Documentation for evaluators, implementers, and operators.

Operator workflow

1. Create business domains and services.
2. Add applications, databases, files, and other data stores.
3. Record personal data categories and processing activities.
4. Associate processors, owners, and system contacts.
5. Run or import discovery findings where available.
6. Review and approve the resulting record.

Expected records

• Data store inventory
• Processing activity record
• Personal data category record
• Processor relationship
• Ownership and review history
• Discovery finding and resolution

Operator workflow

1. Create the processing purpose.
2. Select the relevant personal data.
3. Record the applicable processing ground.
4. Add the responsible business function.
5. Set the retention requirement.
6. Draft and review the notice.
7. Publish an approved version.

Expected records

• Purpose version
• Data category mapping
• Processing ground record
• Retention requirement
• Notice version
• Approval and publication history

Operator workflow

1. Select the approved purpose and notice.
2. Configure the consent experience.
3. Review language and accessibility.
4. Publish the approved version.
5. Record grant or withdrawal decisions.
6. Review history and exceptions.
7. Confirm that connected actions are created where required.

Expected records

• Consent experience version
• Notice association
• Grant record
• Withdrawal record
• Decision history
• Downstream action status
• Integrity verification result

Available services

• Review and manage consent preferences
• Submit requests for access information
• Submit correction, completion, updating, or erasure requests
• Raise a grievance
• Submit nomination details
• Review request status where configured
• Access published privacy information and contact details

Operator workflow

1. Receive the request.
2. Verify identity and authority.
3. Classify the request.
4. Assign the responsible team.
5. Gather the required information or complete the required action.
6. Review the response.
7. Communicate with the Data Principal.
8. Record the outcome and closure evidence.

Expected records

• Request record
• Verification record
• Assignment history
• Communication history
• Internal task record
• Approval record
• Outcome and closure evidence

Operator workflow

1. Select the relevant processing record or request.
2. Confirm the required action.
3. Review legal and operational exceptions.
4. Create the action for connected systems.
5. Monitor execution.
6. Resolve failures or exceptions.
7. Record completion and available verification.

Expected records

• Action request
• Connected system response
• Exception record
• Retry history
• Completion status
• Verification information

Operator workflow

1. Open the incident record.
2. Record the nature, timing, location, extent, and likely impact.
3. Identify affected Data Principals.
4. Record immediate containment and remediation.
5. Prepare and record communications to affected Data Principals.
6. Record the information provided to the Data Protection Board of India.
7. Track additional information and detailed reporting.
8. Record findings, corrective action, and closure review.

Expected records

• Incident chronology
• Affected data and system record
• Data Principal communication record
• Board intimation record
• Detailed reporting information
• Remediation action
• Closure review and evidence

Available records

• Processor details
• Service and processing description
• Data categories involved
• Contractual reference
• Security and compliance review
• Responsible owner
• Issue and remediation record
• Review and renewal history

Operator workflow

1. Describe the proposed or existing processing.
2. Identify the personal data and affected Data Principals.
3. Assess potential impact on Data Principal rights.
4. Record existing safeguards.
5. Assign further remediation.
6. Review and approve the assessment.
7. Schedule periodic review where required.

Available outputs

• Processing records
• Consent and notice history
• Rights and grievance records
• Retention and erasure records
• Personal data breach records
• Processor oversight records
• Impact assessments
• Remediation status
• Approved evidence packages

Administration areas

• Tenant configuration
• User accounts
• Roles and permissions
• Authentication settings
• Activity records
• Organisation details
• Branding and language settings
• Notification settings
• Environment and deployment configuration