From official status to retrievable evidence.

1. 01 / Official source + status

   Act No. 22 of 2023

   Digital Personal Data Protection Act, 2023

   Provision

   Act s. 4

   Status

   Notified for 2027-05-13

   Source checked

   2026-09-27

   Open official record ↗Commencement notification · G.S.R. 843(E)↗

   Status source checked 2026-09-27.

2. 02 / Named control

   MAP-01

   Collection-point inventory

   List forms, interfaces, imports and human collection paths.

   Inspect the full control
3. 03 / Vendor action + journey

   Zoho CRM

   Profiles, roles, sharing rules, privileged capabilities and API identities are owned and reviewed.

   Verify in the current admin console

   1. Collectform · import · manual
   2. CRM recordfields · notes · files
   3. Automatescore · route · notify
   4. Connectmail · support · API
   5. Evidenceaudit · export · version
   6. Endclose · delete · residual
   Open the verified-boundary guide
4. 04 / Readiness question

   Inventory

   Can you trace where personal data enters and travels?

   Start with collection points, not a theoretical data list. Follow a real journey into the systems, exports and human hand-offs that act on it.

   Answer with four honest states
5. 05 / Evidence artefact

   Owned register

   Owned collection-point register

   Suggested next action: Trace one recent lead or customer journey from collection to every destination.

   Save internally in an approved location. This preview accepts no uploads.

Reviewed 2026-08-20. The relationship is editorial implementation guidance. Verify the source, vendor console, organisation facts and qualified advice before relying on it.

1. 01 / Official source + status

   Act No. 22 of 2023

   Digital Personal Data Protection Act, 2023

   Provision

   Act ss. 11–15

   Status

   Notified for 2027-05-13

   Source checked

   2026-09-27

   Open official record ↗Commencement notification · G.S.R. 843(E)↗

   Status source checked 2026-09-27.

2. 02 / Named control

   RIGHTS-01

   Rights intake

   Name a channel, verification step and owner.

   Inspect the full control
3. 03 / Vendor action + journey

   Salesforce

   Object, field, record and export access match job need.

   Verify in the current admin console

   1. Collectweb · import · API
   2. Objectsstandard · custom · files
   3. Processflow · case · campaign
   4. Packagesapp · sync · export
   5. Evidencehistory · audit · report
   6. Endarchive · delete · residual
   Open the verified-boundary guide
4. 04 / Readiness question

   Rights

   Can your team complete a real Data Principal request?

   A mailbox is only the front door. The operating evidence includes verification, system search, correction or erasure actions, decisions and communication.

   Answer with four honest states
5. 05 / Evidence artefact

   Request register

   Owned request register

   Suggested next action: Run a synthetic request through intake, search, decision and response.

   Save internally in an approved location. This preview accepts no uploads.

Reviewed 2026-08-20. The relationship is editorial implementation guidance. Verify the source, vendor console, organisation facts and qualified advice before relying on it.

1. 01 / Official source + status

   Act No. 22 of 2023

   Digital Personal Data Protection Act, 2023

   Provision

   Act ss. 11–15

   Status

   Notified for 2027-05-13

   Source checked

   2026-09-27

   Open official record ↗Commencement notification · G.S.R. 843(E)↗

   Status source checked 2026-09-27.

2. 02 / Named control

   RIGHTS-01

   Rights intake

   Name a channel, verification step and owner.

   Inspect the full control
3. 03 / Vendor action + journey

   Freshworks / Freshsales

   Required configuration events are retrievable for the available period.

   Verify in the current admin console

   1. Collectform · email · chat
   2. Recordcontact · ticket · deal
   3. Agentreply · note · attach
   4. ConnectCRM · bot · telephony
   5. Evidenceaudit · export · access
   6. Endclose · retain · delete
   Open the verified-boundary guide
4. 04 / Readiness question

   Rights

   Can your team complete a real Data Principal request?

   A mailbox is only the front door. The operating evidence includes verification, system search, correction or erasure actions, decisions and communication.

   Answer with four honest states
5. 05 / Evidence artefact

   Request register

   Owned request register

   Suggested next action: Run a synthetic request through intake, search, decision and response.

   Save internally in an approved location. This preview accepts no uploads.

Reviewed 2026-08-20. The relationship is editorial implementation guidance. Verify the source, vendor console, organisation facts and qualified advice before relying on it.

