Chapter 35 — A Worked End-to-End Enterprise Transformation

1. One enterprise, but not one long dependency chain

The earlier chapters separate discovery, purposes, authority, retention, rights, incident response, assurance and buying. An enterprise must connect those decisions without pretending that every workstream waits for the previous chapter. Approval of a particular data flow requires enough inventory and purpose evidence to decide that flow. Preparing an incident bridge, assigning a grievance owner and stopping an obviously unsupported export do not require a complete discovery programme. Governance begins with the charter, not after the last engineering test.

That distinction changes the transformation plan. At EVT-001 the fictional Company starts source monitoring, incident readiness and governance together. Discovery then expands the known estate while product and engineering design authority checks for a bounded pilot. An unknown processor copy is an owned exception, not an excuse to omit the processor from scope. A stopped training proposal remains stopped even when the commercial business case is attractive. The teaching sequence is a way to explain these dependencies, not a statutory instruction to implement rights before breach response.

The dossier reader guide and file manifest are the working objects for this chapter. They deliver the inventory, architecture, events, decisions, specimens, economics, scorecard and test records discussed below. The original fixed-ID contract remains visible so that a changed business fact cannot silently repair an inconvenient result. This chapter makes an integrated decision record usable; it does not certify the Company or the book.

2. Establish the case boundary before planning the work

CASE-001 / ENT-001 is a fictional Indian NBFC lender with an insurance-distribution activity, approximately 200 employees, 100,000 adult registered customers and 20,000 active loans. These are sizing assumptions. The Company is not an insurer, marketplace, hospital, school or statutory Consent Manager. Its SDF status remains not_designated. Section 10(1) makes notification decisive; volume and sensitivity support readiness planning, not a prediction that designation is inevitable. ACT:404–438.[1]

The source schedule places the core Act provisions in the eighteen-month tranche and the Consent Manager registration provisions in the one-year tranche. Rules have their own staging. The retained 13 November 2025 publication baseline yields 13 November 2026 and 13 May 2027 for planning; the corrigendum corrects the publication wording rather than moving the breach clock. COMM:49–59; RULES:1005–1010; CORR:24–38.[2][5][6]

Licensing, the NBFC’s precise class/layer and applicable sector reporting remain real-use prerequisites. The sector decisions preserve Chapter 31’s bounded class assumptions and refusal to invent a supervisory deadline where those facts are absent. The base Company does not offer lending or targeted advertising to children. The child-targeting proposal in the assessment is explicitly a separate retail counterexample, CASE-101, not a quiet change to the Company’s business.

The case’s data vocabulary matters. DS-002 means loan applications and transactions, not order fulfilment. DS-003 is the optional marketing projection. DS-006 is identifiable training input/features and outputs; it is not a declaration that every model weight is personal data or anonymous. DS-010 is insurance referral/claim-support material, not the independent insurer’s whole claims estate. ENT-002 determines its own insurer purposes, while ENT-004 acts on the Company’s marketing instructions. ENT-005’s proposed own-product reuse is a separate activity, not permission carried by a processor contract.

3. Turn discovery into a bounded decision surface

The inventory contains the declared systems, datasets and flows, with confidence, ownership and an unknown set. It preserves the earlier illustrative distinction between structurally reviewed systems and unverified supplier, model, backup and orchestration surfaces. Completing the declared dictionary does not turn those unknowns into observed coverage. A reader can identify every named dataset while still seeing why release is blocked on a particular copy.

FLOW-001 carries the requested application from SYS-001 to SYS-002. FLOW-002 projects optional marketing to SYS-003. FLOW-003 reaches the warehouse and model environment; its training branch lacks authority. FLOW-004 reaches the unapproved foreign backup SYS-008, while FLOW-005 concerns overseas analytics SYS-009. FLOW-006 is a proposed insurer referral, not an actual base-case disclosure. The remaining flows connect HR archives, withdrawal controls, restore quarantine and rights execution. A control event travelling through FLOW-008 does not itself create permission to send a campaign.

The purpose decisions make these distinctions operational. PUR-001 has a recorded application consent. PUR-002 has a separate optional choice. PUR-003 training has no grant and is stopped. PUR-004 serving cannot borrow a training token and remains paused on disputed input and unresolved release evidence. The Act supplies consent or certain legitimate uses for a lawful purpose; a service contract does not add a third ground. ACT:160–166.[1]

A useful positive contrast is PUR-007: the principal voluntarily supplies her own contact for a requested payment acknowledgement and has not indicated non-consent. The negative branch removes those facts and refuses the use; simply displaying a notice does not repair it. Employment administration under PUR-006 is scoped to Section 7(i), while the unsuccessful applicant branch remains a fact-specific decision rather than an invented recruitment limb. ACT:269–284,326–329.[1]

For the base insurance referral, the dossier deliberately does not import the separate sector specimen’s assumed permission. There is no referral grant or transmission in the base timeline, so the access reply cannot list ENT-002 as an actual recipient. This is the kind of reconciliation that a collection of otherwise plausible templates often misses: a conditional example elsewhere is not evidence that this customer actually authorised this disclosure.

