Data Protection and Privacy Procedure

1. Purpose

This procedure turns the Data Protection and Privacy Policy into repeatable steps. It sets how the Organisation finds personal data, decides why and for how long it may hold it, protects it in storage and in transit, controls who can reach it, obtains and records consent, assesses privacy risk before new processing, answers requests from individuals, and removes the data when the reason for holding it ends.

It also gives staff one place to look when they need to know what to do with personal data on an ordinary working day.

2. Scope

• In scope: all personal data processed by the Organisation as owner of the purpose (employees, candidates, customers' contacts, website visitors, suppliers' staff) and personal data processed on behalf of customers, in any form: electronic, paper, audio, video, images and backups.
• In scope: every system, application, cloud service, device, premises, supplier and project that collects, stores, shares or deletes personal data, and every employee, contractor and third party who handles it.
• Out of scope: anonymised data that cannot be linked back to a person by any party with reasonable means, and non-personal business data, which follows the Information Classification and Handling Procedure.
• Where the Organisation operates in several jurisdictions, the strictest applicable requirement is applied unless the Data Protection Officer records a justified exception.

3. Terms and definitions

4. Roles and Responsibilities

5. PII Identification

5.1 Build and keep the processing inventory

The Organisation cannot protect what it has not found. The Data Protection Officer keeps one processing inventory that lists, for every process that uses personal data, the categories of data, the individuals concerned, the purpose, the lawful basis, the systems and suppliers involved, where data is stored, who can access it, recipients, transfers abroad and the retention period. The record format is in Annexure C.

1. ScopeThe Data Protection Officer sends each business owner the inventory template and a list of their systems from the asset inventory. Target: at first adoption and then every [12 months].
2. DescribeThe owner lists each process that uses personal data and completes the record, naming the system of record and any copies, exports and reports.
3. DiscoverThe information security team runs data discovery on file shares, databases, mailboxes and cloud storage using pattern matching for identifiers such as account numbers and national identity numbers. Unexpected stores are added to the inventory or removed.
4. ClassifyAssign each data category a sensitivity from the table below and the matching classification under the Information Classification and Handling Procedure.
5. ApproveThe Data Protection Officer reviews for completeness and sign-off is recorded. Gaps become actions with owners and dates.
6. MaintainAny new system, supplier, purpose or data field triggers an inventory update before go-live, through the change process.

5.2 Categories of personal data and their handling level

If a data set mixes categories, it takes the highest level. If there is doubt whether data is personal, it is treated as personal until the Data Protection Officer decides otherwise.

5.3 Signs that personal data is present in an unexpected place

• Spreadsheet exports, test databases copied from production, screenshots in tickets, and log files that record request bodies.
• Email attachments, chat messages and shared drives used as informal databases.
• Backups, archived projects and legacy systems that nobody currently owns.
• Free-text fields where users type identifiers or health details.
• Paper forms, notebooks, whiteboards and printed reports left in shared areas.

6. Protection of PII

6.1 Principles applied to all personal data

• Collect only the data needed for the stated purpose (minimisation), and do not collect a field because it might be useful later.
• Use data only for the purpose notified; a new purpose needs a new lawful basis and a DPIA screening.
• Keep data accurate and up to date, and give individuals a route to correct it.
• Keep data only as long as the purpose or a legal duty requires (see data purging).
• Protect data with safeguards that match its sensitivity, from collection to deletion.
• Be able to show, with records, that each of these was done (accountability).

6.2 Safeguards through the data lifecycle

6.3 Minimisation, masking and pseudonymisation

Where a task does not need to know who a person is, the person is not identified. Reports and analytics use pseudonymous identifiers; customer service screens mask all but the last [4] characters of account and identity numbers; support staff reveal a full value only with a reason recorded in the ticket. Test and training data is generated or masked. Production personal data is copied into a non-production environment only with written approval from the Data Protection Officer, and is masked before it leaves production.

