Sector Overlay Packs | Dhristhi DPDP Product Showcase

Product Overview & Key Capabilities

Tailored, industry-specific compliance overlays that reconcile DPDP obligations with overlapping sectoral regulations across Banking, NBFCs, Fintech, Securities, Insurance, Healthcare, and E-Commerce, resolving legal conflicts and synchronizing multi-track reporting clocks.

Core Enterprise Capabilities

Pre-configured regulatory conflict matrices categorizing interactions into Compatible, Parallel, Conflict, or Conditional regimes.

Deep NBFC & Digital Lending overlay mapping Loan Service Providers (LSPs) and Account Aggregators (AAs) to statutory processor boundaries.

Synchronized multi-clock incident alerting coordinating CERT-In (6h), DPBI (Immediate/72h), and sector regulator notifications.

Sectoral retention schedule templates embedding PMLA, SEBI CSCRF, and IRDAI statutory exemptions.

Deliverable & Core Artifact

Ready-to-deploy sector overlay decision packs, regulatory conflict classification registers, and multi-clock incident workflows.

Target Roles & Operational Impact

Target Persona & Role	Decision Authority	Operational Value & Impact
NBFC & Fintech Compliance Lead	Sector Operator	Map digital lending and Loan Service Provider (LSP) relationships directly to Section 8 processor boundaries.
Sector Regulatory Counsel	Conflict Interpretation Veto	Classify interactions into COMPATIBLE, PARALLEL, CONFLICT, or CONDITIONAL regimes under Section 38.
Incident & Risk Manager	Reporting Cadence Lead	Synchronize DPDP breach reporting (Immediate/72h) with CERT-In (6h) and RBI/SEBI sector incident notifications.

Data Schema & Architecture Interface Contracts

The following data schemas and interface contracts define the structured payloads and integration endpoints of this product:

overlay_row

row_id; sector_domain (NBFC, BANKING, SECURITIES, INSURANCE); entity_licence_type; activity_scope; canonical_dpdp_obligation; sector_instrument_ref; clause_locator; interaction_type (COMPATIBLE, PARALLEL, CONFLICT, CONDITIONAL, UNKNOWN); reconciliation_reasoning; owner; residual_risk; reviewer

recipient_clock

incident_id; regulator_authority; trigger_event; initial_window; detailed_window; mandatory_contents; submission_channel; evidence_receipt

Operational Workflow & Product Invariants

Execution Workflow Procedure

Identify regulated entity type, operational licenses, and specific data processing activities (e.g. NBFC digital lending).
Map applicable sector circulars (RBI Master Directions, SEBI CSCRF, IRDAI Guidelines) against baseline DPDP controls.
Classify legal interactions: COMPATIBLE (additional obligation), PARALLEL (dual requirement), CONFLICT (sector statute overrides under s.38), or CONDITIONAL.
Configure dual-clock breach notification workflows matching specific sector timelines.
Export sector compliance overlay packs into enterprise governance workpapers.

Mandatory Product Invariants

P05-R01: Initial active specification is a bounded NBFC digital lending overlay; healthcare, telecom, and education overlays remain research-stage prototypes.
P05-R02: Use precise interaction types (COMPATIBLE, PARALLEL, CONFLICT, CONDITIONAL, UNKNOWN); do not rely on vague stricter-wins assumptions.
P05-R03: Ground all overlay rules in verified Gazette notifications and regulatory circular hashes.
P05-R04: Maintain separate timelines for Board notifications, affected principal notices, and sector regulator submissions.

Operational Boundaries & Architecture Assumptions

• No formal regulatory representations before the RBI, SEBI, IRDAI, or DPBI.
• No real-time automated API submission to regulatory portals without human review.
• No claim of universal applicability across non-financial jurisdictions.

Built-in Quality Verification & Compliance Test Harness

P05-A01-TEST Verified

NBFC LSP Data Isolation Test

Verify that loan service providers are correctly classified as Data Processors with prohibited data access beyond credit underwriting.

