Ten honest evidence questions. No compliance score.

Start with collection points, not a theoretical data list. Follow a real journey into the systems, exports and human hand-offs that act on it.

A privacy page is not the same as evidence of what a person saw. Look for purpose-specific text, version history and reachable action routes.

The useful evidence is not merely a yes flag. It connects the action to a purpose, notice version, time, channel and any later withdrawal.

A mailbox is only the front door. The operating evidence includes verification, system search, correction or erasure actions, decisions and communication.

“Keep for three years” is not enough if nobody can detect the start event or perform the deletion across active systems and restore paths.

Start with services that actually receive or can access personal data. Role labels depend on the facts and contract, not the software logo.

Policies help only when they connect to current access, protection, logging, monitoring, continuity and processor arrangements.

Rule 7 separates without-delay communications from the later specified 72-hour detail step. The workflow needs facts, owners and escalation—not a single generic deadline.

For the Act, a child is under 18. Product risk, verifiable parent or lawful-guardian consent and any conditional exception need a fact-specific review.

Only a Central Government notification can designate an organisation or class as a Significant Data Fiduciary. An internal score or DPIA cannot do that.