1. 01 / Official source + status

   Act No. 22 of 2023

   Digital Personal Data Protection Act, 2023

   Provision

   Act s. 6

   Status

   Notified for 2027-05-13

   Source checked

   2026-09-27

   Open official record ↗Commencement notification · G.S.R. 843(E)↗

   Status source checked 2026-09-27.

2. 02 / Named control

   CONSENT-02

   Withdrawal route

   Test a route that is as easy to find as the consent path.

   Inspect the full control
3. 03 / Vendor action + journey

   HubSpot

   The team knows which user actions are recorded and for how long.

   Verify in the current admin console

   1. Collectform · chat · import
   2. Contactproperty · source · file
   3. Activatelist · workflow · send
   4. Connectapp · ads · sync
   5. Evidenceaudit · preference · export
   6. Endremove · delete · residual
   Open the verified-boundary guide
4. 04 / Readiness question

   Choice

   Can you prove and propagate a choice where consent is relied on?

   The useful evidence is not merely a yes flag. It connects the action to a purpose, notice version, time, channel and any later withdrawal.

   Answer with four honest states
5. 05 / Evidence artefact

   Choice event

   Choice event with purpose key

   Suggested next action: Select one optional purpose and trace consent and withdrawal through every connected channel.

   Save internally in an approved location. This preview accepts no uploads.

Reviewed 2026-08-20. The relationship is editorial implementation guidance. Verify the source, vendor console, organisation facts and qualified advice before relying on it.

1. 01 / Official source + status

   Act No. 22 of 2023

   Digital Personal Data Protection Act, 2023

   Provision

   Act s. 8

   Status

   Notified for 2027-05-13

   Source checked

   2026-09-27

   Open official record ↗Commencement notification · G.S.R. 843(E)↗

   Status source checked 2026-09-27.

2. 02 / Named control

   PROC-01

   Processor register

   List processors, data flows, access and review dates.

   Inspect the full control
3. 03 / Vendor action + journey

   Google Workspace

   Admin roles, service accounts and OAuth grants are least-privileged and reviewed.

   Verify in the current admin console

   1. Collectform · email · file
   2. Identityuser · group · service
   3. Repositoriesmail · drive · calendar
   4. Sharelink · domain · OAuth
   5. Evidenceaudit · Vault · export
   6. Endtransfer · hold · delete
   Open the verified-boundary guide
4. 04 / Readiness question

   Processors

   Can you reconcile vendors, contracts, access and data locations?

   Start with services that actually receive or can access personal data. Role labels depend on the facts and contract, not the software logo.

   Answer with four honest states
5. 05 / Evidence artefact

   Service register

   Current service and processor register

   Suggested next action: Compare the last three purchased software services with the processor register.

   Save internally in an approved location. This preview accepts no uploads.

Reviewed 2026-08-20. The relationship is editorial implementation guidance. Verify the source, vendor console, organisation facts and qualified advice before relying on it.

1. 01 / Official source + status

   Act No. 22 of 2023

   Digital Personal Data Protection Act, 2023

   Provision

   Act s. 8

   Status

   Notified for 2027-05-13

   Source checked

   2026-09-27

   Open official record ↗Commencement notification · G.S.R. 843(E)↗

   Status source checked 2026-09-27.

2. 02 / Named control

   SEC-01

   Access review

   Review least-privilege access at a stated cadence.

   Inspect the full control
3. 03 / Vendor action + journey

   Microsoft 365

   Privileged roles and service principals are reviewed at the right scope.

   Verify in the current admin console

   1. Collectmail · Teams · forms
   2. Entrauser · guest · app
   3. Workloadsmail · site · drive
   4. Connectlink · Graph · Power
   5. Purviewaudit · search · retain
   6. Endhold · transfer · delete
   Open the verified-boundary guide
4. 04 / Readiness question

   Safeguards

   Can you show safeguards operating in the systems that matter?

   Policies help only when they connect to current access, protection, logging, monitoring, continuity and processor arrangements.

   Answer with four honest states
5. 05 / Evidence artefact

   System control record

   System safeguard record

   Suggested next action: Choose the highest-impact system and verify three stated safeguards through current evidence.

   Save internally in an approved location. This preview accepts no uploads.

Reviewed 2026-08-20. The relationship is editorial implementation guidance. Verify the source, vendor console, organisation facts and qualified advice before relying on it.