P05-A02-TEST Verified

Dual Incident Clock Synchronization

Validate multi-track alerting triggering CERT-In (6h), DPBI (Immediate/72h), and RBI (6h/24h) simultaneously.

P05-A03-TEST Verified

PMLA 5-Year Retention Override

Verify that loan transaction records override Section 8(7) erasure requests under Section 38(1) statutory exemptions.

Statutory Grounding & Regulatory Crosswalk

7 Enforced Provisions

The following primary Act sections and subordinate Rule provisions establish the direct legal grounding, mandatory statutory constraints, and operational compliance duties enforced by this product:

Direct Citations: Section 3Section 16Section 17Section 38Rule 7Rule 14Rule 15

ACT-3 s.3

Tranche 3 (13 May 2027)

Section 3

Actor: Person processing digital personal data

Trigger: India processing or offshore goods/services connection

Includes later-digitised collection; offshore nexus is principals within India, not Indian citizenship.

Product Invariant: Publicly accessible does not by itself meet the public-data exclusion.

Exception: Individual personal/domestic use; principal-made public data or legally obliged publication by another.

Gazette Verified View Provision (s.3)

ACT-16 s.16

Tranche 3 (13 May 2027)

Section 16

Actor: Central Government; Data Fiduciary

Trigger: Offshore processing/transfer

Government may notify destination restrictions.

Product Invariant: Separate from general s38 conflict rule; a contract cannot override a binding restriction.

Exception: s16(2) preserves higher protection/restriction in other Indian law for transfers.

Gazette Verified View Provision (s.16)

ACT-17 s.17

Tranche 3 (13 May 2027)

Section 17

Actor: Actors specified in exemption subrows

Trigger: Clause-specific conditions or notifications

Differently scoped disapplications in (1)-(5); see complete subrows.

Product Invariant: Determine activity, facts, disapplied provisions, preserved provisions and notification evidence before use.

Exception: Not all exemptions are partial, and not all have an identical necessity test.

Gazette Verified View Provision (s.17)

ACT-38 s.38

Tranche 1 (13 Nov 2025)

Section 38

Actor: Concurrent-law decision maker

Trigger: Concurrent law; actual conflict

Act in addition/not derogation; Act prevails to extent of conflict.

Product Invariant: Do not use a blanket stricter-sector-law-wins rule.

Exception: s16(2) is a separate transfer-specific saving.

Gazette Verified View Provision (s.38)

RULE-7 r.7

Tranche 3 (13 May 2027)

Rule 7

Actor: Data Fiduciary

Trigger: Awareness of any personal-data breach

Without-delay notices to each affected principal and initial Board notice; 72-hour detailed update; prescribed fields.

Product Invariant: Track awareness separately from occurrence/detection; incomplete knowledge does not permit silence.

Exception: Board may allow longer update period on written request; no severity exemption stated.

Gazette Verified View Provision (r.7)

RULE-14 r.14

Tranche 3 (13 May 2027)

Rule 14

Actor: Data Fiduciary; applicable CM; principal

Trigger: Rights and grievance services

Publish means/identifiers; prior-consent request; publish reasonable grievance-response period <=90 days and measures; one/more nominees per terms/law.

Product Invariant: Use source wording carefully: r14(3) is awkwardly drafted; interpret with s13(2), not as a publication delay.

Exception: Not general 48/72/90-day access/correction/erasure SLA.

Gazette Verified View Provision (r.14)

RULE-15 r.15

Tranche 3 (13 May 2027)

Rule 15

Actor: Data Fiduciary; Central Government

Trigger: Foreign transfer/access

Meet general/special order requirements for making personal data available to foreign State/controlled person/entity/agency.

Product Invariant: Not evidence-tag retention/documentation law or generic destination threshold.

Exception: Also s16 and conditional r13(4), plus sector duties.

