2025數(shù)字個(gè)人數(shù)據(jù)保護(hù)規(guī)則的關(guān)鍵原則研究報(bào)告（英文版）-普華永道

DigitalPersonalData

ProtectionRules(2025)

January2025

01

OverviewofdraftDPDPrules2025

KeytenetsoftheDPDPrules

Dataprivacynoticeandconsent:

Noticeshouldincludeanitemisedlistofcollectedpersonaldata,thepurposeforprocessingit,anditemiseddescriptionofgoodsandservicesprovided.Itshould

alsoincludealinktoaccessthewebsiteorapptowithdrawconsentandmakeacomplainttotheDataProtectionBoard.

RightsofDataPrincipals:

01

02

DataFiduciariesandConsentManagersmustclearlyoutlineontheirwebsiteor

apptheprocessforDataPrincipalstoexercisetheirrightsundertheAct,

includingtheDataPrincipal’srighttonominate.

Reasonablesecuritysafeguards:

DataFiduciariesmustprotectthe

personaldataoftheirDataPrincipalsbytakingadequatedatasecuritymeasures.

Verifiableparentalconsent:

03

04

ForaDataPrincipalunder18oranypersonwithadisability,theData

Fiduciarymustobtainverifiableconsentfromtheparentorguardian.

Personaldatadeletion:

Dataprivacybreachnotification:

Incaseofadatabreach,theData

FiduciaryshouldnotifyaffectedData

Principalsandtheboardwithin72hours.

05

06

Forspecificscenarios,thepersonaldataofDataPrincipalswhohavenotinteractedwiththeDataFiduciaryforthreeyears

mustbedeleted,andtheyshouldbenotifiedofthesameatleast48hoursbeforedeletion.

PwC|DigitalPersonalDataProtectionRules(2025)January20252

KeytenetsoftheDPDPrules

Cross-borderdatatransfer:

ObligationsofSignificantDataFiduciaries(SDFs):

SDFsmustconductanannualData

ProtectionImpactAssessment(DPIA)anddataprivacyaudits.

DataFiduciariesprocessingdatainIndiaorprovidinggoodsorservicesfrom

08

07

outsideIndiamustadheretoany

requirementsestablishedbythecentralgovernmentregardingtheavailabilityofsuchpersonaldatatoaforeignstateoritsentities.

Exemptionstotheact:

DataFiduciarieslikehealthcare

professionals,educationalinstitutions

andchildcareprovidersareexemptfromcertainprovisionsregardingchildren’s

data,butcanonlyprocessitforspecificactivities(e.g.safetymonitoringand

transportationtracking).

PublishingthedetailsoftheDPOorrepresentative:

10

09

DataFiduciariesshoulddisplaythe

contactdetailsofanydesignatedpersonsuchasthedataprotectionofficer

(DPO).

ProcessingofpersonaldatabytheState:

ConsentManager:

MustbeanIndian-incorporatedcompanywithanetworthofatleastINR2crore

andacertifiedinteroperableplatformformanagingconsent.

TheStateandinstrumentalitiesmay

11

12

processthepersonaldataofindividualstoprovidevariousbenefits,services,

certificates,licencesorpermits,aspermittedbylawsandpolicies,orthroughpublicfunds.

PwC|DigitalPersonalDataProtectionRules(2025)January20253

Ourperspectiveonkeytenets

Referencetotheact

Requirementintheact

Proposedrules

Ourperspective

ChapterII,Section5-Notice

Thenoticeforconsent-based

processingshouldbeservedto:

?newandexistingData

Principalsassoonasitisreasonablypracticable.

Thenoticeshouldcontaindetailsabout:

?personaldataandthepurposeofprocessing

?themannertoexerciserights

?themannertomakeacomplainttotheboard.

ThenoticeshouldbeaccessibleinEnglish,oranylanguagespecifiedintheEighthScheduleofthe

ConstitutionofIndia.

Rule3

ThenoticefromtheDataFiduciarytotheDataPrincipalshould:

?beindependentlyunderstood

?haveclearandplainlanguage

?provideafairaccountofthedetailssuchas:

a)anitemisedlistofpersonaldata

b)specifiedpurposeof

processinganditemiseddescriptionofgoodsandservicestobeprovided

c)communicationlinkfor

accessingthewebsiteor

apporboth,towithdrawtheconsentorexerciserights

undertheactormakeacomplainttotheboard.