4. Choose architecture and pilot scope together

ARCH-001 provides a concrete topology and trust boundaries. SYS-010 is the trusted authority ledger and policy decision service; it is an enterprise tool, not a registered Consent Manager. Public clients cannot supply a trusted purpose merely by naming one. Service, job, storage and egress enforcement points must bind the requested operation to the authenticated workload, current authority and approved route. These are recommended engineering controls, not an assertion that the Act mandates a particular token format.

Three architecture choices were considered in the pilot and decision record. A gateway-only retrofit is quicker to demonstrate but leaves warehouse jobs, administrators and restoration outside the boundary. Replacing the lending core makes a broad promise but increases migration risk without resolving missing legal authority. The selected teaching design keeps the core and adds a shared decision plane plus service/job/egress enforcement, an outbox and a restore quarantine. Selection is conditional on actual route coverage; a diagram cannot establish that bypass credentials have been removed.

PILOT-Q09-001 uses one synthetic borrower and the minimum authority/withdrawal/rights/restore routes. It is not a rollout to 100,000 people or a performance test at production traffic. No actual lender, supplier, cloud account or personal-data record is contacted. The pilot makes missing acknowledgement, stale replay, unavailable policy and forged-purpose branches inspectable. It leaves authentication, cryptography, distributed races, latency and physical erasure to explicitly named deployment acceptance work.

The foreign backup is especially important. Stopping new dispatch and isolating the existing cohort are different from erasing it or approving its original location. An India replacement requires its own change record; SYS-008 is never renamed to make the foreign copy disappear. Transfer assessment combines the relevant Section 16 restrictions and other-law protection with applicable Rule 15 requirements and, conditionally, Rule 13(4). A processor contract cannot displace a binding restriction. ACT:515–522; RULES:1287–1290,1319–1323.[1][5]

5. Walk the same withdrawal through every system

At EVT-003, SUB-001 receives NOTICE-001, with a separate Hindi specimen, and gives distinct application and marketing grants. The event pack binds notice version/hash, purpose, action, subject, actor and sequence. The scene identifier EVT-003 appears for both choices; transport identity is therefore the composite event/purpose key, not the scene number alone. Otherwise a naïve deduplicator could drop one legitimate choice.

At 10:00 on 2 June 2027, WITHDRAW-001 revokes the marketing grant. The Company’s immediate local deny is an author-recommended target. The legal duty is qualified cessation within reasonable time, including causing processor cessation unless non-consent processing is required or authorised by the Act, Rules or other law. Withdrawal is accepted; it is later unauthorised marketing that is rejected. ACT:232–249.[1]

At 10:05, ACK-001 is still absent from ENT-004. That five-minute checkpoint is hypothetical, not a statutory deadline. The retention and execution journal keeps the remote state unknown and global completion false. At 10:06 a stale sequence-one grant is replayed; later receipt cannot resurrect authority after sequence-two withdrawal. REM-001 and RETEST-001 address the local cache/propagation model on the following day, but even a successful local denial does not manufacture a supplier receipt.

Retention is decided separately. Rule 8(3) establishes a minimum one-year processing-retention layer for the Seventh Schedule purposes; Rule 6(1)(e) separately addresses specified security evidence. The specimen preserves restricted uses and makes its processing-anchor/overlap interpretation explicit. It does not promise universal immediate deletion or renewed marketing from an archive. RULES:1101–1106,1153–1166.[5]

HOLD-001 is narrower still. In the hypothetical facts, SUB-001 disputes whether one repayment discharged the loan, and the transaction entry and linked receipt are necessary to substantiate the contested claim. DEC-Q09-HOLD conditionally applies Section 17(1)(a) only to that necessary claim processing. The exception disapplies the stated provisions while preserving Section 8(1) and (5); it is not a court order, fixed retention period or blanket marketing hold. ACT:523–526.[1]

The record names requester, legal reviewer, custodian, necessity review and release branch. Releasing the hold reopens disposal eligibility rather than erasing every record automatically. EVT-025 is a later review, not a guaranteed erase date. RESTORE-001 first loads the earlier SNAP-001 into SYS-014 and replays restrictions before any access. Missing current history quarantines the restored copy. A newer consent cannot reconstruct bytes already validly erased; the local replay counterexample explicitly checks that distinction.

