Digital Personal Data Protection Act:2023 (DPDP) - Universal Control Library

TypeLaw Privacy

Framework ID

FW-011

Framework Code

DPDP

Publisher

Government of India

Framework Family

India

Region

India

Industry

All

Framework Overview

DPDP · Full Framework Profile

Purpose & Objective

Regulate the processing of digital personal data in India while recognizing individuals’ rights and the need to process personal data for lawful purposes. It establishes duties for Data Fiduciaries and mechanisms for consent, specified legitimate uses, safeguards, breach response and individual requests.

Scope

Generally concerns digital personal data processed in India, including certain processing outside India connected with offering goods or services to individuals in India. Applicability and obligations depend on the Act’s scope, exemptions, the organization’s role, processing context and provisions or rules in force.

Key Focus Areas

Structure & Domains

Certification & Assessment

Official Source

DPDP · Reference

Visit Official Source

Associated Compliance Domains

3 Mapped Domains in Framework

Click any domain to explore its controls, requirements, and implementation guidance.

Domain ID	Code	Domain Name	Business Owner	Controls	Status	Action
DOM-001	GOV	Governance	Board / CISO	8	Active	View Domain →
DOM-008	DAT	Data Protection & Privacy	Data Protection Officer	16	Active	View Domain →
DOM-024	TPR	Third-Party & Supply Chain Security	Vendor Risk Management	6	Active	View Domain →

Associated Controls Catalog

30 Active Controls in Framework

Control ID	Control Name	Category & Type	Criticality	Status	Requirements	Action
GOV-001	Information Security Governance Establishes the foundational governance structures, accounta...	Administrative Detective	Critical	Active	📋 12 Reqs	View →
GOV-002	Security Charter Creates the foundational governing document establishing the...	Administrative Detective	High	Active	📋 12 Reqs	View →
GOV-003	Governance Committees Establishes formal governance committees with defined charte...	Administrative Preventive	Critical	Active	📋 12 Reqs	View →
GOV-004	Executive Oversight & Reporting Establishes processes and reporting frameworks to provide ex...	Administrative Detective	High	Active	📋 12 Reqs	View →
GOV-005	Information Security Program Management Establishes program management capabilities including strate...	Administrative Detective	High	Active	📋 12 Reqs	View →
GOV-006	Security Program Continuous Improvement Establishes a structured continuous improvement process usin...	Administrative Corrective	High	Active	📋 12 Reqs	View →
GOV-007	Security Integration into Business & Technology Initiatives Establishes processes to embed security, privacy, resilience...	Administrative Preventive	High	Active	📋 12 Reqs	View →
GOV-008	Enterprise Control Library Management Establishes a centralized, governed library of security and...	Administrative Detective	High	Active	📋 12 Reqs	View →
DAT-001	Data Protection & Privacy Strategy Establishes enterprise data protection and privacy strategy...	Administrative Preventive	Critical	Active	📋 10 Reqs	View →
DAT-002	Data Discovery Establishes automated and manual processes to discover, iden...	Technical Detective	High	Active	📋 10 Reqs	View →
DAT-003	Data Classification & Handling Establishes a data classification framework with defined cat...	Administrative Preventive	High	Active	📋 10 Reqs	View →
DAT-004	Data Retention & Disposal Establishes data retention schedules, archival processes, di...	Technical Preventive	Critical	Active	📋 10 Reqs	View →
DAT-005	Data Ownership & Stewardship Establishes clear data ownership and stewardship assignments...	Technical Preventive	High	Active	📋 10 Reqs	View →
DAT-006	Data Flow Mapping, Inventory & Lineage Establishes comprehensive data flow mapping, data inventory,...	Administrative Preventive	High	Active	📋 10 Reqs	View →
DAT-007	Data Subject Rights Management Establishes processes for receiving, validating, fulfilling,...	Administrative Detective	High	Active	📋 10 Reqs	View →
DAT-008	Consent Management Establishes comprehensive consent management including colle...	Administrative Detective	High	Active	📋 10 Reqs	View →
DAT-009	Cross-Border Data Transfer Establishes governance for cross-border data transfers inclu...	Technical Detective	High	Active	📋 10 Reqs	View →
DAT-010	Privacy Notices Establishes processes for developing, publishing, maintainin...	Technical Preventive	High	Active	📋 10 Reqs	View →
DAT-011	Privacy by Design Establishes processes to integrate privacy requirements, con...	Technical Preventive	High	Active	📋 10 Reqs	View →
DAT-012	Data Protection Impact Assessment (DPIA) Establishes formal DPIA processes for scoping, assessing, do...	Technical Detective	Critical	Active	📋 10 Reqs	View →
DAT-013	Record of Processing Activities (ROPA) Establishes and maintains a complete, accurate Record of Pro...	Technical Preventive	High	Active	📋 10 Reqs	View →
DAT-014	Data Loss Prevention (DLP) Establishes Data Loss Prevention controls including policy d...	Technical Detective	Critical	Active	📋 10 Reqs	View →
DAT-015	Data Integrity Establishes data integrity controls including protection, va...	Technical Detective	Critical	Active	📋 10 Reqs	View →
DAT-016	Data Masking & Anonymization Establishes data masking and anonymization processes for pro...	Technical Detective	High	Active	📋 10 Reqs	View →
TPR-001	Third-Party Risk Management Program Establishes TPRM program including governance, scope, classi...	Administrative Detective	Critical	Active	📋 10 Reqs	View →
TPR-002	Third-Party Risk Assessment & Due Diligence Establishes third-party due diligence including vendor risk...	Administrative Detective	Critical	Active	📋 10 Reqs	View →
TPR-003	Third-Party Contract & Compliance Management Establishes third-party contract management including contra...	Administrative Detective	High	Active	📋 10 Reqs	View →
TPR-004	Third-Party Continuous Monitoring & Assurance Establishes third-party monitoring including continuous risk...	Operational Detective	High	Active	📋 10 Reqs	View →
TPR-005	Third-Party Lifecycle & Offboarding Management Establishes third-party lifecycle management including onboa...	Administrative Preventive	High	Active	📋 10 Reqs	View →
TPR-006	Third-Party Concentration Risk Management Establishes concentration risk management including critical...	Administrative Detective	High	Active	📋 10 Reqs	View →

Compliance Requirements & Audit Crosswalk

316 Specific Audit Clauses

The following requirements dictate specific audit evidence criteria and testing steps mapped directly under the controls of this framework.

