Data Protection Act Compliance Procedure

Template draft. Replace everything in [square brackets] with your own decision, delete what does not describe what you really do, and approve it through your own document control. It is not legal advice and does not make an organisation compliant or certified.

1. Purpose

This procedure turns the Organisation's duties under the Digital Personal Data Protection Act, 2023 and its Rules into steps that staff can follow every day. [confirm the current requirement]

It explains how personal data is collected, used, shared, protected, corrected, transferred and erased, how requests and complaints from individuals are answered, and how personal data breaches are handled. It supports the Data Protection and Privacy Policy and sits beside the Data Protection and Privacy Procedure, which holds the general privacy practices that apply in every jurisdiction.

Note. This document is a working procedure, not legal advice. Legal and compliance must confirm the current text of the law and any later notifications before the Organisation relies on any timeframe or obligation stated here.

2. Scope

The Organisation's use of the Digital Personal Data Protection Act, 2023 applies to digital personal data processed in India, and to digital personal data processed outside India where it relates to offering goods or services to individuals in India. [confirm the current requirement]

In scope: personal data of customers, customers' end users, employees, candidates, contractors, visitors and supplier contacts, held in any digital system, including customer-facing platforms, email, backups, logs and paper that is later digitised.
In scope people: all employees, contractors and suppliers who collect, view, change, store or share personal data for the Organisation.
In scope situations: where the Organisation decides why and how personal data is processed (acting as the data fiduciary), and where it processes personal data on behalf of a customer (acting as a data processor under contract).
Out of scope: data that has been irreversibly anonymised, business contact details used only in a business context where the law permits this, and personal data processed for purely personal or domestic purposes.
Where the Organisation operates in other places, applicable law in each jurisdiction where the Organisation operates (such as the EU General Data Protection Regulation) is handled by legal and compliance through a jurisdiction annex to this procedure.

3. Terms and Definitions

Term	Meaning
Personal data	Any data about an individual who can be identified by or in relation to that data.
Data principal	The individual to whom personal data relates, such as a customer, employee or candidate. For a child or a person with a disability, this includes the parent or lawful guardian.
Data fiduciary	The party that decides the purpose and means of processing. The Organisation is the data fiduciary for its own staff, candidate and marketing data.
Data processor	A party that processes personal data on behalf of a data fiduciary. The Organisation is a data processor for customers who instruct it to process their data.
Significant data fiduciary	A data fiduciary notified by the government on grounds such as volume and sensitivity of data; it has additional duties, which the Organisation will meet if notified. [confirm the current requirement]
Consent manager	A registered entity through which data principals can give, manage, review and withdraw consent. [confirm the current requirement]
Board	The Data Protection Board of India, the body that receives breach intimations and handles complaints. [confirm the current requirement]
Personal data breach	Any unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data that compromises its confidentiality, integrity or availability.
Processing	Any operation on personal data, including collection, recording, storage, use, sharing, restriction and erasure.
Notice	A clear statement given to the data principal about what is collected, why, how to exercise rights and how to complain.

4. Roles and Responsibilities

Role	Responsibilities
Document owner (Data Protection Officer)	Owns this procedure, advises on obligations, receives rights requests and complaints, leads breach assessment, and liaises with the Board and regulators.
Senior management	Approves the privacy programme, resources it, and accepts residual privacy risk.
Legal and compliance	Tracks changes in law, drafts notices and contract terms, decides on notification duties.
Head of Information Security	Provides technical safeguards, monitors for breaches and supports investigations.
Business process owners	Know what personal data their processes use, maintain the record of processing, and ensure a lawful purpose and retention rule exist.
HR	Handles employee and candidate data, and deletes it in line with retention rules.
Procurement and supplier owners	Ensure processor contracts contain required terms and that suppliers are assessed.
All employees	Handle personal data only for approved purposes, report suspected breaches at once and complete privacy training.

Activity	Responsible	Accountable	Consulted	Informed
Maintain record of processing activities	Business process owners	Data Protection Officer	Legal and compliance	Head of Information Security
Draft notices and manage consent records	Legal and compliance	Data Protection Officer	Business process owners	Senior management
Respond to data principal requests	Data Protection Officer	Senior management	Business process owners; Legal and compliance	Head of Information Security
Assess and notify personal data breaches	Data Protection Officer	Senior management	Head of Information Security; Legal and compliance	Business process owners
Impact assessments for new processing	Business process owners	Data Protection Officer	Head of Information Security	Senior management
Processor and transfer due diligence	Procurement and supplier owners	Data Protection Officer	Legal and compliance; Head of Information Security	Senior management
Retention and erasure	Business process owners	Data Protection Officer	Head of IT	Legal and compliance

