For legal and compliance teams

What you own

• Notice text per product and language, and the consent wording beside it.
• Processor contracts and intra-group agreements.
• Legitimate-use records for each s.7 ground you rely on.
• Retention, breach and rights policies.
• Updates to the Board of Directors.
• Tracking where sector regulators' directions sit alongside DPDP.

Notices that meet Rule 3

• Understandable on its own, in clear and plain language.
• An itemised description of the personal data and the specified purposes, with the goods, services or uses the processing enables.
• The means, with a link, to withdraw consent, exercise rights and complain to the Board.
• Withdrawal comparably as easy as giving consent.
• Readable in English or any Eighth Schedule language (s.5(3)), and sent as soon as reasonably practicable to people whose consent predates commencement (s.5(2)).

Processor contracts and legitimate uses

s.8(2) allows processors only under a valid contract, and Rule 6 requires security terms in it. Most teams also cover instructions, breach reporting without delay, erasure on instruction (s.8(7)), sub-processors and audit; see the processor contracts guide.

For each legitimate use you rely on, write a short record: the s.7 clause, the activity, the data, and why the clause fits. DPDP has no legitimate interest ground (s.4), so do not carry a GDPR assessment across unchanged.

Proof of consent

Under s.6(10), the fiduciary must prove that notice was given and consent obtained. Keep, for each person and purpose: the notice version shown, the time, the method, and every later withdrawal or update.

Link each record to the exact notice text the person saw, not the current version. When a notice changes, decide whether the change needs fresh consent and record that decision.

What to do this quarter

1. 01Rewrite notices

   Itemise data and purposes per product, and add the three links Rule 3 requires.

2. 02Paper processors

   Use an addendum on every vendor that touches personal data, starting with the largest.

3. 03Write legitimate-use records

   Cover employment (s.7(i)), legal obligations (s.7(d)) and court orders (s.7(e)) where you rely on them.

4. 04Set the retention policy

   Define periods per data category, with the law behind any retention beyond the purpose (s.8(7)).

5. 05Update the Board of Directors

   Report readiness, open risks and decisions needed, using the board reporting guide.

How TruePrivacy helps

• Consent management logs every grant, withdrawal, rejection and update, with consent receipts as evidence for s.6(10).
• Notice campaigns send s.5(2) notices and re-consent requests by email. You write and review the notice text.
• Vendors and processors tracks contracts, and records of processing hold your processing activities.
• Policies, workflows and an audit trail exportable as CSV give you the evidence trail.