REQUIREMENT ID	REQUIREMENT TITLE & DETAILS	MAPPED CONTROL	TYPICAL OWNER	ACTION
GOV-001-R001	Governance Framework The organization shall establish and maintain a formal governance framework for...	GOV-001 Information Security Governanc...	CISO, Governance Committee, Board of Directors, Risk Management	View ↗
GOV-001-R002	Governance Charter The organization shall establish and maintain a formal charter for the informati...	GOV-001 Information Security Governanc...	CISO, Board of Directors, CEO, Governance Committee, Legal	View ↗
GOV-001-R003	Governance Principles The organization shall define and document the core governance principles that g...	GOV-001 Information Security Governanc...	CISO, Governance Committee, Privacy Officer, Legal, Executive Leadership	View ↗
GOV-001-R004	Governance Scope The organization shall define and maintain a documented scope for the informatio...	GOV-001 Information Security Governanc...	CISO, Governance Committee, Enterprise Architecture, Asset Owners, Business Unit Leaders	View ↗
GOV-001-R005	Governance Authority The organization shall establish a formal governance authority for information s...	GOV-001 Information Security Governanc...	CISO, Board of Directors, CEO, Legal	View ↗
GOV-001-R006	Governance Accountability The organization shall assign accountability for the information security and pr...	GOV-001 Information Security Governanc...	CISO, CEO, Board of Directors, Compliance Committee, Risk Committee	View ↗
GOV-001-R007	Governance Decision-Making The organization shall maintain formal decision-making processes for information...	GOV-001 Information Security Governanc...	CISO, Governance Committee, Risk Committee, Compliance, Legal	View ↗
GOV-001-R008	Governance Oversight The organization shall implement formal oversight mechanisms, including governan...	GOV-001 Information Security Governanc...	Board of Directors, Audit Committee, Risk Committee, CISO, Independent Advisors	View ↗
GOV-001-R009	Governance Performance The organization shall measure the effectiveness and efficiency of the governanc...	GOV-001 Information Security Governanc...	CISO, Governance Committee, Board of Directors, Audit Committee	View ↗
GOV-001-R010	Governance Review The organization shall periodically review the governance function to ensure it...	GOV-001 Information Security Governanc...	CISO, Internal Audit, Board of Directors, Governance Committee	View ↗
GOV-001-R011	Governance Reporting The organization shall provide timely and relevant governance information to sta...	GOV-001 Information Security Governanc...	CISO, Board of Directors, Executive Leadership, Audit Committee	View ↗
GOV-001-R012	Governance Continuous Improvement The organization shall drive ongoing enhancement of the governance function thro...	GOV-001 Information Security Governanc...	CISO, Governance Committee, Internal Audit, Risk Management	View ↗
GOV-002-R001	Charter Establishment The organization shall establish a formal Information Security Charter that defi...	GOV-002 Security Charter	CISO, CEO, Board of Directors, Legal, Compliance	View ↗
GOV-002-R002	Charter Purpose The Information Security Charter shall clearly articulate the purpose of the inf...	GOV-002 Security Charter	CISO, CEO, Board of Directors, Communications	View ↗
GOV-002-R003	Charter Scope The Information Security Charter shall define the governance scope, organization...	GOV-002 Security Charter	CISO, CEO, Legal, Business Unit Leaders	View ↗
GOV-002-R004	Charter Authority The Information Security Charter shall articulate the full extent of the securit...	GOV-002 Security Charter	CISO, Board of Directors, CEO, Legal	View ↗
GOV-002-R005	Charter Governance Mandate The Information Security Charter shall define the security function's governance...	GOV-002 Security Charter	CISO, Board of Directors, Governance Committee, Risk Committee	View ↗
GOV-002-R006	Charter Executive Sponsorship The Information Security Charter shall be sponsored by a senior executive with t...	GOV-002 Security Charter	CEO, CISO, Board of Directors	View ↗
GOV-002-R007	Charter Approval The Information Security Charter shall be formally approved by the highest level...	GOV-002 Security Charter	Board of Directors, CEO, CISO	View ↗
GOV-002-R008	Charter Communication The organization shall communicate the Information Security Charter to relevant...	GOV-002 Security Charter	CISO, Communications, HR, Legal, Compliance	View ↗
GOV-002-R009	Charter Accessibility The organization shall ensure the Information Security Charter is readily availa...	GOV-002 Security Charter	CISO, IT Operations, Legal, Compliance	View ↗
GOV-002-R010	Charter Review The organization shall periodically review the Information Security Charter to e...	GOV-002 Security Charter	CISO, Board of Directors, Legal, Compliance	View ↗
GOV-002-R011	Charter Maintenance The organization shall maintain the Information Security Charter through a forma...	GOV-002 Security Charter	CISO, Legal, Compliance, Board of Directors	View ↗
GOV-002-R012	Charter Alignment The organization shall ensure the Information Security Charter is aligned with a...	GOV-002 Security Charter	CISO, Legal, Corporate Governance, Board of Directors	View ↗
GOV-003-R001	Committee Establishment The organization shall establish formal governance committees with responsibilit...	GOV-003 Governance Committees	CISO, Executive Leadership, Board of Directors, Business Unit Leaders	View ↗
GOV-003-R002	Committee Charter The organization shall develop and maintain a formal charter for each governance...	GOV-003 Governance Committees	Committee Chair, CISO, Governance Committee	View ↗
GOV-003-R003	Committee Scope The charter for each governance committee shall clearly define the scope of the...	GOV-003 Governance Committees	Committee Chair, CISO, Governance Committee	View ↗
GOV-003-R004	Committee Membership The organization shall define and document membership requirements for each gove...	GOV-003 Governance Committees	CISO, Governance Committee, Human Resources	View ↗
GOV-003-R005	Committee Roles and Authority The organization shall clearly define the roles and authority of committee membe...	GOV-003 Governance Committees	Committee Chair, CISO, Governance Committee	View ↗
GOV-003-R006	Committee Meeting Management The organization shall establish effective meeting management processes for each...	GOV-003 Governance Committees	Committee Chair, Committee Secretary, CISO	View ↗
GOV-003-R007	Committee Decision Making The organization shall maintain formal decision-making processes for each govern...	GOV-003 Governance Committees	Committee Chair, Committee Secretary, CISO	View ↗
GOV-003-R008	Committee Reporting The organization shall ensure each governance committee receives the information...	GOV-003 Governance Committees	CISO, Committee Secretary, Report Owners	View ↗
GOV-003-R009	Committee Escalation The organization shall establish escalation processes for each governance commit...	GOV-003 Governance Committees	Committee Chair, CISO, Executive Leadership, Board of Directors	View ↗
GOV-003-R010	Committee Performance Review The organization shall conduct periodic performance reviews of each governance c...	GOV-003 Governance Committees	Governance Committee, Internal Audit, CISO	View ↗