6. Give a partial rights answer without pretending execution is complete

RIGHTS-001 combines access, correction and erasure at noon on 2 June. Sections 11 and 12 have the relevant prior-consent scope, including Section 7(a); their content and exceptions must be applied separately. Neither a general 72-hour rights deadline nor a universal portability export is invented here. ACT:441–476.[1]

The prepared response identifies the actual stipulated host and marketing recipients, explains the source correction and pending downstream refresh, and preserves the restricted-retention and narrow claim exceptions. It explicitly cannot confirm remote cessation or deletion. Its status is partial response prepared, not sent; execution remains open. The specimen grievance service chooses thirty calendar days while keeping the Rules’ reasonable published period not exceeding ninety days distinct from the internal rights target. RULES:1294–1318.[5]

Nomination is not an identity migration. NOM-001 and NOM-002 name SUB-006 and SUB-007 as separate actors for SUB-001. Their conflicting instructions during the stipulated incapacity pause the disputed action under DEC-008. Recovery revokes activation, not the historical record or original subject identity. Section 14 provides the death/incapacity mechanism; the separate authority record and conflict process are recommended implementation choices. ACT:489–495.[1]

7. Rehearse an incident, not a successful notification story

INC-001 distinguishes occurrence at 09:00, alert at 09:10, awareness at 09:20 and containment at 09:35 on 10 June. Its stipulated unauthorised object-read exposure compromises confidentiality. Listing permission alone is not silently treated as proof that every object was read; hostile downloads and the wider affected population remain unknown. The case is not a clinical disclosure example and does not infer breach merely from an external recipient.

Rule 7 requires initial Board and affected-principal intimations without delay after awareness and detailed Board information within seventy-two hours unless the Board allows a longer period on written request. Preparing a file is not dispatching it, and a late detailed update cannot cure an unjustified initial delay. RULES:1112–1139.[5]

The initial Board specimen, principal specimen and detailed update are delivered locally and not sent. The arithmetic places the detailed deadline at 09:20 on 13 June; the update specimen is prepared at 16:00 on 12 June. DELIVERY-001 fails on the first simulated principal route. The retry is queued without a receipt and escalated, not relabelled as universal delivery success. CERT-In and applicable sector tracks run concurrently with their own facts and clocks; the dossier preserves the source-backed conditional track and urgent unresolved entity-specific reporting analysis.

8. Reject a launch, price the remaining work and qualify assurance

The completed DPIA rejects unauthorised training and the separate prohibited child-targeting proposal before any residual-risk score can influence approval. A parent token alone cannot overcome the separate Section 9(3) restriction, and a business sponsor cannot waive a legal stop. ACT:386–403.[1]

Rescoping leaves a narrower adult-serving investigation, not an automatic production launch. Source-data quality, model suitability, route controls and serving authority still need evidence. The business sponsor owns the scope and resources; privacy advice challenges the decision; independent review is not invented. Voluntary readiness in this non-designated Company must not be reported as discharge of an SDF audit duty.

COST-001 and its editable inputs size the hypothetical programme. Six hundred monthly rights cases, 35% fully automated, leave 390 manual cases at forty-five minutes each: 292.5 hours, requiring three funded case-operation FTE at 120 productive hours each. The 1.5 peak assumption requires four. Total base staffing is 7.5 allocated FTE, including four existing and 3.5 incremental, at ₹2.10 crore annual loaded cost. Base year-one resource cost before reserve is ₹2.6902 crore. These computed assumptions are not payroll observations or a statutory staffing ratio.

The completed bidder workbook, score inputs and synthetic workpapers preserve BID-001 and BID-002. Evidence/auditability has nonzero weight, and the processor mandatory gate defeats BID-002 despite a higher numerical score. A cell labelled “Tested” is an assumed evidence tier in this fictional comparison, not an actual supplier trial. Bidder component TCO is not added to the programme budget without replacing overlapping licence/build/support meters.

The local checks and failure/retest output demonstrate only their supplied sequential models and calculations. The independent-workpaper specimen reaches a qualified teaching conclusion, with missing ACK, copy, correction, notification and deployment evidence remaining visible. It is not an actual independent book review. The residual register carries those issues into Chapter 36 rather than ending the case with a green dashboard.

A useful reader exercise is to add an authenticated supplier acknowledgement to a copy of the dossier. Which exact scope and operation does it cover? Does it prove cessation, restricted retention or eligible erasure? Does any backup or corrected-input follow-up remain? If a single acknowledgement closes every row, the integration has lost the distinctions the case was built to teach.

Source locations

Source keys ACT, COMM, RULES and CORR use physical newline-based ranges in source-passages.json; URL/date/hash metadata is retained in source-manifest.json. The baseline is bounded retained-source research, not comprehensive negative assurance about later instruments.

Sources

[1] https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf — Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) [2] https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf — G.S.R. 843(E), DPDP Act commencement notification [5] https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf — Digital Personal Data Protection Rules, 2025, G.S.R. 846(E) [6] https://www.meity.gov.in/static/uploads/2025/12/3c7ebbae0e5456f493f486e6845df86b.pdf — Corrigenda to G.S.R. 846(E), G.S.R. 892(E)

Contents · Reader guide and citation conventions · Artifact index