1. 01 / Official source + status

   Act No. 22 of 2023

   Digital Personal Data Protection Act, 2023

   Provision

   Act s. 6

   Status

   Notified for 2027-05-13

   Source checked

   2026-09-27

   Open official record ↗Commencement notification · G.S.R. 843(E)↗

   Status source checked 2026-09-27.

2. 02 / Named control

   CONSENT-02

   Withdrawal route

   Test a route that is as easy to find as the consent path.

   Inspect the full control
3. 03 / Vendor action + journey

   WhatsApp Business / Meta messaging

   The person sees the appropriate notice before or at collection.

   Verify in the current admin console

   1. EntryQR · link · inbound
   2. Channelphone · message · media
   3. Routewebhook · inbox · bot
   4. Actagent · template · note
   5. Evidencechoice · log · status
   6. Endclose · export · delete
   Open the verified-boundary guide
4. 04 / Readiness question

   Choice

   Can you prove and propagate a choice where consent is relied on?

   The useful evidence is not merely a yes flag. It connects the action to a purpose, notice version, time, channel and any later withdrawal.

   Answer with four honest states
5. 05 / Evidence artefact

   Choice event

   Choice event with purpose key

   Suggested next action: Select one optional purpose and trace consent and withdrawal through every connected channel.

   Save internally in an approved location. This preview accepts no uploads.

Reviewed 2026-08-20. The relationship is editorial implementation guidance. Verify the source, vendor console, organisation facts and qualified advice before relying on it.

1. 01 / Official source + status

   Act No. 22 of 2023

   Digital Personal Data Protection Act, 2023

   Provision

   Act s. 5

   Status

   Notified for 2027-05-13

   Source checked

   2026-09-27

   Open official record ↗Commencement notification · G.S.R. 843(E)↗

   Status source checked 2026-09-27.

2. 02 / Named control

   NOTICE-01

   Notice version

   Archive the notice displayed at each collection point.

   Inspect the full control
3. 03 / Vendor action + journey

   Shopify / WooCommerce

   Every extension has a purpose, scope, owner and exit decision.

   Verify in the current admin console

   1. Storefrontaccount · cart · checkout
   2. Ordercustomer · address · item
   3. Fulfilpay · ship · support
   4. Extendapp · plugin · webhook
   5. Evidencescope · request · export
   6. Endretain · anonymise · erase
   Open the verified-boundary guide
4. 04 / Readiness question

   Notice

   Can you retrieve the notice shown at each collection point?

   A privacy page is not the same as evidence of what a person saw. Look for purpose-specific text, version history and reachable action routes.

   Answer with four honest states
5. 05 / Evidence artefact

   Versioned notice

   Versioned notice archive

   Suggested next action: Choose the busiest form and archive its exact notice, version and destination links.

   Save internally in an approved location. This preview accepts no uploads.

Reviewed 2026-08-20. The relationship is editorial implementation guidance. Verify the source, vendor console, organisation facts and qualified advice before relying on it.

1. 01 / Official source + status

   Act No. 22 of 2023

   Digital Personal Data Protection Act, 2023

   Provision

   Act s. 8

   Status

   Notified for 2027-05-13

   Source checked

   2026-09-27

   Open official record ↗Commencement notification · G.S.R. 843(E)↗

   Status source checked 2026-09-27.

2. 02 / Named control

   PROC-02

   Processor instructions

   Keep written purpose and security instructions.

   Inspect the full control
3. 03 / Vendor action + journey

   Razorpay

   Dashboard privileges match payment-operation need.

   Verify in the current admin console

   1. Checkoutorder · contact · amount
   2. Paymentattempt · status · ID
   3. Webhooksigned · delivered · retried
   4. OperationsCRM · support · finance
   5. Evidencerole · event · export
   6. Endretain · dispute · dispose
   Open the verified-boundary guide
4. 04 / Readiness question

   Processors

   Can you reconcile vendors, contracts, access and data locations?

   Start with services that actually receive or can access personal data. Role labels depend on the facts and contract, not the software logo.

   Answer with four honest states
5. 05 / Evidence artefact

   Service register

   Current service and processor register

   Suggested next action: Compare the last three purchased software services with the processor register.

   Save internally in an approved location. This preview accepts no uploads.

Reviewed 2026-08-20. The relationship is editorial implementation guidance. Verify the source, vendor console, organisation facts and qualified advice before relying on it.