GOV-003-R011	Committee Records Management The organization shall maintain records management processes for each governance...	GOV-003 Governance Committees	Committee Secretary, Records Management, Legal, CISO	View ↗
GOV-003-R012	Committee Continuous Improvement The organization shall drive ongoing enhancement of each governance committee th...	GOV-003 Governance Committees	Committee Chair, CISO, Internal Audit	View ↗
GOV-004-R001	Executive Oversight Framework The organization shall establish an executive oversight framework that defines h...	GOV-004 Executive Oversight & Reportin...	Board of Directors, CEO, CISO, Audit Committee	View ↗
GOV-004-R002	Board Oversight Responsibilities The organization shall define and document the board of directors' responsibilit...	GOV-004 Executive Oversight & Reportin...	Board of Directors, CEO, CISO, Corporate Governance	View ↗
GOV-004-R003	Executive Management Oversight The organization shall define and document executive management's responsibiliti...	GOV-004 Executive Oversight & Reportin...	CEO, CISO, Executive Leadership, Audit Committee	View ↗
GOV-004-R004	Governance Review Meetings The organization shall conduct regular governance review meetings between execut...	GOV-004 Executive Oversight & Reportin...	Board of Directors, CEO, CISO, Audit Committee	View ↗
GOV-004-R005	Executive Reporting Framework The organization shall establish an executive reporting framework that defines h...	GOV-004 Executive Oversight & Reportin...	CISO, Board of Directors, Executive Leadership, Audit Committee	View ↗
GOV-004-R006	Reporting Content and Information Quality The organization shall define content requirements for executive and board repor...	GOV-004 Executive Oversight & Reportin...	CISO, Board of Directors, Executive Leadership	View ↗
GOV-004-R007	Reporting Frequency and Timeliness The organization shall establish reporting frequency and timeliness requirements...	GOV-004 Executive Oversight & Reportin...	CISO, Board of Directors, Executive Leadership	View ↗
GOV-004-R008	Governance Performance Reporting The organization shall provide executive leadership and the board with regular r...	GOV-004 Executive Oversight & Reportin...	CISO, Board of Directors, Executive Leadership, Internal Audit	View ↗
GOV-004-R009	Strategic Risk and Issue Reporting The organization shall provide executive leadership and the board with regular r...	GOV-004 Executive Oversight & Reportin...	CISO, Board of Directors, Risk Committee, Executive Leadership	View ↗
GOV-004-R010	Executive Decision Support The organization shall provide executive leadership and the board with informati...	GOV-004 Executive Oversight & Reportin...	CISO, Board of Directors, Executive Leadership, Internal Audit	View ↗
GOV-004-R011	Oversight Records and Action Tracking The organization shall maintain comprehensive records of executive oversight and...	GOV-004 Executive Oversight & Reportin...	CISO, Governance Committee, Records Management	View ↗
GOV-004-R012	Oversight and Reporting Continuous Improvement The organization shall drive ongoing enhancement of executive oversight and repo...	GOV-004 Executive Oversight & Reportin...	CISO, Board of Directors, Executive Leadership	View ↗
GOV-005-R001	Program Management Framework The organization shall establish a program management framework for the informat...	GOV-005 Information Security Program M...	CISO, Security Program Manager, Project Management	View ↗
GOV-005-R002	Program Planning The organization shall conduct formal planning for the information security prog...	GOV-005 Information Security Program M...	CISO, Security Program Manager, Project Management	View ↗
GOV-005-R003	Program Execution The organization shall execute the information security program in accordance wi...	GOV-005 Information Security Program M...	CISO, Security Program Manager, Project Managers	View ↗
GOV-005-R004	Program Resource Management The organization shall manage resources for the information security program, in...	GOV-005 Information Security Program M...	CISO, Security Program Manager, Human Resources	View ↗
GOV-005-R005	Program Budget Management The organization shall manage the information security program budget, including...	GOV-005 Information Security Program M...	CISO, Security Program Manager, Finance	View ↗
GOV-005-R006	Program Staffing The organization shall ensure the information security program is appropriately...	GOV-005 Information Security Program M...	CISO, Security Program Manager, Human Resources	View ↗
GOV-005-R007	Program Prioritization The organization shall maintain prioritization processes for the information sec...	GOV-005 Information Security Program M...	CISO, Security Program Manager, Risk Management	View ↗
GOV-005-R008	Program Coordination The organization shall maintain coordination processes for the information secur...	GOV-005 Information Security Program M...	CISO, Security Program Manager, Business Unit Leaders	View ↗
GOV-005-R009	Program Dependency Management The organization shall maintain dependency management processes for the informat...	GOV-005 Information Security Program M...	CISO, Security Program Manager, Project Management	View ↗
GOV-005-R010	Program Performance Monitoring The organization shall monitor the performance of the information security progr...	GOV-005 Information Security Program M...	CISO, Security Program Manager, Performance Management	View ↗
GOV-005-R011	Program Review The organization shall conduct periodic reviews of the information security prog...	GOV-005 Information Security Program M...	CISO, Security Program Manager, Internal Audit	View ↗
GOV-005-R012	Program Continuous Improvement The organization shall drive ongoing enhancement of the information security pro...	GOV-005 Information Security Program M...	CISO, Security Program Manager, Security Teams	View ↗
GOV-006-R001	Improvement Framework The organization shall establish a continuous improvement framework for the info...	GOV-006 Security Program Continuous Im...	CISO, Security Program Manager, Quality Management	View ↗
GOV-006-R002	Improvement Identification The organization shall systematically identify improvement opportunities for the...	GOV-006 Security Program Continuous Im...	CISO, Security Program Manager, Security Teams	View ↗
GOV-006-R003	Improvement Prioritization The organization shall prioritize improvement opportunities for the information...	GOV-006 Security Program Continuous Im...	CISO, Security Program Manager, Risk Management	View ↗
GOV-006-R004	Improvement Planning The organization shall develop formal plans for implementing approved improvemen...	GOV-006 Security Program Continuous Im...	CISO, Security Program Manager, Project Managers	View ↗
GOV-006-R005	Improvement Approval The organization shall establish approval processes for improvement initiatives...	GOV-006 Security Program Continuous Im...	CISO, Security Program Manager, Governance Committee	View ↗
GOV-006-R006	Improvement Implementation The organization shall implement approved improvements to the information securi...	GOV-006 Security Program Continuous Im...	CISO, Security Program Manager, Project Managers	View ↗
GOV-006-R007	Improvement Monitoring The organization shall monitor improvement initiatives to the information securi...	GOV-006 Security Program Continuous Im...	CISO, Security Program Manager, Project Managers	View ↗