6.4 Physical and printed personal data

• Paper containing High-sensitivity data is kept in locked storage, printed only when necessary, collected from printers at once and shredded when no longer needed.
• Visitors and cleaners are not left alone with unlocked records.
• Clear desk and clear screen rules in the Acceptable Usage Policy apply to every workspace, including homes of remote workers.
• Devices carrying personal data have full-disk encryption and remote wipe enabled before issue.

6.5 Transfers outside the country

Personal data is sent to another country only after the Data Protection Officer confirms that the transfer is permitted by applicable data protection law and any customer contract, that the destination country is not restricted by the Government, and that an agreement with the recipient binds it to equivalent safeguards. The destination and the safeguard are recorded in the processing inventory. The Organisation checks the position under the Digital Personal Data Protection Act, 2023 [confirm the current requirement] and any notified restrictions before each new destination is used.

7. Network and Transmission of PII

Data loss prevention rules detect personal identifiers leaving through email, web upload and removable media. Alerts are triaged by the information security team within [1 working day]; a confirmed leak is handled as an incident under the Incident Management Procedure. Keys and encryption settings follow the Cryptography Procedure.

8. Access Control to PII

• Access to personal data is granted by role on a need-to-know basis, approved by the data owner, and issued under the User Access Management Procedure.
• High-sensitivity data requires multi-factor authentication and, for bulk export, a second approver.
• Administrators do not browse personal data; production data access by administrators is by break-glass request and is reviewed afterwards.
• Access rights are reviewed by data owners at least every [6 months] for High-sensitivity systems and [12 months] for others; removal after transfer or exit is within [1 working day].
• Shared accounts are not used on systems holding personal data.
• Bulk download, report scheduling and API keys that return personal data need data owner approval and are listed in the inventory.
• Supplier access is time-limited, sponsored by a named employee and removed at the end of the task.

9. Data Purging

9.1 Retention and deletion rules

Each data category in the inventory has a retention period and a trigger. Personal data is deleted or irreversibly anonymised when the trigger occurs unless a law, a contract or a legal hold requires it to be kept. Default retention is set in the Documents and Records Management Procedure; where this procedure sets a shorter period for personal data, the shorter one applies.

9.2 Purging steps

1. IdentifyEach month the process owner lists records that reached their trigger, using reports from the system or a discovery scan. Output: purge list.
2. CheckConfirm that no legal hold, open request, dispute or audit needs the data. The Data Protection Officer decides doubtful cases.
3. ApproveThe process owner approves the purge list; the Data Protection Officer approves anything over [10,000 records] or any High-sensitivity data.
4. DeleteIT operations deletes the records from the live system, search indexes, caches, exports and replicas, using a method consistent with the Asset Disposal Process for media.
5. VerifyA second person checks a sample and the system confirms the count. Records restored from backup are re-deleted immediately.
6. EvidenceRecord date, scope, count, method and approvers in the purge log. Target: complete within [30 days] of the trigger.

9.3 Suppliers and individual deletion requests

Suppliers that hold copies are instructed in writing to delete them and to confirm in writing within [15 working days]. When an individual asks for erasure, the request is handled under the rights process and the purge steps above are used, with the exceptions the law allows recorded in the register.

10. Logging and Monitoring of PII Processing

Systems that hold personal data record who accessed, changed, exported or deleted it, from where and when. Logs follow the Logging and Monitoring Procedure and are protected against change. Log content must not itself become a store of personal data: identifiers are masked or tokenised where practicable, and request bodies, passwords and full card numbers are never logged.

Security logs are kept for [180 days] within Indian jurisdiction where the CERT-In Directions of 28 April 2022 apply [confirm the current requirement]. Unusual access patterns, such as an employee viewing many unrelated records, trigger an alert and a documented review.

