Interactive Checklist

C-11 Data Principal Rights Legal Counsel & DPO

The Rights Request Response Checklist

Standard operating procedure checklist for processing Data Principal rights requests (Access, Correction, Erasure, Nomination) under Rule 14.

Statutory Source: Ch. 12 + r.14 manner/identifiers/windows: intake → identity → scope → decision gates → service → evidence

Total Verification Points: 6 Audit Checks

C-11Ch. 12 + r.14 manner/identifiers/windows: intake → identity → scope → decision gates → service → evidence

The Rights Request Response Checklist

The rights-service operating procedure as a checklist

Readiness Score

0 / 6 checks

Intake & Acknowledgment: Request logged via authorized portal with instant automated acknowledgment receipt.

Rule 14(1)

Identity Verification: Principal identity authenticated using least-intrusive existing credentials (no over-collection).

Rule 14(2)

Scope & Request Classification: Determine whether request relates to Section 11 (Access), 12(1) (Correction), 12(2) (Erasure), or 14 (Nomination).

Sections 11–14

Statutory Exclusion & Exemption Check: Validate whether request conflicts with legal hold, debt recovery (s.17(1)(c)), or court order.

Section 17

Fulfillment within Prescribed Period: Complete response and service of data summary delivered within 30 calendar days.

Rule 14(3)

Refusal Justification & Board Recourse: If request is refused, provide written legal justification and DPBI complaint rights.

Section 13 & Section 28

State automatically persisted in browser localStorage

Statutory Grounding & Legal Perimeter

Mandatory statutory clauses, rules, and gazette requirements enforceable under this checklist.

Enforceable Provisions:

Section 11

Section 12

Section 13

Section 14

Rule 14

Statutory Context:

This checklist is directly anchored in Ch. 12 + r.14 manner/identifiers/windows: intake → identity → scope → decision gates → service → evidence. Failure to maintain verifiable affirmative proof of compliance exposes the enterprise to severe adjudication penalties under Section 33 (Schedule) of the DPDP Act.

Target Architecture & Impacted Systems

Enterprise applications, stores, and integration surfaces evaluated by this checklist.

View Full Systems Topology (SYS-001..014) →

In-Scope System Nodes:

SYS-001 Architecture Spec →

Customer App & Web Portal

Public client boundary & untrusted intake surface for notices and consent capture

SYS-003 Architecture Spec →

Marketing Automation Engine

Processor-operated messaging engine (ENT-004) gated by optional consent

SYS-004 Architecture Spec →

Enterprise Cloud Data Warehouse

Purpose-partitioned analytical warehouse staging operational reporting

SYS-010 Architecture Spec →

Consent Ledger & Policy Decision Point

Immutable consent event store and Policy Decision Point issuing authority tokens

Associated Operational Controls (54 OBLs)

Control Master Matrix obligations directly tested by this checklist.

Open Control Matrix →

OBL-16 Workpaper →

Control Dossier OBL-16

OBL-13 Workpaper →

Control Dossier OBL-13

Audit & Implementation Guidance

Best practices for establishing evidence, avoiding traps, and conducting periodic assurance.

Evidence Retention Standard

Do not rely solely on policy documents or statements of intent. Ensure verifiable evidence artifacts (cryptographic logs, test manifests, signed DPA agreements, or automated crawler receipts) are archived for at least 1 year.

Common Implementation Trap

Avoid declaring compliance based on frontend UI alone. The Data Protection Board evaluates the full data pipeline, including database persistence, read replicas, cache invalidation, and third-party processor synchronization.

Previous Checklist

C-10 — The Legal Register Row Checklist

Next Checklist

C-12 — The Grievance Response Checklist