5. Data Protection Principles

These principles are applied to every processing activity. They are drawn from the Act and from accepted good practice, and are tested at design time, at consent capture and in audit. [confirm the current requirement]

Principle	What it means in practice	How the Organisation applies it
Lawful, fair and transparent processing	Personal data is processed only for a lawful purpose, for which consent has been given or a legitimate use applies, and individuals are told what happens to their data.	Every purpose is recorded in the register of processing and has a notice and a lawful ground before data is collected.
Notice before consent	Each request for consent comes with a notice in clear and plain language describing the data, the purpose, how to exercise rights and how to complain to the Board. [confirm the current requirement]	Standard notice templates in Annexure E; notices offered in English and [the other languages the Organisation's customers use].
Purpose limitation	Data is used only for the purpose stated at collection or one compatible with it.	A new purpose needs a new lawful ground, an updated notice, and approval from the Data Protection Officer.
Data minimisation	Only the data needed for the purpose is collected.	Forms are reviewed at design; optional fields are marked and not required for service.
Accuracy and completeness	Data used to make a decision about a person, or shared with another party, is kept accurate and complete.	Correction routes, periodic validation of high-impact data, and system checks at entry.
Storage limitation	Data is erased once the purpose is served or consent is withdrawn, unless law requires retention.	Retention schedule in this procedure; automated deletion jobs where possible.
Security safeguards	Reasonable security safeguards are in place to prevent a personal data breach.	Controls in the data security section of this procedure and in the Information Security Policy.
Breach notification	The Board and each affected data principal are informed of a personal data breach in the manner and time prescribed. [confirm the current requirement]	Breach steps in this procedure, with a decision log by the Data Protection Officer.
Accountability	The Organisation can show that it complies, and answers for processors acting for it.	Records, audits, processor contracts and management reporting.
Children and persons with a disability	Verifiable consent from a parent or lawful guardian is needed before processing a child's data, and tracking, behavioural monitoring and targeted advertising directed at children are avoided unless law allows. [confirm the current requirement]	Age checks at sign-up where services could be used by children; no behavioural advertising to users under [18 years].

6. Data Principal Rights

Individuals have rights over their data. The Organisation honours the rights below when it is the data fiduciary, and passes requests to the relevant customer within [2 working days] when it is only a processor. [confirm the current requirement]

Right	What the person can ask for	Organisation response
Access to information	A summary of the personal data processed, the processing activities, and the names of other fiduciaries and processors with whom it is shared.	Provide within [30 days] after identity is verified, unless law gives a different period. [confirm the current requirement]
Correction, completion and updating	Correct inaccurate or misleading data and complete or update it.	Correct within [30 days] and tell parties to whom the data was disclosed where needed.
Erasure	Delete personal data that is no longer needed or where consent is withdrawn, unless retention is required by law.	Erase within [30 days] from all systems and backups at the next backup cycle; tell processors to do the same.
Withdrawal of consent	Stop processing based on consent, as easily as consent was given.	Stop within [2 working days]; the effect and any consequences are explained, and the lawfulness of earlier processing is unaffected.
Grievance redressal	Make a complaint about the Organisation's handling of data.	Acknowledge within [2 working days]; resolve within [15 days]; refer to the Board if the person is not satisfied. [confirm the current requirement]
Nomination	Nominate another person to exercise rights in case of death or incapacity.	Record nominations in the data principal's profile where offered.

6.1 Handling a request

ReceiveRequests are accepted through [the privacy contact form, the privacy email address and any consent manager]. Staff who receive one in any other channel forward it to the Data Protection Officer the same working day.
LogThe Data Protection Officer logs the request in the request register (Annexure A) with a due date counted from receipt.
Verify identityConfirm the requester is the data principal or an authorised representative, asking for the minimum extra information necessary.
SearchBusiness owners and IT search listed systems within [7 working days] and return the data to the Data Protection Officer.
DecideThe Data Protection Officer checks exemptions such as legal retention duties or the rights of others, and records the decision and reason.
RespondSend the response in writing and in an easily readable form; where the request is refused, explain why and how to complain.
CloseRecord completion, evidence of erasure or correction, and lessons learned. Time target: all steps complete within [30 days].

6.2 Requests that the Organisation receives as a processor

The Organisation does not respond directly to the data principal; it forwards the request to the customer within [2 working days] and helps as the contract requires.
Technical help to find, correct or erase data is provided within the time set in the customer contract and logged against the request.