11. Consent and Notice

11.1 When consent is the basis

Consent is used where no other lawful basis applies. Where the law permits other legitimate uses, for example performing a contract, meeting a legal duty or responding to a medical emergency, the process owner records that basis instead and the Data Protection Officer confirms it. Consent is never bundled into general terms and is never a condition for a service that does not need the data.

11.2 Consent record and lifecycle

1. DesignThe process owner drafts the notice and consent wording and sends it to the Data Protection Officer. Output: approved wording and version number.
2. CaptureThe consent interface records principal reference, purpose, version of notice, date and time, channel, and the action taken.
3. StoreStore the record in a system that cannot be edited without an audit trail and keep it for as long as the data is processed plus [3 years].
4. ApplyDownstream systems check the consent status before using data for each purpose, including marketing exports.
5. RefreshRe-confirm consent when the purpose, notice or data changes, and for long-running consents every [24 months].
6. WithdrawOn withdrawal, stop processing for that purpose within [3 working days], update suppression lists and tell processors. Delete the data unless another basis or a legal duty requires it.

11.3 Audit of consent

Each quarter the Data Protection Officer samples [50] consent records and checks wording, evidence, withdrawals honoured and marketing lists. Defects are logged as non-conformities with owners and dates.

12. Secure PII Processing

12.1 Processing on the Organisation's own account

• Every use of personal data is tied to a recorded purpose in the processing inventory; staff must not copy data into personal tools, personal email or unapproved AI services.
• Automated decisions that significantly affect people are identified in the DPIA and given a human review route.
• Development follows the System Development and Maintenance Procedure: privacy requirements are set at design, and production data is not used for testing.
• New systems, suppliers and purposes go through a privacy check at the start of the project, using the DPIA screening questions.

12.2 Processing on behalf of customers

When the Organisation processes customer data, it does so only on the customer's documented instructions and for the agreed service. Staff do not use customer data for their own purposes, product improvement or analytics unless the contract allows it. The Organisation helps the customer meet its duties, including rights requests, security and breach notification, within the times in the contract, and returns or deletes data at the end of the service.

12.3 Using processors and sub-processors

1. AssessBefore selection, the Data Protection Officer and the information security team assess the supplier's safeguards under the Supplier Relationship Management Procedure.
2. ContractSign an agreement before data is shared that covers: subject and duration, nature and purpose, types of data, instructions only, confidentiality of staff, security measures, sub-processor approval, assistance with rights and breaches, audit rights, breach notice within [24 hours], return or deletion, and transfers.
3. RecordList the processor in the processing inventory with data shared and location.
4. MonitorReview the processor each [12 months] against the agreement: certificates, audit reports, incidents, sub-processor changes.
5. ExitAt exit, obtain written confirmation of deletion or return within [30 days].

12.4 Breach of personal data

Any person who suspects loss or exposure of personal data reports it immediately under the Incident Management Procedure. The Data Protection Officer joins the incident within [2 hours] of notice, assesses the data, number of individuals and likely harm, and advises management on informing the Data Protection Board of India and affected individuals, as the Digital Personal Data Protection Act, 2023 and its Rules may require [confirm the current requirement]. Customers are told within the time in their contracts. Every breach, including those not notified, is recorded with facts, effects and action taken.

13. Data Protection Impact Assessment Procedure

13.1 When a DPIA is required

A DPIA screening is completed at the start of every project, change or supplier selection that touches personal data. A full DPIA is required when any of the following applies.

• Large-scale processing, or processing of High-sensitivity data or of children's data.
• Profiling, scoring, automated decisions or systematic monitoring of individuals.
• New technology or a new use of data, including use of artificial intelligence or biometrics.
• Combining data sets from different sources, or sharing with a new category of recipient.
• Transfers to a country not previously used.
• Designation as a significant data fiduciary, where the law requires periodic assessments [confirm the current requirement].

