Control Master Matrix & Ownership Crosswalk

Verifies digital personal data processing within India and offshore goods/services nexus.

Determines activity-specific roles: Data Fiduciary, Data Processor, or Data Principal.

Asserts valid consent or statutory Section 7 legitimate use before processing.

Issues transparent multilingual notice and manages pre-commencement consent transition.

Governs affirmative consent lifecycles, withdrawal requests, and Consent Manager registration.

Validates employment, medical emergency, judicial, and statutory legitimate grounds.

Mandates itemised data/purposes, DPO contacts, and Eighth Schedule language support (Rule 3).

Enforces valid data processing agreements and downstream propagation of statutory duties.

Maintains accuracy and completeness of personal data used to make decisions affecting principals.

Establishes baseline technical controls to prevent unauthorized access or processing.

Deploys end-to-end encryption, access controls, and boundary defenses against data breaches.

Mandates prompt notification to the Data Protection Board and affected principals upon breach.

Automates deletion or de-identification when processing purpose is fulfilled or consent withdrawn.

Maintains storage schedules and periodic reviews for inactive customer and employee data.

Publishes business contact details of the Data Protection Officer or grievance representative.

Provides an easily accessible channel for principal complaints with timely resolution workflows.

Implements continuous security monitoring, encryption, and audit log safeguards under Rule 6.

Executes dual reporting clocks: CERT-In 6-hour intimation and DPDP Rule 7 Board breach dossiers.

Enforces automated data erasure after prolonged account inactivity under Rule 8.

Prominently displays DPO contact details across web, mobile, and communication surfaces (Rule 9).

Evaluates statutory criteria and Second Schedule exemptions for state instrumentality processing.

Enforces cross-border transfer blacklists, adequacy checks, and contractual transfer terms.

Applies research and statistical exemptions without using personal data for individual decisions.

Requires verifiable consent from parents or lawful guardians before processing child data.

Prohibits any processing of child personal data that is likely to cause harm to child well-being.

Prohibits tracking, behavioral monitoring, and targeted advertising directed at children.

Applies government notified conditional exemptions for specialized educational/child entities.

Applies statutory exemptions where verifiable age assurance mechanisms are deployed.

Implements verifiable age-token and parent relationship checks in compliance with Rule 10.

Enforces child-safe processing architecture and strict safeguard defaults under Rule 11.

Applies Fourth Schedule conditional compliance relaxations for qualifying health/education fiduciaries.

Assesses processing volume, sensitivity, and national security factors against SDF designation.

Appoints an India-resident Data Protection Officer reporting directly to the Board of Directors.

Appoints an independent external auditor to conduct periodic compliance evaluations.

Executes periodic Data Protection Impact Assessments (DPIAs) and periodic security audits.

Conducts algorithmic transparency reviews and periodic risk assessments under Rule 13.

Furnishes Data Principals a summary of processed personal data and shared third-party identities.

Processes principal requests to correct inaccurate data, complete records, or erase obsolete data.

Provides timely, documented internal grievance resolution before regulatory escalation.

Enables Data Principals to nominate a representative to exercise rights upon death or incapacity.

Validates authentic principal claims and prevents false, frivolous, or impersonated requests.

Operates self-service rights fulfillment portals adhering to prescribed timelines under Rule 14.

Blocks personal data transfers to countries blacklisted or restricted by the Central Government.

Preserves stricter sectoral data localization and transfer mandates (RBI, SEBI, IRDAI).

Evaluates legal process, law enforcement, debt recovery, and court order exemption perimeters.

Interoperates with Board-registered Consent Managers acting as trusted intermediaries.

Implements secure APIs, cryptographic logs, and technical specifications for Consent Managers.

Governs financial penalty exposure up to ₹250 Crore per significant statutory non-compliance.

Monitors statutory penalty tiers across security safeguards, breach, children, and SDF duties.

Maintains operational readiness for regulatory summons, inquiries, and institutional proceedings.

Handles Board investigations, binding compliance directions, and alternate dispute resolution.

Interfaces with the Board's digital portal for electronic filing, service, and virtual hearings.

Governs appeals before TDSAT, statutory deposit requirements, and limitation periods (Rule 22).

Responds to Central Government statutory information calls for Seventh Schedule purposes.