?Noticemustbeclearandeasilyaccessible,withouthiding

importantdetailsinseparatetermsandconditionsor

redirectingtounclearFAQs.ThisensuresthattheData

Principalhasalltherequiredinformationatoneplaceforinformeddecision-makingonconsent.

?Themanagementshouldcreateaconciseitemisedlistof

personaldata.

?Insomecases,businesses

mightdelivernoticesinapaperformat.Thedraftrulesdonot

specifywhatmustbeincludedinsuchnotices,whereaddingawebsiteorapplinkisnot

possible.

ChapterIISection6-Consent,Clause7

and8

TheDataPrincipalcangive,

manage,revieworwithdrawtheirconsentthroughaConsent

Manager.

TheConsentManagerwillbe

accountabletotheDataPrincipalandshallactontheirbehalf.

Rule4

PrerequisiteforConsentManagercompanies:

?incorporatedinIndia

?minimumnetworthofINR2crore

?interoperableplatformsforconsentmanagement

?reputationforfairnessandintegrity

?appropriatetechnicalandorganisationalmeasures

?noconflictofinterestwiththeregisteredDataFiduciaries

?adheretothedefinedobligationssuchas:

?maintainingthewebsiteorappthroughwhichData

Principalsaccessservices/consents

?keeprecordsofconsents,accompanyingnoticesandpersonaldatasharedwithtransfereeDataFiduciariesforatleast7years.

?Anyentitywiththenecessary

infrastructuretoactasa

consentmanagershoulduseitonlyforinternalpurposes

withoutaconflictofinterestwiththedatafiduciary.So,ifan

entitycanmaintainthisintegrity,theycanoffertheirplatformto

otherfirmstoexplorebusinessopportunities.

?Consentmanagershouldstorerecordsforatleastsevenyearsorlongerasagreeduponbythedataprincipal,orasrequiredbythelaw.Butforafewindustries,datashouldbedeletedwithin

threeyears.So,consent

managersmusthavebuilt-in

capabilitiestomeetthesedataretentionrequirements.

PwC|DigitalPersonalDataProtectionRules(2025)January20254

Ourperspectiveonkeytenets

Referencetotheact

Requirementintheact

Proposedrules

Ourperspective

ChapterII,

Section7-

Certain

Legitimate

uses,Clause7(b)

TheStateanditsinstrumentalitiesmayprocesspersonaldatato

providesubsidy,benefit,service,certificate,licenceorpermitas

prescribed,where:

?theDataPrincipalhas

previouslyconsentedtotheprocessingoftheirpersonaldata

?personaldataisavailableinadigitalform,orinanon-digitalformwhichissubsequently

digitisedfromanydatabase,register,bookorother

documentmaintainedbythestateanditsinstrumentalities.

Rule5

TheStateanditsinstrumentalitiesmayprocessthepersonaldata

undercertainlegitimateusessuchasprovidingsubsidies,benefits,

services,certificates,licencesandpermitsandwillhavetoadheretocertaintechnicalandorganisationalmeasureswhileprocessingsuch

data.

?Thedraftrulesclarifyhowthe

Stateanditsinstrumentalities

shouldprocesspersonaldata

forlegitimateuse,while

intimatingthecontact

informationofthepersonwhoisanswerabletothedataprincipalaboutprocessingpersonaldata,specifyingcommunicationlink

toaccessthewebsiteortheapp.

ChapterII,Section8-General

obligationsofdata

fiduciary,Clause5

ADataFiduciaryshallprotect

personaldatainitspossession,orunderitscontrol,includingdata

processedonitsbehalfbyadata

processor,bytakingreasonable

securitysafeguardstopreventdatabreach.

Rule6

ADataFiduciaryshallprotect

personaldatainitspossessionor

underitscontrolbytaking

reasonablesecuritymeasures,suchas:

?encryption,obfuscation,

maskingoruseofvirtualtokens

?accesscontroltocomputerresources

?visibilityondataaccessed

throughlogs,therebyenablingdetection,investigationand

remediationofunauthorisedaccess

?regularbackupofdataensuringcontinuityincaseof

compromise,destructionorlossofaccess

?retainlogsforoneyear,unlessrequiredotherwisebythelaw

?havingappropriatecontractualobligationsonthedata

processorforreasonablesecuritysafeguards

?implementingtechnicalandorganisationalmeasures.

?Thedraftruleslisttheprivacyandsecuritytechniquestobeimplemented,withroomfor

DataFiduciariestoupgradetheirprivacyandsecurity

infrastructure.