13.2 DPIA steps

1. ScreenThe project lead completes the screening questions. If any answer is yes, a full DPIA is opened. Target: within [5 working days] of project start.
2. DescribeDescribe the processing: data, purpose, flow, systems, recipients, retention, location. Attach the data flow diagram.
3. Assess necessityState the lawful basis, show why each data item is needed and whether a less intrusive way exists.
4. Identify risksList risks to individuals (not only to the Organisation) such as exposure, discrimination, loss of control or inaccurate decisions, and rate likelihood and impact.
5. TreatChoose safeguards for each risk: minimise, mask, encrypt, restrict access, shorten retention, give transparency or choice. Assign owner and date.
6. Review and decideThe Data Protection Officer gives written advice. Residual High risk goes to senior management, which accepts, redesigns or stops the processing.
7. Follow upCheck actions before go-live; revisit the DPIA when scope changes or at least every [12 months].

13.3 Risk rating

Residual High risk may proceed only with documented approval from senior management and, where the law requires, consultation with the regulator. The DPIA form is in Annexure A.

14. Data Principal Rights Management

14.1 Rights recognised

The Organisation honours the rights that the Digital Personal Data Protection Act, 2023 and other applicable data protection law give to individuals [confirm the current requirement]. Where the Organisation is only a processor, it passes the request to the customer within [2 working days] unless the contract says otherwise.

14.2 Handling a request

1. ReceiveRequests come through the privacy contact channel [the privacy mailbox and web form] or any other channel; any employee who receives one forwards it to the Data Protection Officer the same day. Entry: request register (Annexure B).
2. AcknowledgeSend an acknowledgement with the reference number within [2 working days].
3. VerifyConfirm the identity of the requester using information already held, plus a second factor if needed. Do not ask for more data than needed. If acting for someone else, check authority.
4. LocateThe Data Protection Officer asks business owners and IT operations to search the systems in the inventory, including processors and backups. Owners reply within [7 days].
5. DecideAssess exemptions, legal holds, and the effect on others' data. Record the decision and reason.
6. RespondProvide the result in a clear, readable format by a secure channel, or explain why the request cannot be met and how to complain.
7. CloseUpdate the register, confirm deletion or correction with processors, and keep the file for [3 years].

14.3 Escalation and complaints

A requester unhappy with the reply may escalate to the Data Protection Officer's manager, then to senior management. Unresolved complaints are told how to approach the regulator. Patterns, such as repeated complaints about marketing, are reported to management each quarter.

15. Privacy Awareness and Training

Completion is recorded by human resources; staff who do not finish within [30 days] lose access to systems with High-sensitivity data until they do. Training effectiveness is checked through a short test (pass mark [80 percent]) and through the number of mistaken disclosures.

16. Measures

17. Records and evidence

Annexure A: DPIA form

Annexure B: Rights request register

Annexure C: Processing inventory record

18. Exception

Exceptions to this document are allowed only where compliance is not practicable and the risk has been assessed. A request must state what is to be excepted, why, the risk it creates, the compensating controls, and an end date no later than [6 months]. It is approved in writing by the document owner and the risk owner, recorded in the exceptions register, and reviewed at the end date. An exception does not change the document.

19. Enforcement

Compliance is monitored through internal audits, management review and routine checks by the document owner. Non-compliance is reported through the incident or non-conformity process and handled under the organisation's disciplinary procedure, and under the terms of any contract for people who are not employees. Serious or repeated non-compliance may lead to loss of access and, where the law is broken, to referral to the authorities.

20. Review

This document is reviewed at least every [12 months], and when there is a significant change to the organisation, its systems, its risks or the law, or after an incident that shows it was not effective. Each review is recorded in the revision history.

ISO/IEC 27001:2022 references

Related documents

• Data Protection and Privacy Policy
• Data Protection Act Compliance Procedure
• Incident Management Procedure
• Information Classification and Handling Procedure
• Cryptography Procedure
• Asset Disposal Process
• Supplier Relationship Management Procedure
• Data Governance Policy