7. Lawful Basis for Processing

Every processing activity needs a lawful ground recorded before it starts. The Act relies on consent and on a list of legitimate uses. [confirm the current requirement]

Ground	When it applies	Evidence kept
Consent	The person agrees through a clear affirmative action to a specified purpose, after notice. It must be free, specific, informed, unconditional and unambiguous, limited to data necessary for the purpose, and capable of withdrawal.	Time-stamped consent record with the notice version, purpose, channel and identifier
Voluntary provision for a specified purpose	The person provides data for a stated purpose and does not object to its use. [confirm the current requirement]	Record of the interaction
State function or legal obligation	Processing needed to perform a function under law, to comply with a court order, or for statutory duties.	Reference to the law or order
Medical emergency, disaster or public health	Processing needed to respond to a threat to life or health, or to public order in a disaster.	Emergency record, decision by senior management
Employment	Processing for purposes of employment or to safeguard the employer from loss or liability, such as preventing corporate espionage. [confirm the current requirement]	Employment contract and HR privacy notice
Processing as a processor	The customer decides the purpose and holds the ground; the Organisation acts on documented instructions.	Customer contract and data processing terms

Consent requests are not bundled with other terms and are not a condition of service beyond the data needed for that service.
Consent records are retained for as long as the processing continues and for [3 years] afterwards.
Where a consent manager is used, the Organisation honours consent and withdrawals signalled by it within [1 working day].
Consent collected before the Act took effect is reviewed by legal and compliance, which decides whether a fresh notice and consent are needed. [confirm the current requirement]

8. Data Protection Officer

The Organisation appoints a Data Protection Officer, based in India, who reports to senior management and is the point of contact for individuals and the Board. A significant data fiduciary must appoint a Data Protection Officer and carry out other duties; the Organisation appoints the role whether or not it has been notified. [confirm the current requirement]

Duties: monitor compliance, advise on impact assessments, run training, receive rights requests and complaints, lead breach response, keep the record of processing and review processor contracts.
The Data Protection Officer must be free of conflicting duties and must have direct access to senior management; the role must not be held by the Head of Information Security or head of a business function that decides purposes of processing.
The contact details are published in the privacy notice and on the website: [dpo@organisation address] and [telephone]. They are kept current by Legal and compliance.
An independent data auditor and periodic data protection impact assessments are arranged if the Organisation is notified as a significant data fiduciary. [confirm the current requirement]

9. Data Security

The Organisation must protect personal data by reasonable security safeguards and must be able to show them. The table links each safeguard to the document that sets it out. [confirm the current requirement]

Safeguard	Requirement	Detail in
Classification	Personal data is classified at least Confidential; sensitive combinations such as identity numbers, financial and health data are Restricted.	Information Classification and Handling Policy
Access control	Access to personal data is by role, approved by the data owner, reviewed every [quarter] and removed on leaving.	Access Control Policy; User Access Management Procedure
Encryption	Personal data is encrypted in transit and at rest; keys are managed separately.	Cryptography Policy; Key Management Process
Masking and pseudonymisation	Non-production use and analytics use masked or pseudonymised data unless approved otherwise.	System Development and Maintenance Procedure
Logging and monitoring	Access to and export of personal data are logged and alerts raised for bulk access. Logs are retained for at least the period the Rules require, and for ICT logs the CERT-In Directions of 28 April 2022 require retention for 180 days within Indian jurisdiction. [confirm the current requirement]	Logging and Monitoring Procedure
Backups	Backups of personal data are encrypted and erased in line with retention.	Backup Management and Retention Procedure
Vulnerability management	Systems that hold personal data are scanned and fixed on the shortened timelines for Critical assets.	Vulnerability Assessment and Penetration Testing Procedure
Physical and device security	Screens locked, clear desk, managed devices with disk encryption, lost devices reported within [4 hours].	Mobile Device and Teleworking Policy
Suppliers	Processors are bound by contract to equivalent safeguards, with audit rights and breach notice within [24 hours].	Supplier Relationship Management Procedure
Awareness	All staff complete privacy training at joining and every [12 months]; HR and support staff complete role-specific training.	HR Security Procedure

9.1 Personal data breach response

Anyone who sees or suspects a personal data breach must report it to the service desk or the Data Protection Officer immediately, and no later than [1 hour]. Staff must not try to investigate or hide an incident.