?Maintainingtheaudittrailforayearwillassistfiduciariesto

demonstratecomplianceandtakereasonableactionsduringanyincident.

?Implementingthesecontrols

mayincreaseoperationalcostsfortheDataFiduciary,which

canbeachallengeforsmallorganisations.

?Maintaininganefficientdata

backupmechanismwillrequirearobustbusinesscontinuity

program(BCP).

?Thedraftrulesdonotoutline

theaccountabilityand

contractualobligationsofthe

dataprocessorformaintainingreasonablesecuritymeasures.

?ThedraftrulesdonotclarifyifthesecuritymeasuresapplytoallDataFiduciariesirrespectiveoftheirsizeandscale.

PwC|DigitalPersonalDataProtectionRules(2025)January20255

Ourperspectiveonkeytenets

Referencetotheact

Requirementintheact

Proposedrules

Ourperspective

ChapterII,Section8-General

obligationsofdata

fiduciary,Clause6

ThenotificationofpersonaldatabreachshallbegivenbytheDataFiduciaryto:

?theboard

?affectedDataPrincipals.

Rule7

DataFiduciaryshallnotifythebreachto:

?theboard–within72hoursof

becomingawareoralongerperiod

–aspermittedbytheboard

?affectedDataPrincipalsina

concise,clearandplainmanner,

withoutdelaythroughuseraccountoranymodeofcommunication

registeredbythem.

Thenotificationshallinclude:

?adescriptionofthebreach

?consequencesofthebreach

?measuresimplementedtomitigaterisk

?safetymeasuresthatdata

principalmaytaketoprotectthemselves

?businesscontactinformationofarepresentative

?factsrelatedtotheevent,

reasonsleadingtothebreachandanyfindingsregardingthepersonwhocausedthebreach.

?Thedraftruleforthepersonal

databreachnotificationis

detailedandcomprehensible.

Datafiduciariesshallupdate,ordocumentnewpolicy/procedurealignedwiththeactanddraft

rulestoensurecompliance.

?Incaseofadatabreach,thedraftrulesdonotprovidea

mechanismtonotifytheDataProtectionBoardorspecifyiftheymustinformguardiansorparentsofchildrenorpersonswithdisabilitiesaboutthe

incident.

?Thedraftrulesdonotmandateatimeperiodforcommunicatingaboutthebreachtothedata

principal,whichispractical,aseachbreachneedstobe

investigatedbeforenotification.

ChapterII,Section8-General

obligationsofdata

fiduciary,Clause7and8

TheDataFiduciaryshallerasethepersonaldatawhen:

?eitherDataPrincipalswithdrawtheirconsent

?ortheintendedpurposeis

fulfilled–whicheverisearlier

?orifrequiredbythelaw.

ADataFiduciaryshallobligateitsdataprocessortoerasethe

personaldataasperthedefinedperiod,orascommunicated.

ThedataprincipalcanrequesttheDataFiduciarytoexercisetheir

rightsforaspecifictimeperiod.ThismayvarydependingontheclassoftheDataFiduciariesandpurposes.

Rule8

E-commerceentities(with>2crore

usersinIndia),gaming

intermediaries(with>50lakhs

usersinIndia)andsocialmedia

intermediaries(with>2croreusersinIndia)musterasepersonaldataafterthreeyearsfromthedatetheDataPrincipallastapproachedthefiduciary,exceptforenablingthe

DataPrincipaltoaccesstheir

accountoranyvirtualtokens

issuedbyoronbehalfoftheDataFiduciary

IntimatetheDataPrincipalatleast48hoursbeforedeletionoftheir

dataunlesstheylogintotheir

accountorinitiatecontactwiththeDataFiduciary.

?AsperConsumerProtectionAct2019,‘e-commerce’means

buyingorsellingofgoodsor

services,includingdigital

products,overdigitalor

electronicnetwork.Hence,all

organisationswithanonline

presence(websiteand/orapp)foracceptinganddelivering

goodsandservicescomeunderthepurviewofthisrule.

?Thiscompliancemayreduce

storagecostsbutcouldimpactmarketingandanalytics.Itmayalsorequireupdatestodata

managementsystemsforproperidentificationanddeletionofpersonaldata.