GOV-006-R008	Improvement Measurement The organization shall measure the effectiveness of implemented improvements to...	GOV-006 Security Program Continuous Im...	CISO, Security Program Manager, Performance Management	View ↗
GOV-006-R009	Lessons Learned Integration The organization shall capture and integrate lessons learned from incidents, aud...	GOV-006 Security Program Continuous Im...	CISO, Security Program Manager, Incident Response, Audit	View ↗
GOV-006-R010	Improvement Reporting The organization shall report on improvement initiatives to the information secu...	GOV-006 Security Program Continuous Im...	CISO, Security Program Manager, Governance Committee	View ↗
GOV-006-R011	Improvement Review The organization shall conduct periodic reviews of the continuous improvement pr...	GOV-006 Security Program Continuous Im...	CISO, Security Program Manager, Quality Management	View ↗
GOV-006-R012	Improvement Effectiveness The organization shall evaluate the overall effectiveness of the continuous impr...	GOV-006 Security Program Continuous Im...	CISO, Security Program Manager, Internal Audit	View ↗
GOV-007-R001	Integration Framework The organization shall establish a framework for integrating information securit...	GOV-007 Security Integration into Busi...	CISO, Security Architects, IT Leadership, Project Management	View ↗
GOV-007-R002	Business Initiative Integration The organization shall ensure information security governance requirements are i...	GOV-007 Security Integration into Busi...	CISO, Business Leaders, Security Architects, Project Management	View ↗
GOV-007-R003	Technology Initiative Integration The organization shall ensure information security governance requirements are i...	GOV-007 Security Integration into Busi...	CISO, IT Leadership, Security Architects, Project Management	View ↗
GOV-007-R004	Security Participation The organization shall ensure the information security function participates in...	GOV-007 Security Integration into Busi...	CISO, Security Architects, IT Leadership, Project Management	View ↗
GOV-007-R005	Planning Integration The organization shall ensure information security governance requirements are a...	GOV-007 Security Integration into Busi...	CISO, Security Architects, IT Leadership, Project Management	View ↗
GOV-007-R006	Governance Review The organization shall conduct governance reviews of business and technology ini...	GOV-007 Security Integration into Busi...	CISO, Security Architects, Governance Committee	View ↗
GOV-007-R007	Security Acceptance Criteria The organization shall define and apply security acceptance criteria for busines...	GOV-007 Security Integration into Busi...	CISO, Security Architects, IT Leadership, Quality Assurance	View ↗
GOV-007-R008	Integration Monitoring The organization shall monitor the integration of information security governanc...	GOV-007 Security Integration into Busi...	CISO, Security Architects, Project Management	View ↗
GOV-007-R009	Executive Escalation The organization shall establish escalation processes for addressing situations...	GOV-007 Security Integration into Busi...	CISO, Security Architects, Governance Committee	View ↗
GOV-007-R010	Integration Reporting The organization shall report on the integration of information security governa...	GOV-007 Security Integration into Busi...	CISO, Security Architects, Governance Committee	View ↗
GOV-007-R011	Integration Review The organization shall conduct periodic reviews of the security integration proc...	GOV-007 Security Integration into Busi...	CISO, Security Architects, IT Leadership	View ↗
GOV-007-R012	Integration Continuous Improvement The organization shall drive ongoing enhancement of the security integration int...	GOV-007 Security Integration into Busi...	CISO, Security Architects, IT Leadership	View ↗
GOV-008-R001	Control Library Framework The organization shall establish a framework for the enterprise control library...	GOV-008 Enterprise Control Library Man...	CISO, Control Owners, Compliance, Security Architects	View ↗
GOV-008-R002	Control Definition Standards The organization shall establish definition standards for controls in the enterp...	GOV-008 Enterprise Control Library Man...	CISO, Control Owners, Compliance, Security Architects	View ↗
GOV-008-R003	Control Classification The organization shall establish classification schemas for controls in the ente...	GOV-008 Enterprise Control Library Man...	CISO, Control Owners, Compliance, Security Architects	View ↗
GOV-008-R004	Control Ownership The organization shall assign explicit ownership for each control in the enterpr...	GOV-008 Enterprise Control Library Man...	CISO, Control Owners, Compliance	View ↗
GOV-008-R005	Control Change Management The organization shall maintain change governance processes for controls in the...	GOV-008 Enterprise Control Library Man...	CISO, Control Owners, Compliance, Governance Committee	View ↗
GOV-008-R006	Control Lifecycle Management The organization shall maintain lifecycle management processes for controls in t...	GOV-008 Enterprise Control Library Man...	CISO, Control Owners, Compliance	View ↗
GOV-008-R007	Control Relationships The organization shall maintain relationship mapping between controls in the ent...	GOV-008 Enterprise Control Library Man...	CISO, Control Owners, Compliance	View ↗
GOV-008-R008	Control Reuse The organization shall promote the reuse of controls in the enterprise control l...	GOV-008 Enterprise Control Library Man...	CISO, Control Owners, Compliance	View ↗
GOV-008-R009	Control Quality Management The organization shall maintain quality management processes for controls in the...	GOV-008 Enterprise Control Library Man...	CISO, Control Owners, Compliance, Quality Assurance	View ↗
GOV-008-R010	Control Library Review The organization shall conduct periodic reviews of the enterprise control librar...	GOV-008 Enterprise Control Library Man...	CISO, Control Owners, Compliance, Internal Audit	View ↗
GOV-008-R011	Control Library Reporting The organization shall report on the enterprise control library, providing visib...	GOV-008 Enterprise Control Library Man...	CISO, Control Owners, Compliance, Governance Committee	View ↗
GOV-008-R012	Control Library Continuous Improvement The organization shall drive ongoing enhancement of the enterprise control libra...	GOV-008 Enterprise Control Library Man...	CISO, Control Owners, Compliance	View ↗
DAT-001-R001	Data Protection & Privacy Framework The organization shall establish a data protection and privacy strategy framewor...	DAT-001 Data Protection & Privacy Stra...	Data Protection Officer, CISO, Privacy Governance Committee	View ↗
DAT-001-R002	Strategic Objectives The organization shall define strategic objectives for the data protection and p...	DAT-001 Data Protection & Privacy Stra...	Data Protection Officer, CISO, Privacy Governance Committee	View ↗
DAT-001-R003	Privacy Governance The organization shall establish privacy governance structures that provide over...	DAT-001 Data Protection & Privacy Stra...	Data Protection Officer, CISO, Privacy Governance Committee	View ↗
