Implementation
Start with one product. Have it working in weeks.
Trying to cover every system at once is how DPDP programmes stall. We start with the products and channels where the risk is highest, get them running properly, then extend.
In short
How is TrustOS implemented?
In phases. The first phase usually covers the data inventory, notices and the request workflow for one or two products, and runs in weeks. Later phases add breach response, processors and evidence, and extend the work to more systems and channels.
How a rollout runs
Five phases, each with something you can see
- Step 1Scoping and discoveryWorkshops with privacy, legal, technology and operations. We map the products, the systems that hold personal data, the vendors and the owners, and agree what the first phase covers.
- Step 2ConfigurationPurposes, notices, consent flows, request types, retention rules and roles are set up in TrustOS for the products in scope.
- Step 3Integrations and actionsConnectors to the systems that hold the data, so consent changes, erasure and suppression run where the data lives. Manual steps are assigned where a system cannot be connected.
- Step 4Validation and trainingTest requests and test incidents run end to end. Teams are trained on their part of the work, and you accept each workflow before it goes live.
- Step 5Go live and handoverProduction deployment, the Privacy Centre published, and handover to the people who will run it, with documentation and a support plan.
Who brings what
A shared plan, with both sides named
An implementation moves at the pace of the slower side. This is what each side puts in, area by area.
| Area | Code Colonies brings | You bring |
|---|---|---|
| Leadership | A lead who knows the DPDP Act and the product | A sponsor who can make decisions |
| People | Engineers for configuration and connectors | Named owners in privacy, technology and operations |
| Systems | Connector interfaces and test cases | Access to the systems in scope, or people who can act in them |
| Content | Templates for notices, registers and runbooks | Your counsel's view on legal interpretation |
| Acceptance | Test plans and training for each team | Time for testing and acceptance |
| After go live | Support through go live and after | Owners who keep the records current |
Outside the scope · Legal advice, formal certification, independent audit and representation before regulators are not part of an implementation unless agreed separately. Custom integration work can be delivered on 2good.dev terms, where you pay after you accept the work.
The end of the first phase
What is running, for the products in scope
The first phase is judged by work that runs, so each item below is something you can open in TrustOS and check.
- A data inventory for the products in scope, with systems, vendors and owners
- Purposes, notices and consent flows set up, with each notice version recorded
- The request workflow live, with the Privacy Centre published under your name
- Connectors to the systems in scope, or assigned manual steps where a system cannot be connected
- Teams trained on their part of the work, and each workflow accepted by you
Questions
About implementation
How long does a first phase take?
It depends on the systems in scope. A first phase covering the inventory, notices and the request workflow for one or two products usually runs in weeks. We give you a plan with dates after scoping.
Do we need a Data Protection Officer first?
No. Someone needs to own the programme, but the formal DPO role is a duty for Significant Data Fiduciaries. Many teams start with a privacy lead and grow from there.
Can our own IT team build the connectors?
Yes. We share the interface and test cases, and review the work with them. Or our engineers build them with your team.
See it with your data
Show us where your personal data lives. We will show you TrustOS running on it.
A 30 minute walkthrough on Google Meet with someone who knows the Act and the product. You leave with a view of your first phase, the owners and the effort.
Or get a rollout proposal in two minutes- Step 1A 30 minute demo on Google MeetWith someone who knows the Act and the product.
- Step 2Your systems and purposesWe walk one product's personal data through TrustOS.
- Step 3A first phase you can planModules, owners and effort, written down for you to keep.