PwC|DigitalPersonalDataProtectionRules(2025)January20256

Ourperspectiveonkeytenets

Referencetotheact

Requirementintheact

Proposedrules

Ourperspective

ChapterII,Section8-General

obligationsofdata

fiduciary,Clause9

DataFiduciaryshallpublishthe

businesscontactinformationofaDPOorapersonwhoisableto

answerthequeriesoftheData

Principalabouttheprocessingof

theirpersonaldataonbehalfoftheDataFiduciary.

Rule9

DataFiduciaryshallpublishtheirbusinesscontactortheirDPOonthewebsiteortheapp.The

fiduciarymustalsosharethese

contactsineverycommunicationwiththeDataPrincipalwithregardtoexercisingtheirDPDPrights.

?Thedraftrulesre-emphasise

thatthecontactpersonorDPOappointeeshouldbeaccessiblefordataprincipalsonwebsites,mobileappsandotherrelevantcommunicationplatforms.

ChapterII,Section9-Processingofpersonaldataof

children

TheDataFiduciaryshall:

?obtainverifiableconsentfromtheparentorlawfulguardian

beforeprocessingthepersonaldataofachildorapersonwithdisabilitywhohasalawful

guardian

?refrainfromprocessingany

personaldatathatislikelyto

causeanydetrimentaleffectonthewell-beingofachild

?refrainfromtracking,

behaviouralmonitoringand

targetedadvertisingdirectedatchildren.

Theabove-mentionedprovisionsshallnotbeapplicabletothe

processingofthepersonaldataofachildbytheclassesofData

Fiduciariesorforsuchpurposes,andsubjecttosuchconditions,asmaybeprescribed.

Rule10

ADataFiduciaryshalladopt

appropriatetechnicaland

organisationalmeasurestoensurethatverifiableconsentoftheparentisobtainedbeforeprocessinganypersonaldataofachildandfrom

individualsidentifyingthemselvesasthelawfulguardianofapersonwithdisability.

Fiduciarymustensurethatthe

individualidentifyingastheparentisanadultandisidentifiable

through:

?reliabledetailsofidentityandageavailablewiththeData

Fiduciary

?voluntarilyprovideddetailsofidentityandage

?avirtualtokenmappedtothesame

?theguardianisappointedbyacourtoflaw,adesignated

authorityoralocallevel

committee,underthelawapplicabletoguardianship.

ExceptionsapplytoDataFiduciary

classessuchaseducational

institutions,clinicalestablishments,mentalhealthestablishmentsandhealthcareprofessionals–subjecttonotundertaketrackingor

behaviouralmonitoringortargetedadvertisingforchildren.

?TheDataFiduciarywillrequiretechnologicalandprocess

changestoobtainverifiable

consentfromparentsor

guardians.Thisposes

challengestoverifytheageandidentityoftheindividual

identifyingastheparent,andintegratingsystemswith

externalentitiesentrustedby

lawortheCentralGovernment(UIDAI,DigiLocker,etc.).

PwC|DigitalPersonalDataProtectionRules(2025)January20257

Ourperspectiveonkeytenets

Referencetotheact

Requirementintheact

Proposedrules

Ourperspective

ChapterII,Section10-Additional

obligationsofSDF

TheSDFshall:

?appointaDPO

?appointanindependentdataauditor

?undertaketheperiodicDPIA

?conductperiodicaudits

?implementothermeasures

consistentwiththeprovisionsoftheact,asmaybeprescribed.

Rule12

SDFshall:

?undertakeDPIAanddataprivacyauditsonceayear

?furnishthereporttotheboardcontainingsignificant

observationsintheDPIAandaudit

?observeduediligencetoverifythatalgorithmicsoftware

deployedarenotposingarisktotherightsofDataPrincipals

?ensurethatpersonaldata

specifiedbythecentral

governmentisprocessed

subjecttotherestrictionthatthepersonalandtrafficdata

pertainingtoitsflowisnottransferredoutsideIndia.

?Thedraftrulesclarifythe

additionalobligationsofSDFs,andtheymustmakeadditionaleffortstoensurecompliance.

?ThecriteriaforclassificationofSDFsisunclear.

?Whilethedraftrulesdonot

clarifywhatalgorithmicsoftwareis,SDFsusingpersonaldataforthepurposeoftrainingmodelsneedtoreconsidertheir

processes,incaseaData

Principalwithdrawsconsent.

?Thedraftrulesdonotclarifyhowandwhenthecentral

governmentwilldefinethepersonaldatathatmustbeprocessedwithinIndia’s

borders.Additionally,thesedraftrulesreinforcedatalocalisationrequirementsacrossallindustrysectors,whichwereoriginally

applicableonlytopayment

systemprovidersundera

ReserveBankofIndia(RBI)regulation.