DAT-001-R004	Data Protection Roles & Responsibilities The organization shall clearly define and document the roles and responsibilitie...	DAT-001 Data Protection & Privacy Stra...	Data Protection Officer, CISO, Privacy Governance Committee	View ↗
DAT-001-R005	Strategy Implementation The organization shall execute the data protection and privacy strategy in accor...	DAT-001 Data Protection & Privacy Stra...	Data Protection Officer, CISO, Privacy Governance Committee	View ↗
DAT-001-R006	Privacy Risk Alignment The organization shall align data protection and privacy activities with the org...	DAT-001 Data Protection & Privacy Stra...	Data Protection Officer, CISO, Privacy Governance Committee	View ↗
DAT-001-R007	Strategy Communication The organization shall communicate the data protection and privacy strategy to a...	DAT-001 Data Protection & Privacy Stra...	Data Protection Officer, CISO, Privacy Governance Committee	View ↗
DAT-001-R008	Strategy Performance Monitoring The organization shall monitor the performance of the data protection and privac...	DAT-001 Data Protection & Privacy Stra...	Data Protection Officer, CISO, Privacy Governance Committee	View ↗
DAT-001-R009	Strategy Review The organization shall conduct periodic reviews of the data protection and priva...	DAT-001 Data Protection & Privacy Stra...	Data Protection Officer, CISO, Privacy Governance Committee	View ↗
DAT-001-R010	Strategy Continuous Improvement The organization shall drive ongoing enhancement of the data protection and priv...	DAT-001 Data Protection & Privacy Stra...	Data Protection Officer, CISO, Privacy Governance Committee	View ↗
DAT-002-R001	Data Discovery Framework The organization shall establish a data discovery framework that defines the str...	DAT-002 Data Discovery	Data Protection Officer, Data Governance Team, Data Owners	View ↗
DAT-002-R002	Discovery Scope The organization shall define a documented scope for data discovery activities t...	DAT-002 Data Discovery	Data Protection Officer, Data Governance Team, Data Owners	View ↗
DAT-002-R003	Data Discovery Configuration The organization shall configure data discovery tools and processes to appropria...	DAT-002 Data Discovery	Data Protection Officer, Data Governance Team, Data Owners	View ↗
DAT-002-R004	Data Discovery Execution The organization shall execute data discovery activities to identify and locate...	DAT-002 Data Discovery	Data Protection Officer, Data Governance Team, Data Owners	View ↗
DAT-002-R005	Sensitive Data Identification The organization shall use data discovery to identify specific instances of pers...	DAT-002 Data Discovery	Data Protection Officer, Data Governance Team, Data Owners	View ↗
DAT-002-R006	Discovery Validation The organization shall validate data discovery results to ensure their accuracy...	DAT-002 Data Discovery	Data Protection Officer, Data Governance Team, Data Owners	View ↗
DAT-002-R007	Discovery Monitoring The organization shall monitor data discovery activities to ensure discovery is...	DAT-002 Data Discovery	Data Protection Officer, Data Governance Team, Data Owners	View ↗
DAT-002-R008	Discovery Reporting The organization shall report on data discovery, providing visibility into disco...	DAT-002 Data Discovery	Data Protection Officer, Data Governance Team, Data Owners	View ↗
DAT-002-R009	Discovery Review The organization shall conduct periodic reviews of data discovery activities to...	DAT-002 Data Discovery	Data Protection Officer, Data Governance Team, Data Owners	View ↗
DAT-002-R010	Discovery Continuous Improvement The organization shall drive ongoing enhancement of data discovery through a con...	DAT-002 Data Discovery	Data Protection Officer, Data Governance Team, Data Owners	View ↗
DAT-003-R001	Data Classification Framework The organization shall establish a data classification framework that defines th...	DAT-003 Data Classification & Handling	Data Owners, Data Stewards, Data Protection Officer	View ↗
DAT-003-R002	Classification Criteria The organization shall define classification criteria that establish the basis f...	DAT-003 Data Classification & Handling	Data Owners, Data Stewards, Data Protection Officer	View ↗
DAT-003-R003	Data Classification Assignment The organization shall assign classification levels to data based on classificat...	DAT-003 Data Classification & Handling	Data Owners, Data Stewards, Data Protection Officer	View ↗
DAT-003-R004	Data Labeling The organization shall label data with its assigned classification, ensuring cla...	DAT-003 Data Classification & Handling	Data Owners, Data Stewards, Data Protection Officer	View ↗
DAT-003-R005	Data Handling Requirements The organization shall define data handling requirements for each data classific...	DAT-003 Data Classification & Handling	Data Owners, Data Stewards, Data Protection Officer	View ↗
DAT-003-R006	Classification Review The organization shall conduct periodic reviews of data classifications to ensur...	DAT-003 Data Classification & Handling	Data Owners, Data Stewards, Data Protection Officer	View ↗
DAT-003-R007	Classification Change Management The organization shall manage changes to data classifications, ensuring changes...	DAT-003 Data Classification & Handling	Data Owners, Data Stewards, Data Protection Officer	View ↗
DAT-003-R008	Classification Monitoring The organization shall monitor data classification to ensure data continues to b...	DAT-003 Data Classification & Handling	Data Owners, Data Stewards, Data Protection Officer	View ↗
DAT-003-R009	Classification Reporting The organization shall report on data classification, providing visibility into...	DAT-003 Data Classification & Handling	Data Owners, Data Stewards, Data Protection Officer	View ↗
DAT-003-R010	Classification Continuous Improvement The organization shall drive ongoing enhancement of data classification through...	DAT-003 Data Classification & Handling	Data Owners, Data Stewards, Data Protection Officer	View ↗
DAT-004-R001	Data Retention Framework The organization shall establish a data retention framework that defines the str...	DAT-004 Data Retention & Disposal	Data Protection Officer, Records Management, Legal, Data Owners	View ↗
DAT-004-R002	Retention Schedule Management The organization shall maintain retention schedules that define how long differe...	DAT-004 Data Retention & Disposal	Data Protection Officer, Records Management, Legal, Data Owners	View ↗
DAT-004-R003	Data Archival The organization shall archive data that is no longer actively used but must be...	DAT-004 Data Retention & Disposal	Data Protection Officer, Records Management, Legal, Data Owners	View ↗
DAT-004-R004	Data Disposal Authorization The organization shall authorize the disposal of data, ensuring disposal decisio...	DAT-004 Data Retention & Disposal	Data Protection Officer, Records Management, Legal, Data Owners	View ↗
DAT-004-R005	Secure Data Destruction The organization shall securely destroy data that has reached the end of its ret...	DAT-004 Data Retention & Disposal	Data Protection Officer, Records Management, Legal, Data Owners	View ↗
DAT-004-R006	Disposal Verification The organization shall verify that data disposal activities have been completed...	DAT-004 Data Retention & Disposal	Data Protection Officer, Records Management, Legal, Data Owners	View ↗