1. 01 / Official source + status

   Act No. 22 of 2023

   Digital Personal Data Protection Act, 2023

   Provision

   Act s. 8

   Status

   Notified for 2027-05-13

   Source checked

   2026-09-27

   Open official record ↗Commencement notification · G.S.R. 843(E)↗

   Status source checked 2026-09-27.

2. 02 / Named control

   RET-01

   Retention schedule

   Set an event trigger, owner and periodic review date.

   Inspect the full control
3. 03 / Vendor action + journey

   Tally / spreadsheet hand-offs

   Application privileges match finance roles.

   Verify in the current admin console

   1. Entermaster · voucher · import
   2. Company dataledger · invoice · ID
   3. Financereconcile · report · file
   4. Exportsheet · email · accountant
   5. Evidenceuser · register · backup
   6. Endretain · restrict · dispose
   Open the verified-boundary guide
4. 04 / Readiness question

   Retention

   Does every important data class have an executable end event?

   “Keep for three years” is not enough if nobody can detect the start event or perform the deletion across active systems and restore paths.

   Answer with four honest states
5. 05 / Evidence artefact

   Event-based schedule

   Event-based retention schedule

   Suggested next action: Define one deletion event in operational terms and test whether the system can detect it.

   Save internally in an approved location. This preview accepts no uploads.

Reviewed 2026-08-20. The relationship is editorial implementation guidance. Verify the source, vendor console, organisation facts and qualified advice before relying on it.

1. 01 / Official source + status

   Act No. 22 of 2023

   Digital Personal Data Protection Act, 2023

   Provision

   Act s. 8

   Status

   Notified for 2027-05-13

   Source checked

   2026-09-27

   Open official record ↗Commencement notification · G.S.R. 843(E)↗

   Status source checked 2026-09-27.

2. 02 / Named control

   SEC-02

   Security safeguards

   Link practical safeguards to systems and owners.

   Inspect the full control
3. 03 / Vendor action + journey

   Amazon Web Services

   Every relevant service and region has an owner and data class.

   Verify in the current admin console

   1. ApplicationAPI · event · upload
   2. ServicesDB · object · queue
   3. Accessrole · key · account
   4. Copieslog · replica · pipeline
   5. EvidenceCloudTrail · config · alert
   6. Enddelete · snapshot · restore
   Open the verified-boundary guide
4. 04 / Readiness question

   Safeguards

   Can you show safeguards operating in the systems that matter?

   Policies help only when they connect to current access, protection, logging, monitoring, continuity and processor arrangements.

   Answer with four honest states
5. 05 / Evidence artefact

   System control record

   System safeguard record

   Suggested next action: Choose the highest-impact system and verify three stated safeguards through current evidence.

   Save internally in an approved location. This preview accepts no uploads.

Reviewed 2026-08-20. The relationship is editorial implementation guidance. Verify the source, vendor console, organisation facts and qualified advice before relying on it.

1. 01 / Official source + status

   Act No. 22 of 2023

   Digital Personal Data Protection Act, 2023

   Provision

   Act s. 8

   Status

   Notified for 2027-05-13

   Source checked

   2026-09-27

   Open official record ↗Commencement notification · G.S.R. 843(E)↗

   Status source checked 2026-09-27.

2. 02 / Named control

   SEC-02

   Security safeguards

   Link practical safeguards to systems and owners.

   Inspect the full control
3. 03 / Vendor action + journey

   Microsoft Azure

   Directory, resource and data-plane access are reviewed separately.

   Verify in the current admin console

   1. ApplicationAPI · event · upload
   2. ResourcesDB · storage · queue
   3. AccessEntra · RBAC · identity
   4. Copieslog · replica · pipeline
   5. Evidenceactivity · resource · alert
   6. Endsoft delete · backup · restore
   Open the verified-boundary guide
4. 04 / Readiness question

   Safeguards

   Can you show safeguards operating in the systems that matter?

   Policies help only when they connect to current access, protection, logging, monitoring, continuity and processor arrangements.

   Answer with four honest states
5. 05 / Evidence artefact

   System control record

   System safeguard record

   Suggested next action: Choose the highest-impact system and verify three stated safeguards through current evidence.

   Save internally in an approved location. This preview accepts no uploads.

Reviewed 2026-08-20. The relationship is editorial implementation guidance. Verify the source, vendor console, organisation facts and qualified advice before relying on it.