ChapterIII

Section11-14-RightsofData

Principal

TheDataPrincipalhasthefollowingrights:

?righttoaccessinformationaboutpersonaldata

?righttocorrectionanderasureofpersonaldata

?rightofgrievanceredressal

?righttonominate.

Rule13

TheDataFiduciaryandConsentManager(asapplicable)shall

publishontheirwebsiteorapporboth:

?howaDataPrincipalcanraisearequest

?theparticularsoftheidentifierofaDataPrincipal,whichmaybe

requiredtoidentifythem(asapplicable)

?theperiodofresponseunderitsgrievanceredressalsystem.

TheDataPrincipalhastherighttonominateoneormoreindividualstoactontheirbehalfunderthe

righttonominate.

?Theserightsreflecttheact’s

centraltheme,whichisto

empowerindividualstocontroltheirinformationandhow

organisationscollect,process

andshareit.DataFiduciaries

andConsentManagersmust

developprocessesand

technologysolutionstoaddressDataPrincipals’rightsrequests.

?ThedraftrulesdonotdefinethemaximumtimeallowedforDataFiduciariesandConsent

Managerstoaddress

grievances.Withoutaspecifiedtimeframeforgrievance

redressal,therightsgrantedtodataprincipalsundertheDPDPActmaybeweakened.

PwC|DigitalPersonalDataProtectionRules(2025)January20258

Ourperspectiveonkeytenets

Referencetotheact

Requirementintheact

Proposedrules

Ourperspective

ChapterIV,Section16-Processing

ofpersonal

dataoutsideIndia,Clause1and2

Thecentralgovernmentmay

imposerestrictionsonthetransferofpersonaldatabyaData

FiduciarytoanycountryorterritoryoutsideIndia.ThisdoesnotimpactanyexistinglawsinIndiathat

provideprotectionorrestrictionsontransferringpersonaldatabya

DataFiduciaryoutsideIndia.

Rule14

Thetransferofpersonaldata

processedbyaDataFiduciaryto

anycountryorterritoryoutside

IndiaissubjecttotheconditionthattheDataFiduciarymustcomply

withtherequirementssetbythe

centralgovernment.These

requirementsmaybespecified

throughgeneralorspecialorders.

?ThecurrentdraftrulewillhaveanannexurewithmoredetailsregardingthetransferofdataoutsideIndia.

?Iftheprocessingofpersonal

databyDataFiduciariesoutsideIndiaisrestrictedbyafuture

governmentorder,

organisationsthatusecloud

servicesorprocesspersonal

dataabroadwillneedto

reconsidertheirITstrategyandarchitecturetomaintain

compliancewiththeDPDPAct2023.

ChapterIV,Section17-Exemptions,Clause2

Theactdoesnotapplywhen:

?thecentralgovernmentmay

notify,intheinterestsof

sovereigntyandintegrityofIndia,securityofthestate,friendly

relationswithforeignstates,

maintenanceofpublicorderor

preventingincitementtoany

cognisableoffencerelatingtoanyofthese.

?dataisnecessaryforresearch,archivingorstatisticalpurposes,aslongasitisnotgoingtobe

usedtotakeanydecisions

specifictoaDataPrincipalandsuchprocessingiscarriedoutinaccordancewithsuchstandardsasmaybeprescribed.

Rule15

Theprovisionsoftheactshallnotapplytotheprocessingofpersonaldatanecessaryforresearch,

archivingorstatisticalpurposesifitiscarriedoutinaccordancewith

thestandardsspecifiedinthesecondschedule.

?Thedefinitionsof‘research’,

‘a(chǎn)rchival’and‘statistical

purpose’arenotclearlydefinedinthedraftrules.Forinstance,itisnotclearwhetherclinical

trialsandmedicaldevice

researchfallunderthecategoryof‘research’undertheact.

PwC|DigitalPersonalDataProtectionRules(2025)January20259

02

Key

responsibilities

Keyresponsibilitiesofadatafiduciary

Dataprivacynotice

Presentedinanunderstandableandclearlanguage

?Descriptionofpersonaldata

?Purposeofprocessing

?Descriptionofthegoodsorservicestobeprovided

?Descriptionofmeansusingwhichthedataprincipalmaywithdrawhis/herconsent,exercisetheirrightsandmakeacomplainttotheboard

Personaldatasecurity

ProtectthepersonaldataincludinganyprocessingundertakenbytheDataFiduciaryoronitsbehalfbyadataprocessor.