DAT-004-R007	Retention Compliance Monitoring The organization shall monitor retention and disposal activities to ensure compl...	DAT-004 Data Retention & Disposal	Data Protection Officer, Records Management, Legal, Data Owners	View ↗
DAT-004-R008	Retention Reporting The organization shall report on retention and disposal activities, providing vi...	DAT-004 Data Retention & Disposal	Data Protection Officer, Records Management, Legal, Data Owners	View ↗
DAT-004-R009	Retention Review The organization shall conduct periodic reviews of retention and disposal activi...	DAT-004 Data Retention & Disposal	Data Protection Officer, Records Management, Legal, Data Owners	View ↗
DAT-004-R010	Retention Continuous Improvement The organization shall drive ongoing enhancement of retention and disposal manag...	DAT-004 Data Retention & Disposal	Data Protection Officer, Records Management, Legal, Data Owners	View ↗
DAT-005-R001	Data Ownership Framework The organization shall establish a data ownership framework that defines the str...	DAT-005 Data Ownership & Stewardship	Data Owners, Data Stewards, Data Governance Committee	View ↗
DAT-005-R002	Data Owner Assignment The organization shall assign explicit data owners to all personal and sensitive...	DAT-005 Data Ownership & Stewardship	Data Owners, Data Stewards, Data Governance Committee	View ↗
DAT-005-R003	Data Steward Responsibilities The organization shall define and assign data stewards to support data owners in...	DAT-005 Data Ownership & Stewardship	Data Owners, Data Stewards, Data Governance Committee	View ↗
DAT-005-R004	Ownership Accountability The organization shall establish accountability for data ownership, ensuring dat...	DAT-005 Data Ownership & Stewardship	Data Owners, Data Stewards, Data Governance Committee	View ↗
DAT-005-R005	Ownership Transfer The organization shall transfer data ownership when organizational changes occur...	DAT-005 Data Ownership & Stewardship	Data Owners, Data Stewards, Data Governance Committee	View ↗
DAT-005-R006	Ownership Validation The organization shall validate data ownership to ensure ownership assignments r...	DAT-005 Data Ownership & Stewardship	Data Owners, Data Stewards, Data Governance Committee	View ↗
DAT-005-R007	Ownership Documentation The organization shall maintain comprehensive documentation of data ownership as...	DAT-005 Data Ownership & Stewardship	Data Owners, Data Stewards, Data Governance Committee	View ↗
DAT-005-R008	Ownership Reporting The organization shall report on data ownership, providing visibility into owner...	DAT-005 Data Ownership & Stewardship	Data Owners, Data Stewards, Data Governance Committee	View ↗
DAT-005-R009	Ownership Review The organization shall conduct periodic reviews of data ownership assignments to...	DAT-005 Data Ownership & Stewardship	Data Owners, Data Stewards, Data Governance Committee	View ↗
DAT-005-R010	Ownership Continuous Improvement The organization shall drive ongoing enhancement of data ownership and stewardsh...	DAT-005 Data Ownership & Stewardship	Data Owners, Data Stewards, Data Governance Committee	View ↗
DAT-006-R001	Data Inventory Framework The organization shall establish a data inventory framework that defines the str...	DAT-006 Data Flow Mapping, Inventory &...	Data Owners, Data Stewards, Data Governance Team	View ↗
DAT-006-R002	Data Flow Identification The organization shall identify data flows that describe how personal and sensit...	DAT-006 Data Flow Mapping, Inventory &...	Data Owners, Data Stewards, Data Governance Team	View ↗
DAT-006-R003	Data Inventory Management The organization shall maintain a comprehensive inventory of data assets, includ...	DAT-006 Data Flow Mapping, Inventory &...	Data Owners, Data Stewards, Data Governance Team	View ↗
DAT-006-R004	Data Flow Mapping The organization shall create and maintain data flow maps that document the move...	DAT-006 Data Flow Mapping, Inventory &...	Data Owners, Data Stewards, Data Governance Team	View ↗
DAT-006-R005	Data Lineage Documentation The organization shall document data lineage for personal and sensitive data, tr...	DAT-006 Data Flow Mapping, Inventory &...	Data Owners, Data Stewards, Data Governance Team	View ↗
DAT-006-R006	Data Flow Validation The organization shall validate data flow maps and data inventory to ensure thei...	DAT-006 Data Flow Mapping, Inventory &...	Data Owners, Data Stewards, Data Governance Team	View ↗
DAT-006-R007	Data Flow Monitoring The organization shall monitor data flows to ensure data movements are documente...	DAT-006 Data Flow Mapping, Inventory &...	Data Owners, Data Stewards, Data Governance Team	View ↗
DAT-006-R008	Data Flow Reporting The organization shall report on data flow mapping and inventory, providing visi...	DAT-006 Data Flow Mapping, Inventory &...	Data Owners, Data Stewards, Data Governance Team	View ↗
DAT-006-R009	Data Flow Review The organization shall conduct periodic reviews of data flow mapping and invento...	DAT-006 Data Flow Mapping, Inventory &...	Data Owners, Data Stewards, Data Governance Team	View ↗
DAT-006-R010	Data Flow Continuous Improvement The organization shall drive ongoing enhancement of data flow mapping, inventory...	DAT-006 Data Flow Mapping, Inventory &...	Data Owners, Data Stewards, Data Governance Team	View ↗
DAT-007-R001	Rights Management Framework The organization shall establish a data subject rights management framework that...	DAT-007 Data Subject Rights Management	Data Protection Officer, Privacy Operations, Legal	View ↗
DAT-007-R002	Request Intake The organization shall receive data subject rights requests through accessible c...	DAT-007 Data Subject Rights Management	Data Protection Officer, Privacy Operations, Legal	View ↗
DAT-007-R003	Identity Verification The organization shall verify the identity of data subjects making rights reques...	DAT-007 Data Subject Rights Management	Data Protection Officer, Privacy Operations, Legal	View ↗
DAT-007-R004	Rights Request Processing The organization shall process data subject rights requests, including requests...	DAT-007 Data Subject Rights Management	Data Protection Officer, Privacy Operations, Legal	View ↗
DAT-007-R005	Response Management The organization shall respond to data subject rights requests, ensuring respons...	DAT-007 Data Subject Rights Management	Data Protection Officer, Privacy Operations, Legal	View ↗
DAT-007-R006	Request Tracking The organization shall track data subject rights requests from receipt through c...	DAT-007 Data Subject Rights Management	Data Protection Officer, Privacy Operations, Legal	View ↗
DAT-007-R007	Regulatory Compliance Monitoring The organization shall monitor data subject rights management to ensure complian...	DAT-007 Data Subject Rights Management	Data Protection Officer, Privacy Operations, Legal	View ↗
DAT-007-R008	Rights Reporting The organization shall report on data subject rights management, providing visib...	DAT-007 Data Subject Rights Management	Data Protection Officer, Privacy Operations, Legal	View ↗
DAT-007-R009	Rights Review The organization shall conduct periodic reviews of data subject rights managemen...	DAT-007 Data Subject Rights Management	Data Protection Officer, Privacy Operations, Legal	View ↗
DAT-007-R010	Rights Continuous Improvement The organization shall drive ongoing enhancement of data subject rights manageme...	DAT-007 Data Subject Rights Management	Data Protection Officer, Privacy Operations, Legal	View ↗