Gazette Verified View Provision (r.15)

Target Systems Topology (SYS-001..014)

View Complete Architecture Topology →

SYS-001 System Spec →

Customer App & Web Portal

Public client boundary & untrusted intake surface for notices and consent capture

SYS-002 System Spec →

Core Lending Monolith & Transaction Store

Domestic production database and primary system of record for loan servicing

SYS-003 System Spec →

Marketing Automation Engine

Processor-operated messaging engine (ENT-004) gated by optional consent

SYS-004 System Spec →

Enterprise Cloud Data Warehouse

Purpose-partitioned analytical warehouse staging operational reporting

SYS-010 System Spec →

Consent Ledger & Policy Decision Point

Immutable consent event store and Policy Decision Point issuing authority tokens

SYS-012 System Spec →

SIEM & Security Telemetry Store

Security log repository preserving tamper-evident dual-clock audit trails

Associated Operational Controls

7 Controls Mapped

The following operational controls from the canonical Control Master Matrix (OBL-01 through OBL-54) are directly implemented, automated, and verified by this product:

Controls: OBL-01 OBL-04 OBL-09 OBL-20 OBL-21 OBL-22 OBL-51

OBL-01 s.3(a),(b),(c)

Legal / activity owner

Processing Scope & Territorial Perimeter

Verifies digital personal data processing within India and offshore goods/services nexus.

Target Systems: SYS-002; SYS-004

Workpaper: purpose-decisions.json

Spec: SPEC-Q10-OBL-01 Open Workpaper (OBL-01)

OBL-04 s.5 (notice; s.5(2) legacy)

Product / privacy

Itemised Notice & Legacy Consent Transition

Issues transparent multilingual notice and manages pre-commencement consent transition.

Target Systems: SYS-001; SYS-010

Workpaper: NOTICE-001-v1.md

Spec: SPEC-Q10-OBL-04 Open Workpaper (OBL-04)

OBL-09 s.8(3)

Data owner / rights operations

Personal Data Accuracy & Decision Completeness

Maintains accuracy and completeness of personal data used to make decisions affecting principals.

Target Systems: SYS-002; SYS-005

Workpaper: rights-case.json

Spec: SPEC-Q10-OBL-09 Open Workpaper (OBL-09)

OBL-20 r.9 (contact publication)

Rights operations / Legal

Contact Publication & Notice Surfaces (Rule 9)

Prominently displays DPO contact details across web, mobile, and communication surfaces (Rule 9).

Target Systems: SYS-001; contact publication surface

Workpaper: rights-case.json

Spec: SPEC-Q10-OBL-20 Open Workpaper (OBL-20)

OBL-21 r.5 + Second Schedule (State processing)

Legal / activity owner

State Processing Exemption Review (Rule 5)

Evaluates statutory criteria and Second Schedule exemptions for state instrumentality processing.

Target Systems: Not a base Company State-processing activity; applicability review only

Workpaper: purpose-decisions.json

Spec: SPEC-Q10-OBL-21 Open Workpaper (OBL-21)

OBL-22 r.15 (transfer)

Architecture / sector Legal

Cross-Border Data Transfer Governance (Rule 15)

Enforces cross-border transfer blacklists, adequacy checks, and contractual transfer terms.

Target Systems: SYS-008; SYS-009

Workpaper: transfer-decisions.json

Spec: SPEC-Q10-OBL-22 Open Workpaper (OBL-22)

OBL-51 ss.28–34,36–37 — staged functions with separate actors

Legal / board secretariat

Board Proceedings, Directions & Mediation (Sections 28–34, 36–37)

Handles Board investigations, binding compliance directions, and alternate dispute resolution.

Target Systems: Governance register; no live Board system asserted

Workpaper: dashboard.json

Spec: SPEC-Q10-OBL-51 Open Workpaper (OBL-51)

Enterprise Evidence Artifacts Vault

The following verifiable artifacts and test workpapers are generated by this product:

SECTOR_OVERRIDES_NBFC.xlsx

Dual_Clock_Reporting_Workpaper.md

Sector_Legal_Conflict_Matrix.json