Operational Lifecycle Hub
Operational Lifecycle Hub
Section 10 Rule 13
Significant Data Fiduciary & DPIA
Designation criteria under s.10(1), resident DPO mandate, independent external audit, and statutory Data Protection Impact Assessments under r.13.
Mapped Controls & Evidence Obligations
Appendix B Control Master Matrix rows governing this lifecycle.
OBL-32 Section 10(1) — designation-dependent SDF status
SPEC-Q10-OBL-32 Significant Data Fiduciary Assessment (Section 10(1))
Assesses processing volume, sensitivity, and national security factors against SDF designation.
Owner: Privacy / accountable sponsor Open Workpaper →
Systems: Governance source register
OBL-33 Section 10(2)(a)
SPEC-Q10-OBL-33 India-Resident Statutory DPO Appointment (Section 10(2)(a))
Appoints an India-resident Data Protection Officer reporting directly to the Board of Directors.
Owner: Privacy / accountable sponsor Open Workpaper →
Systems: Governance appointment evidence; no actual appointment claimed
OBL-34 Section 10(2)(b)
SPEC-Q10-OBL-34 Independent Data Auditor Engagement (Section 10(2)(b))
Appoints an independent external auditor to conduct periodic compliance evaluations.
Owner: Privacy / accountable sponsor Open Workpaper →
Systems: Governance audit relationship; no actual appointment claimed
OBL-35 Section 10(2)(c)
SPEC-Q10-OBL-35 DPIA & Periodic Security Risk Audit (Section 10(2)(c))
Executes periodic Data Protection Impact Assessments (DPIAs) and periodic security audits.
Owner: Privacy / accountable sponsor Open Workpaper →
Systems: SIEM & Security Telemetry Store (SYS-012); assessment/audit evidence
OBL-36 Rule 13
SPEC-Q10-OBL-36 SDF Algorithmic & Assessment Safeguards (Rule 13)
Conducts algorithmic transparency reviews and periodic risk assessments under Rule 13.
Owner: Privacy / accountable sponsor Open Workpaper →
Systems: SIEM & Security Telemetry Store (SYS-012); conditional SDF controls
Mechanism Chapters
Detailed architecture, implementation patterns, and case studies.