DAT-008-R001	Consent Management Framework The organization shall establish a consent management framework that defines the...	DAT-008 Consent Management	Data Protection Officer, Privacy Operations, Legal, Product Owners	View ↗
DAT-008-R002	Consent Collection The organization shall collect consent from data subjects in a manner that is in...	DAT-008 Consent Management	Data Protection Officer, Privacy Operations, Legal, Product Owners	View ↗
DAT-008-R003	Consent Recording The organization shall record consent decisions, ensuring consent records are ac...	DAT-008 Consent Management	Data Protection Officer, Privacy Operations, Legal, Product Owners	View ↗
DAT-008-R004	Consent Validation The organization shall validate the validity of consent, ensuring consent remain...	DAT-008 Consent Management	Data Protection Officer, Privacy Operations, Legal, Product Owners	View ↗
DAT-008-R005	Consent Withdrawal The organization shall process consent withdrawals, ensuring data subjects can e...	DAT-008 Consent Management	Data Protection Officer, Privacy Operations, Legal, Product Owners	View ↗
DAT-008-R006	Consent Lifecycle Management The organization shall manage the lifecycle of consent, from collection through...	DAT-008 Consent Management	Data Protection Officer, Privacy Operations, Legal, Product Owners	View ↗
DAT-008-R007	Consent Monitoring The organization shall monitor consent management to ensure consent is properly...	DAT-008 Consent Management	Data Protection Officer, Privacy Operations, Legal, Product Owners	View ↗
DAT-008-R008	Consent Reporting The organization shall report on consent management, providing visibility into c...	DAT-008 Consent Management	Data Protection Officer, Privacy Operations, Legal, Product Owners	View ↗
DAT-008-R009	Consent Review The organization shall conduct periodic reviews of consent management activities...	DAT-008 Consent Management	Data Protection Officer, Privacy Operations, Legal, Product Owners	View ↗
DAT-008-R010	Consent Continuous Improvement The organization shall drive ongoing enhancement of consent management through a...	DAT-008 Consent Management	Data Protection Officer, Privacy Operations, Legal, Product Owners	View ↗
DAT-009-R001	Cross-Border Transfer Framework The organization shall establish a cross-border data transfer framework that def...	DAT-009 Cross-Border Data Transfer	Data Protection Officer, Legal, Privacy Operations	View ↗
DAT-009-R002	Transfer Assessment The organization shall assess cross-border data transfers to evaluate compliance...	DAT-009 Cross-Border Data Transfer	Data Protection Officer, Legal, Privacy Operations	View ↗
DAT-009-R003	Transfer Authorization The organization shall authorize cross-border data transfers, ensuring transfers...	DAT-009 Cross-Border Data Transfer	Data Protection Officer, Legal, Privacy Operations	View ↗
DAT-009-R004	Transfer Safeguards The organization shall implement appropriate safeguards for cross-border data tr...	DAT-009 Cross-Border Data Transfer	Data Protection Officer, Legal, Privacy Operations	View ↗
DAT-009-R005	Transfer Documentation The organization shall maintain comprehensive documentation of cross-border data...	DAT-009 Cross-Border Data Transfer	Data Protection Officer, Legal, Privacy Operations	View ↗
DAT-009-R006	Transfer Monitoring The organization shall monitor cross-border data transfers to ensure transfers r...	DAT-009 Cross-Border Data Transfer	Data Protection Officer, Legal, Privacy Operations	View ↗
DAT-009-R007	Regulatory Compliance Verification The organization shall verify that cross-border data transfers comply with appli...	DAT-009 Cross-Border Data Transfer	Data Protection Officer, Legal, Privacy Operations	View ↗
DAT-009-R008	Transfer Reporting The organization shall report on cross-border data transfers, providing visibili...	DAT-009 Cross-Border Data Transfer	Data Protection Officer, Legal, Privacy Operations	View ↗
DAT-009-R009	Transfer Review The organization shall conduct periodic reviews of cross-border data transfer ma...	DAT-009 Cross-Border Data Transfer	Data Protection Officer, Legal, Privacy Operations	View ↗
DAT-009-R010	Transfer Continuous Improvement The organization shall drive ongoing enhancement of cross-border data transfer m...	DAT-009 Cross-Border Data Transfer	Data Protection Officer, Legal, Privacy Operations	View ↗
DAT-010-R001	Privacy Notice Framework The organization shall establish a privacy notice framework that defines the str...	DAT-010 Privacy Notices	Data Protection Officer, Legal, Communications, Product Owners	View ↗
DAT-010-R002	Notice Content Management The organization shall develop and maintain privacy notice content that accurate...	DAT-010 Privacy Notices	Data Protection Officer, Legal, Communications, Product Owners	View ↗
DAT-010-R003	Notice Publication The organization shall publish privacy notices in locations and formats that are...	DAT-010 Privacy Notices	Data Protection Officer, Legal, Communications, Product Owners	View ↗
DAT-010-R004	Notice Accessibility The organization shall ensure privacy notices are accessible to all data subject...	DAT-010 Privacy Notices	Data Protection Officer, Legal, Communications, Product Owners	View ↗
DAT-010-R005	Notice Updates The organization shall update privacy notices when changes occur in data process...	DAT-010 Privacy Notices	Data Protection Officer, Legal, Communications, Product Owners	View ↗
DAT-010-R006	Notice Communication The organization shall communicate privacy notices to data subjects through appr...	DAT-010 Privacy Notices	Data Protection Officer, Legal, Communications, Product Owners	View ↗
DAT-010-R007	Notice Compliance Monitoring The organization shall monitor privacy notice management to ensure notices remai...	DAT-010 Privacy Notices	Data Protection Officer, Legal, Communications, Product Owners	View ↗
DAT-010-R008	Notice Reporting The organization shall report on privacy notice management, providing visibility...	DAT-010 Privacy Notices	Data Protection Officer, Legal, Communications, Product Owners	View ↗
DAT-010-R009	Notice Review The organization shall conduct periodic reviews of privacy notices to ensure the...	DAT-010 Privacy Notices	Data Protection Officer, Legal, Communications, Product Owners	View ↗
DAT-010-R010	Notice Continuous Improvement The organization shall drive ongoing enhancement of privacy notice management th...	DAT-010 Privacy Notices	Data Protection Officer, Legal, Communications, Product Owners	View ↗
DAT-011-R001	Privacy by Design Framework The organization shall establish a privacy by design framework that defines the...	DAT-011 Privacy by Design	Data Protection Officer, Privacy Engineering, Application Owners	View ↗
DAT-011-R002	Privacy Requirements Identification The organization shall identify privacy requirements that must be addressed in t...	DAT-011 Privacy by Design	Data Protection Officer, Privacy Engineering, Application Owners	View ↗
DAT-011-R003	Privacy Design Assessment The organization shall conduct privacy design assessments to evaluate whether sy...	DAT-011 Privacy by Design	Data Protection Officer, Privacy Engineering, Application Owners	View ↗