?Securingofpersonaldatathroughencryption,obfuscation,maskingortheuseofvirtualtokensmappedtothepersonaldata

?Accesscontrolforthecomputerresourceused

?Maintaining,monitoringandreviewinglogs

?Retaininglogsandpersonaldatafordetection,investigation,remediationandcontinuousprocessingforoneyear

?Databackupsandanyothermeansforcontinuedprocessing

?AppropriatecontractualclausesbetweenDataFiduciaryanddataprocessorforundertakingreasonablesecuritysafeguards

?Appropriatetechnicalandorganisationalmeasures

PwC|DigitalPersonalDataProtectionRules(2025)January202510

Keyresponsibilitiesofadatafiduciary

Notificationofpersonaldatabreach

SendnotificationstoeachaffectedDataPrincipalinaconcise,clearmannerandwithoutdelay,andtotheboardwithin72hoursofbecomingaware–orwithinalongerspecifiedperiodasallowedbytheboard.

?Descriptionofthebreach,includingitsnature,extentandthetimingandlocationofitsoccurrence

?Consequencesthatarelikelytoarisefromthebreach

?Measuresimplementedandbeingimplementedtomitigaterisk

?SafetymeasuresthattheDataPrincipalsmaytaketoprotecttheirinterests

?Businesscontactinformationofarepresentative

?Anyfindingsregardingthepersonwhocausedthebreach

?Areportregardingtheintimationsgiventoaffecteddataprincipals

Personaldatadeletion

?InformtheDataPrincipalatleast48hoursbeforecompletionofthetimeperiodforerasure.

?IntimatetheDataPrincipalaboutthedeletionunlesstheylogintotheiruseraccountorinitiatecontactwiththefiduciaryforthespecifiedpurposeofdataprivacyrights.

Publishingthecontactinformation

?PublishthebusinesscontactinformationoftheDPOorarepresentative.

?Publishthedetailsonthewebsiteorapp,andineveryresponsetoacommunicationfortheexerciseoftherights.

Verifiableconsentfromparentsand/orguardians

?Adoptnecessarytechnicalandorganisationalmeasurestoensurethatverifiableconsentisobtainedfromtheparent

beforeprocessingthechild’spersonaldataandtoverifythattheguardianisappointedbyacourtoflaworadesignatedauthorityunderappropriatelaw.

?Suchparentorguardianshallbeadultandshallbeidentifiableasrequiredbythefollowingreferences:?reliabledetailsofidentityandageavailablewiththefiduciary

?voluntarilyprovideddetailsofidentityandage?virtualtokenmappedtothedetailsoftheparent

?tokenverifiedandmadeavailablebyadigitallockerserviceprovider.

Dataprivacyrights

?PublishthemeansusingwhichaDataPrincipalcanmakearequestonthewebsiteorapp.

?Additionallypublish:

?theparticularsoridentifiernumber*whichisrequiredtoidentifytheDataPrincipal?theperiodforgrievanceredressalandforrespondingtothegrievances.

*IdentifiermeansanysequenceofcharactersissuedbytheDataFiduciarytoidentifytheDataPrincipalandincludesacustomeridentificationfilenumber,customeracquisitionformnumber,applicationreferencenumber,enrolmentIDorlicencenumberthatenablessuchidentification.

PwC|DigitalPersonalDataProtectionRules(2025)January202511

Keyresponsibilitiesofadatafiduciary

PerformingDPIAsandauditsforSDFs

?PerformperiodicDPIAsanddataprivacyaudits.

?PerformaDPIAonceevery12monthsfromthedateonwhichtheywerenotifiedasanSDF.

?Conductanauditonceevery12monthstoensureeffectiveobservanceoftheactanddraftrules.

?FurnishsignificantobservationsfromtheDPIAandaudittotheboard.

RiskassessmentforSDFs

?Observeduediligencetoverifythatalgorithmicsoftwaredeployedforhosting,display,uploading,modification,publishing,transmission,storage,updatingorsharingofpersonaldataprocessedarenotlikelytoposearisktotherightsofData

Principals.

Cross-borderdatatransferforSDFs

?Aligncross-borderdatatransferwiththecentralgovernment’snotification.

?Undertakemeasurestoensurethatpersonaldataandtrafficdata,specifiedbythecentr