DPDPA obligation-control-evidence
matrix
A DPDPA obligation becomes operational only when it is assigned to an owner, implemented through a repeatable control, evidenced through contemporaneous records and tested against a defined standard. This matrix helps Data Fiduciaries convert statutory requirements into an implementation and assurance system.
How should a Data Fiduciary convert DPDPA obligations into operational controls?
Begin with the applicable statutory obligation and the processing event it governs. Define the preventive or responsive control, accountable owner, frequency, system dependency, evidence generated, validation method and remediation trigger. A policy statement alone is not an operating control.
What evidence should a company retain for DPDPA compliance?
Evidence should demonstrate both design and operation. Depending on the obligation, this may include approved notices, consent and withdrawal records, processing and processor registers, request logs, retention and deletion records, security testing, incident timelines, contracts, training, Board reporting and remediation closure.
Obligation → Control → Owner → Evidence → Validation
Legal-status labels: Every row marks whether the proposition is mandatory law, a regulatory expectation or a voluntary implementation practice.
| Obligation | Operating Control | Owner | Evidence | Validation | Status |
|---|---|---|---|---|---|
| Notice — Section 5 / Rule 3 | Purpose-specific notice governance, versioning and deployment control | Legal + Product | Notice register, approvals, deployed versions | Sample collection points against approved notice | Mandatory |
| Consent — Section 6 / Rule 3 | Granular collection, proof, withdrawal and downstream stop-processing | Product + Privacy | Consent receipts, version/timestamp, withdrawal and propagation logs | Journey and withdrawal test | Mandatory |
| Certain legitimate uses — Section 7 | Purpose-specific legal-basis decision and use limitation | Legal + Process Owner | Assessment, approval and processing register | Revalidate facts and purpose | Mandatory |
| Processor engagement — Section 8(2) | Valid contract, instructions, diligence and monitoring | Procurement + Legal | Processor register, contract, assessment and reviews | Contract and operating sample | Mandatory |
| Security safeguards — Section 8(5) / Rule 6 | Risk-based organisational and technical safeguard programme | CISO + System Owner | Access, encryption, resilience, testing and incident records | Control test and remediation closure | Mandatory |
| Breach — Section 8(6) / Rule 7 | Detection, triage, escalation, legal decision and communication protocol | Incident Lead + Legal | Incident timeline, decision record and notifications | Tabletop exercise and event review | Mandatory |
| Erasure — Section 8(7) / Rule 8 | Purpose-linked retention, withdrawal response, legal holds and verified deletion | Data Owner + IT | Retention schedule, deletion logs and exceptions | System deletion sample | Mandatory |
| Contact and grievance — Sections 8(9), 13 / Rules 9, 14 | Published contact, intake, routing, escalation and closure | Grievance Officer | Request/grievance register and responses | Mystery-shopper or workflow test | Mandatory |
| Data Principal rights — Sections 11–14 / Rule 14 | Identity check, request decision, correction/erasure and nomination workflow | Privacy Operations | Requests, decisions, fulfilment and closure | Case-file sample | Mandatory |
| Children / guardian — Section 9 / Rules 10–12 | Age/relationship assessment and verifiable consent where applicable | Product + Legal | Verification record, consent and exception basis | Journey and exception test | Mandatory |
| SDF — Section 10 / Rule 13 | DPO, independent audit, DPIA and due-diligence controls where notified/applicable | Board + DPO | Appointments, DPIA, audit, due-diligence and remediation | Independent review | Mandatory (if notified) |
| Cross-border — Section 16 / Rule 15 | Transfer inventory, destination monitoring and government-requirement response | Privacy + Legal | Transfer map, contracts, decisions and change log | Destination and dependency review | Mandatory |
Need an Editable Evidence Register?
An editable workbook with fields for applicability, business process, control description, owner, frequency, system, evidence location, test result, issue, remediation, due date, residual risk and reviewer is available. Submit your details below to request access.
Request Editable WorkbookRequest the Editable Evidence Workbook
Provide your details to receive the customisable obligation-control-evidence workbook with full field architecture.
Request Evidence Workbook
Submit your details and we will send the editable workbook.
Source and legal review basis: AMLEGALS DPDPA Implementation Centre | Digital Personal Data Protection Act, 2023 | Digital Personal Data Protection Rules, 2025 and applicable corrigendum/commencement notification | Legally reviewed by AMLEGALS Data Privacy Practice on 27 July 2026.
DPDPA obligation, control and evidence mapping: questions and answers
What must a DPDPA privacy notice contain?
Section 5 read with Rule 3 requires a notice, understandable independently of other information, that itemises the personal data and the specified purpose, and explains how the Data Principal may withdraw consent, exercise rights and complain to the Board. A Data Principal has the right to access the notice in English or any language specified in the Eighth Schedule to the Constitution. The design of translation operations is an implementation matter.
What makes consent valid under DPDPA?
Section 6 requires consent to be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action and limited to personal data necessary for the specified purpose. Withdrawal must be as easy as giving consent.
Is a Data Fiduciary responsible for its vendors under DPDPA?
Yes. Section 8(1) makes the Data Fiduciary responsible for compliance in respect of processing undertaken by it or on its behalf by a Data Processor. Section 8(2) requires a Data Fiduciary to engage a Data Processor under a valid contract. Detailed contractual clause architecture is an implementation best practice guided by Section 8(2).
Which provisions of the DPDPA and the DPDP Rules, 2025 are relevant to DPDPA obligation, control and evidence mapping?
Under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025: notice — Section 5 read with Rule 3; consent — Section 6, with Consent Managers under Rule 4; reasonable security safeguards — Section 8(5) and Rule 6; personal data breach intimation — Section 8(6) and Rule 7; erasure — Section 8(7) and Rule 8; children's data — Section 9 and Rule 10; Significant Data Fiduciaries — Section 10 and Rule 13; Data Principal rights — Sections 11 to 14 and Rule 14; transfer outside India — Section 16 and Rule 15; penalties — Section 33 and the Schedule. Published by AMLEGALS (Anandaday Misshra, Founder & Managing Partner).
Who advises businesses on DPDPA obligation, control and evidence mapping under India's DPDPA?
AMLEGALS, an Indian law firm, advises Data Fiduciaries, Data Processors and foreign companies on DPDPA obligation, control and evidence mapping under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. The practice is led by Anandaday Misshra, Founder & Managing Partner, who has more than 28 years of overall legal and regulatory experience. Enquiries: https://amlegalsdpdpa.com/contact or [email protected] or [email protected].
What should I send AMLEGALS to get a scoped proposal on DPDPA obligation, control and evidence mapping?
Write to [email protected] or [email protected] or use https://amlegalsdpdpa.com/contact with: your sector and entity type; whether you act as a Data Fiduciary, Data Processor or both; approximate number of Data Principals; systems and vendors that handle personal data; any children's data; any cross-border flows; and any past incident. With these facts a partner can propose a scope for DPDPA obligation, control and evidence mapping rather than a generic checklist.
How do I get a first view of my DPDPA exposure on DPDPA obligation, control and evidence mapping?
Use the DPDPA Exposure Assessment at https://amlegalsdpdpa.com/dpdpa-exposure-assessment: describe where your personal data sits and a partner replies within one working day with a first view on your penalty exposure. Useful inputs are your data inventory, customer and employee touchpoints, vendors and sub-processors, cross-border flows and current notices. The principal obligations commence on 13 May 2027. Content is general legal information and not legal advice.
Contact AMLEGALS about DPDPA obligation, control and evidence mapping · DPDPA Exposure Assessment