Report and logThe service desk opens a security incident under the Incident Management Procedure and alerts the Data Protection Officer.
ContainThe Head of Information Security stops further loss: isolate systems, revoke credentials, recall messages.
AssessThe Data Protection Officer, with security and legal, determines what personal data, how many people and what harm are involved within [24 hours] of detection, recording the facts for the decision log.
Notify the Board and individualsIf a personal data breach has occurred, the Organisation intimates the Board and each affected data principal in the form and time prescribed. [confirm the current requirement] The decision, content and time of each notice are recorded.
Report cyber incidentsCyber incidents that fall under the CERT-In Directions of 28 April 2022 are reported to the national agency within 6 hours of noticing them, in addition to any intimation to the Board. [confirm the current requirement]
Notify customersWhere the Organisation is the processor, it informs the affected customer within the time in the contract and no later than [24 hours] after confirmation.
Recover and reviewRestore normal operations, complete a root cause review within [10 working days], and update controls, training and the risk register.

Note. The decision on whether to notify belongs to the Data Protection Officer with senior management and legal advice. No other employee may notify a regulator, customer or individual about a breach without that approval.

10. Data Processing Procedures

10.1 Record of processing activities

Each business process owner lists every processing activity in the register (Annexure C): purpose, data categories, data principals, lawful ground, systems, recipients, processors, transfers outside India, retention period and security measures. The Data Protection Officer reviews the register at least [every 6 months] and when any process changes.

10.2 Privacy impact assessment for new processing

ScreenAny new system, supplier, feature or change that processes personal data is screened by the business owner using the questions in Annexure D.
AssessIf high risk is indicated (large scale, sensitive data, children, new technology, monitoring), the Data Protection Officer leads a full impact assessment with security.
TreatControls are agreed, residual risk is recorded, and the owner accepts or escalates it.
ApproveThe Data Protection Officer signs before the project passes the planning gate in the System Development and Maintenance Procedure.

10.3 Engaging processors and sharing data

Data is shared with a processor only under a written contract that limits use to documented instructions, requires equivalent safeguards, breach notice, help with rights requests, return or deletion at end, and flow-down to sub-processors, per the Supplier Relationship Management Procedure.
Sharing with any other party, including group companies, needs a lawful ground, a data sharing note recorded in the register and Data Protection Officer approval.
Requests from authorities are sent to Legal and compliance; staff must not disclose personal data in response to an informal request.

10.4 Marketing and communications

Marketing messages are sent only to people who have consented for that channel, and every message gives a simple way to withdraw.
Do-not-disturb and opt-out lists are applied before each campaign, and checked within [24 hours] of a withdrawal.
Purchased or scraped contact lists are not used.

10.5 Employee and candidate data

HR gives a notice at hiring covering the purposes of employment processing, monitoring and background checks.
Candidate data is deleted [6 months] after the selection process unless the candidate agrees to be kept for future roles.
Monitoring of staff is limited to what the Acceptable Usage Policy states and is proportionate.

11. Cross-Border Data Transfers

The Act permits transfers of personal data outside India except to countries or territories the government may restrict by notification, and other laws or sector rules may impose stricter limits. [confirm the current requirement]

IdentifyThe register of processing lists every transfer, the destination country, the recipient and the purpose.
CheckLegal and compliance checks the current list of restricted territories, sector rules, customer contract terms and rules in other jurisdictions (such as the EU General Data Protection Regulation) before transfer starts.
ProtectContracts with the recipient include safeguards equivalent to this procedure; data is encrypted in transit and at rest.
ApproveThe Data Protection Officer approves each new destination and records it; transfers to restricted destinations are blocked.
MonitorCloud regions and support access are reviewed [every 6 months] so that data does not move without approval.

Customer data that a contract requires to stay in a specified country stays there, including backups and support access.

12. Monitoring and Auditing

Activity	Frequency	By
Review of the record of processing	[Every 6 months]	Data Protection Officer
Sample check of consent records against notices	[Quarterly]	Legal and compliance
Rights request log review for timeliness	[Monthly]	Data Protection Officer
Access review for personal data systems	[Quarterly]	System owners
Processor assessments (High and Critical)	[Annually]	Supplier owner and Data Protection Officer
Retention and erasure test on a sample	[Every 6 months]	Data Protection Officer
Internal audit of this procedure	[Annually]	Internal audit
Management report on privacy	[Quarterly]	Data Protection Officer

13. Security of Personal Data in Use

Staff must not copy personal data to personal devices, personal email or unapproved tools, including public generative AI services, as set out in the Employee AI Usage Policy.
Personal data in screenshots, exports and test files is deleted after use.
Printing of Restricted personal data needs the data owner's approval and the printout is shredded when no longer needed.
Bulk export of personal data needs a ticket with business reason and approval from the data owner.

14. Data Retention

Personal data is kept only as long as the purpose requires or as law demands. The schedule gives sample periods for the adopter to confirm with legal and compliance.

