Interactive Checklist

C-04 Legal & Regulatory Legal Counsel & DPO

The Exemption Trap Checklist

Legal validation checklist preventing improper reliance on Section 17 statutory exemptions, verifying mandatory non-derogable safeguards.

Statutory Source: Ch. 3 §4: the s.17 exemptions — what lifts, what survives (s.8(1)/(5) always), 'necessary for' as a test

Total Verification Points: 7 Audit Checks

C-04Ch. 3 §4: the s.17 exemptions — what lifts, what survives (s.8(1)/(5) always), 'necessary for' as a test

The Exemption Trap Checklist

Before you claim an exemption, run this

Readiness Score

0 / 7 checks

Statutory Branch Identification: Pinpoint the precise Section 17 sub-clause (e.g. s.17(1)(a) judicial, s.17(1)(b) legal claim, s.17(1)(c) debt).

Section 17(1)

Strict Necessity Test: Processing is strictly necessary for the exempted purpose and cannot be fulfilled by less intrusive means.

Section 17(1)

Section 8(1) Fiduciary Accountability Survives: Fiduciary remains solely responsible for all processing done on its behalf.

Section 8(1)

Section 8(5) Reasonable Security Safeguards Survive: Technical safeguards and encryption MUST remain active regardless of exemption.

Section 8(5)

No Individual Profiling in Research/Statistics: Section 17(2)(b) research data is never used to take individual decisions affecting principals.

Section 17(2)(b) & Rule 16

Offshore Processing Boundary (s.17(1)(d)): Processing under contract with foreign persons is restricted to non-resident personal data.

Section 17(1)(d)

Exemption Expiry Logging: When the exempted purpose ends (e.g. litigation concluded), immediate transition to erasure schedule.

Section 8(7)

State automatically persisted in browser localStorage

Statutory Grounding & Legal Perimeter

Mandatory statutory clauses, rules, and gazette requirements enforceable under this checklist.

Enforceable Provisions:

Section 17(1)

Section 17(2)

Section 17(3)

Section 17(4)

Section 17(5)

Section 8(1)

Section 8(5)

Statutory Context:

This checklist is directly anchored in Ch. 3 §4: the s.17 exemptions — what lifts, what survives (s.8(1)/(5) always), 'necessary for' as a test. Failure to maintain verifiable affirmative proof of compliance exposes the enterprise to severe adjudication penalties under Section 33 (Schedule) of the DPDP Act.

Target Architecture & Impacted Systems

Enterprise applications, stores, and integration surfaces evaluated by this checklist.

View Full Systems Topology (SYS-001..014) →

In-Scope System Nodes:

SYS-001 Architecture Spec →

Customer App & Web Portal

Public client boundary & untrusted intake surface for notices and consent capture

SYS-003 Architecture Spec →

Marketing Automation Engine

Processor-operated messaging engine (ENT-004) gated by optional consent

SYS-010 Architecture Spec →

Consent Ledger & Policy Decision Point

Immutable consent event store and Policy Decision Point issuing authority tokens

Associated Operational Controls (54 OBLs)

Control Master Matrix obligations directly tested by this checklist.

Open Control Matrix →

OBL-21 Workpaper →

Control Dossier OBL-21

OBL-23 Workpaper →

Control Dossier OBL-23

OBL-11 Workpaper →

Control Dossier OBL-11

Audit & Implementation Guidance

Best practices for establishing evidence, avoiding traps, and conducting periodic assurance.

Evidence Retention Standard

Do not rely solely on policy documents or statements of intent. Ensure verifiable evidence artifacts (cryptographic logs, test manifests, signed DPA agreements, or automated crawler receipts) are archived for at least 1 year.

Common Implementation Trap

Avoid declaring compliance based on frontend UI alone. The Data Protection Board evaluates the full data pipeline, including database persistence, read replicas, cache invalidation, and third-party processor synchronization.

Previous Checklist

C-03 — Are You Ready for the Cliff? (20-Point Readiness)

Next Checklist

C-05 — The Withdrawal Parity Test