Five streams, not a privacy policy

Compliance under this Act is not a privacy policy on a website. It is a body of records, contracts, controls and routines that must exist, must work, and must be capable of proof. The work falls into five streams.

• Know: Mapping & applicabilityAn inventory of the personal data you hold and the systems that hold it. A contract map: every agreement under which personal data moves in or out. A relationship map: for each counterparty, whether you stand as fiduciary, processor or both. A written view on how the Act applies to you, whether Significant Data Fiduciary designation is likely, and where sectoral rules (RBI, SEBI, IRDAI, CERT-In, health) overlap.
• Paper: Legal instrumentsNotices and consent language. Privacy policy and the internal policies behind it: retention, breach response, handling of individuals’ requests. Data processing agreements and addenda for vendor and customer contracts. Intra-group data sharing agreements. Employment and HR documentation. Legal drafting is settled by independent advocates.
• Build: Systems & securityConsent capture, consent records and withdrawal. A working channel for access, correction and erasure requests. The security baseline the Rules prescribe: encryption, access control, logging, backup. Retention and deletion routines. Age verification and parental consent where children’s data is in play.
• Staff: People & governanceA named grievance officer, and a Data Protection Officer where required. Training by role, because most breaches begin with a person and not a system. A reporting line to the Board, with data protection on its agenda.
• Prove: Evidence & upkeepA breach response plan rehearsed against the 72-hour clock. A record of processing. An evidence file that shows what was done, when, and on whose advice. Periodic review, and for Significant Data Fiduciaries, the annual impact assessment and independent audit.

In our experience the greater part of an organisation’s exposure does not sit in its privacy policy. It sits in its contracts and vendor relationships: data shared on a handshake, group companies drawing on one database with no agreement between them, processors engaged on terms written before this law existed. That is why our method begins with the contract map and the relationship map.