Data category	Retention period	Disposal
Customer account and contact data	Duration of relationship plus [1 year]	Erase or anonymise
Transaction and invoice records	[8 years] or as required by law	Secure deletion
Support tickets and call records	[2 years]	Erase
Marketing consent and preference records	Duration of consent plus [3 years]	Erase
Employee records	Employment plus [7 years]	Erase
Candidate records	[6 months] after decision	Erase
Access and traffic logs	At least [1 year] where required by law, and 180 days minimum within India for ICT logs [confirm the current requirement]	Automatic expiry
CCTV footage	[30 days]	Overwrite
Backups holding personal data	[35 days] rolling	Overwrite at cycle end

Data past its retention period is deleted by the business owner within [60 days], and the deletion is logged.
Legal holds suspend deletion only on written instruction from Legal and compliance.
Erasure includes copies held by processors; the owner obtains written confirmation.

15. Contact Information

Contact	Details
Data Protection Officer	[name, email address, postal address and telephone]
Grievance officer for individuals	[name, email address, response time]
Legal and compliance	[email address]
Service desk for suspected breaches	[telephone and email address]

16. Measures

Measure	Target	How it is measured
Rights requests completed within [30 days]	[100 percent]	Request register
Processing activities in the register with lawful ground	[100 percent]	Register review
Staff with current privacy training	[100 percent]	Training records
Suspected breaches assessed within [24 hours]	[100 percent]	Incident records
New projects with a completed privacy screening before build	[100 percent]	Planning gate records
Processors with a signed data processing addendum	[100 percent]	Supplier register
Data deleted by retention date	[95 percent]	Deletion log sampling

17. Records and Evidence

Record	Kept by	Location	Retention
Record of processing activities	Data Protection Officer	Privacy register	Current plus [3 years] of versions
Consent records and notice versions	Legal and compliance	Consent store	Duration plus [3 years]
Rights request log and responses	Data Protection Officer	Privacy register	[3 years]
Breach register and decision log	Data Protection Officer	Restricted repository	[7 years]
Impact assessments	Data Protection Officer	Document management system	Life of processing plus [3 years]
Training records	HR	Learning platform	[3 years]

Annexure A: Data principal request register

Ref	Date received	Requester and identity check	Type of request	Due date
R-0001	[1 Mar]	[name, ID verified]	Access	[31 Mar]

Annexure B: Personal data breach register

Ref	Date detected	Description	Data and people affected	Board and individuals notified (date)	Cause and fixes
PB-0001

Annexure C: Record of processing activities template

Field	Entry
Activity and owner
Purpose and lawful ground
Categories of personal data
Categories of data principals and approximate numbers
Systems and locations
Recipients and processors
Transfers outside India and safeguards
Retention period and disposal method
Security measures
Last review date

Annexure D: Privacy screening questions

Question	Yes / No	Action if yes
Does the change collect or use personal data?		Continue screening
Is the data of children or sensitive categories?		Full impact assessment
Is data used for a new purpose?		New notice and ground
Will data be shared with a new party or sent outside India?		Processor and transfer review
Is monitoring or profiling of individuals involved?		Full impact assessment
Is the data volume large for the Organisation?		Full impact assessment

Annexure E: Notice content checklist

Content	Included (Y/N)
Identity and contact details of the Organisation and its Data Protection Officer
Description of personal data and the purpose of each use
How to withdraw consent and how this is as easy as giving it
How to exercise rights of access, correction, erasure and nomination
How to make a complaint, and the right to approach the Board
Recipients, processors and transfers outside India
Retention period or criteria
Language: plain, and available in [the languages the Organisation's customers use]

18. Exception

Exceptions to this document are allowed only where compliance is not practicable and the risk has been assessed. A request must state what is to be excepted, why, the risk it creates, the compensating controls, and an end date no later than [6 months]. It is approved in writing by the document owner and the risk owner, recorded in the exceptions register, and reviewed at the end date. An exception does not change the document.

19. Enforcement

Compliance is monitored through internal audits, management review and routine checks by the document owner. Non-compliance is reported through the incident or non-conformity process and handled under the organisation's disciplinary procedure, and under the terms of any contract for people who are not employees. Serious or repeated non-compliance may lead to loss of access and, where the law is broken, to referral to the authorities.

20. Review

This document is reviewed at least every [12 months], and when there is a significant change to the organisation, its systems, its risks or the law, or after an incident that shows it was not effective. Each review is recorded in the revision history.

ISO/IEC 27001:2022 references

Reference	Title
A.5.34	Privacy and protection of PII
A.5.31	Legal, statutory, regulatory and contractual requirements
A.5.33	Protection of records
A.8.10	Information deletion
A.8.11	Data masking
A.8.12	Data leakage prevention
A.5.14	Information transfer