Roles
Six roles. Each one knows what is theirs.
DPDP work fails in the gaps between people: the request the branch never passed on, the erasure IT thought legal had approved. TrustOS gives each role its own queue, its own decisions and a clear handoff to the next.
Roles and teams
A role is one person's responsibility. A team is the group around it.
Each role below has its own work in TrustOS and the decisions that belong to it. Where a role sits inside a team, the team page is linked.
Data Protection Officer
The person accountable for the programme as a whole, and the named contact for questions about personal data. A Significant Data Fiduciary must appoint one based in India, reporting to its board.
In TrustOS
- Sees every open request, grievance, incident and overdue task on one view, by owner
- Approves the requirement map: which duties apply, to which products, and who owns each
- Signs off evidence packs before they go to an auditor, the board or the Data Protection Board
- Takes the monthly or quarterly report to the board or risk committee
- Decides escalations when a team cannot meet a deadline
Decides: Whether the programme is on track, and what goes to the board.
Privacy manager or privacy office
The people who run the work day to day: they keep the inventory current, route requests, chase owners and make sure each task closes with its evidence.
In TrustOS
- Maintains the data inventory with system owners, and runs the periodic review
- Triages incoming requests and grievances, checks identity and assigns them
- Prepares notice changes when a purpose changes, and sends them for legal review
- Runs processor reviews and Data Protection Impact Assessments with the business
Decides: How the work is routed and whether a task is really done.
Legal counsel
The people who decide what the law means for the organisation: the basis for each purpose, the wording of notices, what is kept under another law, and what is filed after a breach.
In TrustOS
- Approves notice versions before they are published, in each language
- Records the ground for each purpose: consent or a specific legitimate use
- Sets retention exceptions where another law requires data to be kept
- Reviews breach intimations and the 72 hour report before they are sent
Decides: What the organisation's legal position is. TrustOS records the decision; it does not make it.
Security lead
The CISO or security manager who owns safeguards and incidents: detection, containment, the facts of a breach, and the evidence that controls were in place.
In TrustOS
- Opens the incident record and starts the clock at the moment of awareness
- Assigns containment and investigation tasks, and records findings as they come in
- Links security safeguards, such as encryption, access control and log retention, to the duties they support
- Coordinates CERT-In reporting where its directions apply, alongside the DPDP intimations
Decides: Whether an event is an incident, and what the facts are.
IT and engineering
The people who run the systems where personal data lives. They connect those systems to TrustOS, or carry out the tasks where a connector is not possible.
In TrustOS
- Confirms which systems hold which data when the inventory is built or reviewed
- Sets up and maintains connectors through a documented interface or scoped database access
- Closes manual tasks, such as clearing a legacy archive, with the log attached
- Runs TrustOS itself when it is deployed in your own infrastructure
Decides: How each system is reached, and how actions in it are proven.
Operations and customer service
The branch staff, call centre agents, nurses at the front desk and support teams who meet the people whose data you hold. Requests often reach them first.
In TrustOS
- Logs requests received at a branch, on a call or by letter, with the channel recorded
- Points customers to the Privacy Centre to change choices and track requests
- Completes verification steps, such as checking a loan account or patient UHID
- Sees the status of a request when the customer calls back to ask
Decides: Nothing on the law. They make sure no request is lost at the front door.
One request, five handoffs
How the roles pass work along
An erasure request at a lending branch in Nashik, followed from the counter to the DPO's report. Illustrative.
- Step 1Operations logs itA customer asks at the branch to delete her data
- Step 2Privacy routes itIdentity checked, owners assigned, due date set
- Step 3Legal rules on itKYC records kept under another law, reason recorded
- Step 4IT acts on itConnectors erase; one archive task closed by hand
- Step 5DPO sees it closedThe request and its evidence in the monthly report
Small organisations
One person, several roles
In a fifty person company the DPO, privacy manager and legal reviewer may be the same person, with IT outsourced. TrustOS still separates the steps, so the record shows that each decision was made, even when one person made them all.
See it with your data
Show us where your personal data lives. We will show you TrustOS running on it.
A 30 minute walkthrough on Google Meet with someone who knows the Act and the product. You leave with a view of your first phase, the owners and the effort.
Or get a rollout proposal in two minutes- Step 1A 30 minute demo on Google MeetWith someone who knows the Act and the product.
- Step 2Your systems and purposesWe walk one product's personal data through TrustOS.
- Step 3A first phase you can planModules, owners and effort, written down for you to keep.