DPDPA 2023 MINDSET

1. Accountability

• Data Fiduciary duty; demonstrate compliance

2. Purpose limitation

• Specified purpose; no incompatible processing

3. Data minimisation

• Only necessary personal data; reduce access

4. Notice to Data Principal

• Provide notice; clear, itemised information

5. Consent management

• Free, specific, informed; easy withdrawal

6. Data Principal rights

• Access; correction/erasure; nominate; grievance

7. Reasonable safeguards

• Technical + organisational measures; prevent breach

8. Data Processor controls

• Contractual obligations; monitor sub-processors

9. Personal data breach

• Contain; notify DPB + Data Principals; evidence

10. Retention & erasure

• Erase when purpose met unless required by law

11. Purpose register

• Record purposes, datasets, owners, Processors

12. DPIA & audit (SDF)

• Data Protection Impact Assessment; independent audit

13. Training & awareness

• Role-based training; drills; secure handling

14. Cross-border transfer

• Check notified restrictions; document transfer basis