Notice · s.5, Rule 3
Does every place you collect personal data show a notice listing each purpose separately, with the data that purpose needs and how to withdraw?
Languages · Rule 3
Can a person read that notice in their own language, from the 22 scheduled languages, if they choose?
Consent · s.6
Does each purpose have its own switch that starts off, with reject as easy as accept?
Proof · s.6(10)
If a customer disputed their consent tomorrow, could you show the exact notice text they saw, the time, and a record that cannot have been edited since?
Rights · s.11–s.14
Can a person see their consents, withdraw one, and raise an access, correction, erasure, nomination or grievance request themselves?
Clocks · Rule 14
Is every rights request tracked against the 30-day deadline (90 for grievances), with an owner and a reminder before it is late?
Identity · s.11
Do you verify a requester's identity before disclosing or erasing their data?
Breach · s.8(6), Rule 7
If a breach were discovered now, is there a process that gets a report with the required contents to the Board within 72 hours and a notice to every affected person?
Erasure · s.8(7)
When a purpose is served or consent is withdrawn, is the data actually erased, including at your processors?
Processors · s.8(2)
Do you have a register of every processor that holds personal data, with a valid contract for each, and do withdrawals reach them?
Inventory · s.8(4), s.8(5)
Do you know every system, store and file share that holds Indian personal data, and which identifiers (Aadhaar, PAN, phone) are in each?
Assessment · s.10
Have you assessed the privacy impact of your riskiest processing, with risks, mitigations and owners written down and reviewed?