DAT-011-R004	Privacy Control Integration The organization shall integrate privacy controls into systems, products, and se...	DAT-011 Privacy by Design	Data Protection Officer, Privacy Engineering, Application Owners	View ↗
DAT-011-R005	Privacy Validation The organization shall validate that systems, products, and services meet privac...	DAT-011 Privacy by Design	Data Protection Officer, Privacy Engineering, Application Owners	View ↗
DAT-011-R006	Design Change Management The organization shall manage changes to privacy design requirements and control...	DAT-011 Privacy by Design	Data Protection Officer, Privacy Engineering, Application Owners	View ↗
DAT-011-R007	Privacy Compliance Monitoring The organization shall monitor privacy by design activities to ensure privacy re...	DAT-011 Privacy by Design	Data Protection Officer, Privacy Engineering, Application Owners	View ↗
DAT-011-R008	Design Reporting The organization shall report on privacy by design, providing visibility into pr...	DAT-011 Privacy by Design	Data Protection Officer, Privacy Engineering, Application Owners	View ↗
DAT-011-R009	Design Review The organization shall conduct periodic reviews of privacy by design activities...	DAT-011 Privacy by Design	Data Protection Officer, Privacy Engineering, Application Owners	View ↗
DAT-011-R010	Design Continuous Improvement The organization shall drive ongoing enhancement of privacy by design through a...	DAT-011 Privacy by Design	Data Protection Officer, Privacy Engineering, Application Owners	View ↗
DAT-012-R001	DPIA Framework The organization shall establish a Data Protection Impact Assessment framework t...	DAT-012 Data Protection Impact Assessm...	Data Protection Officer, Privacy Risk, Legal, Business Owners	View ↗
DAT-012-R002	DPIA Scoping The organization shall scope DPIAs, identifying the processing activities, syste...	DAT-012 Data Protection Impact Assessm...	Data Protection Officer, Privacy Risk, Legal, Business Owners	View ↗
DAT-012-R003	Privacy Risk Assessment The organization shall conduct privacy risk assessments as part of DPIAs, identi...	DAT-012 Data Protection Impact Assessm...	Data Protection Officer, Privacy Risk, Legal, Business Owners	View ↗
DAT-012-R004	Risk Treatment Planning The organization shall develop risk treatment plans as part of DPIAs, defining m...	DAT-012 Data Protection Impact Assessm...	Data Protection Officer, Privacy Risk, Legal, Business Owners	View ↗
DAT-012-R005	DPIA Approval The organization shall approve DPIAs and associated risk treatment plans, ensuri...	DAT-012 Data Protection Impact Assessm...	Data Protection Officer, Privacy Risk, Legal, Business Owners	View ↗
DAT-012-R006	DPIA Documentation The organization shall maintain comprehensive documentation of DPIAs, including...	DAT-012 Data Protection Impact Assessm...	Data Protection Officer, Privacy Risk, Legal, Business Owners	View ↗
DAT-012-R007	DPIA Monitoring The organization shall monitor DPIAs to ensure treatment plans are implemented a...	DAT-012 Data Protection Impact Assessm...	Data Protection Officer, Privacy Risk, Legal, Business Owners	View ↗
DAT-012-R008	DPIA Reporting The organization shall report on DPIAs, providing visibility into assessment act...	DAT-012 Data Protection Impact Assessm...	Data Protection Officer, Privacy Risk, Legal, Business Owners	View ↗
DAT-012-R009	DPIA Review The organization shall conduct periodic reviews of DPIA activities to ensure the...	DAT-012 Data Protection Impact Assessm...	Data Protection Officer, Privacy Risk, Legal, Business Owners	View ↗
DAT-012-R010	DPIA Continuous Improvement The organization shall drive ongoing enhancement of DPIA management through a co...	DAT-012 Data Protection Impact Assessm...	Data Protection Officer, Privacy Risk, Legal, Business Owners	View ↗
DAT-013-R001	ROPA Framework The organization shall establish a Record of Processing Activities framework tha...	DAT-013 Record of Processing Activitie...	Data Protection Officer, Data Owners, Privacy Operations	View ↗
DAT-013-R002	Processing Activity Identification The organization shall identify all processing activities that involve personal...	DAT-013 Record of Processing Activitie...	Data Protection Officer, Data Owners, Privacy Operations	View ↗
DAT-013-R003	Processing Record Maintenance The organization shall maintain comprehensive records of processing activities,...	DAT-013 Record of Processing Activitie...	Data Protection Officer, Data Owners, Privacy Operations	View ↗
DAT-013-R004	Processing Activity Classification The organization shall establish classification schemas for processing activitie...	DAT-013 Record of Processing Activitie...	Data Protection Officer, Data Owners, Privacy Operations	View ↗
DAT-013-R005	Processing Record Validation The organization shall validate ROPA records to ensure their accuracy, completen...	DAT-013 Record of Processing Activitie...	Data Protection Officer, Data Owners, Privacy Operations	View ↗
DAT-013-R006	ROPA Maintenance The organization shall maintain ROPA records to ensure they remain current and r...	DAT-013 Record of Processing Activitie...	Data Protection Officer, Data Owners, Privacy Operations	View ↗
DAT-013-R007	ROPA Monitoring The organization shall monitor ROPA management to ensure records remain accurate...	DAT-013 Record of Processing Activitie...	Data Protection Officer, Data Owners, Privacy Operations	View ↗
DAT-013-R008	ROPA Reporting The organization shall report on ROPA, providing visibility into processing acti...	DAT-013 Record of Processing Activitie...	Data Protection Officer, Data Owners, Privacy Operations	View ↗
DAT-013-R009	ROPA Review The organization shall conduct periodic reviews of ROPA management activities to...	DAT-013 Record of Processing Activitie...	Data Protection Officer, Data Owners, Privacy Operations	View ↗
DAT-013-R010	ROPA Continuous Improvement The organization shall drive ongoing enhancement of ROPA management through a co...	DAT-013 Record of Processing Activitie...	Data Protection Officer, Data Owners, Privacy Operations	View ↗
DAT-014-R001	Data Loss Prevention Framework The organization shall establish a Data Loss Prevention framework that defines t...	DAT-014 Data Loss Prevention (DLP)	CISO, DLP Team, SOC, Data Protection Officer	View ↗
DAT-014-R002	DLP Policy Definition The organization shall define DLP policies that establish the requirements for p...	DAT-014 Data Loss Prevention (DLP)	CISO, DLP Team, SOC, Data Protection Officer	View ↗
DAT-014-R003	Sensitive Data Monitoring The organization shall monitor sensitive data to detect potential data leakage,...	DAT-014 Data Loss Prevention (DLP)	CISO, DLP Team, SOC, Data Protection Officer	View ↗
DAT-014-R004	Data Loss Prevention Controls The organization shall implement controls to prevent unauthorized disclosure and...	DAT-014 Data Loss Prevention (DLP)	CISO, DLP Team, SOC, Data Protection Officer	View ↗
DAT-014-R005	DLP Incident Management The organization shall manage DLP incidents, including the response, investigati...	DAT-014 Data Loss Prevention (DLP)	CISO, DLP Team, SOC, Data Protection Officer	View ↗
DAT-014-R006	DLP Exception Management The organization shall manage exceptions to DLP policies, ensuring deviations ar...	DAT-014 Data Loss Prevention (DLP)	CISO, DLP Team, SOC, Data Protection Officer	View ↗
DAT-014-R007	DLP Monitoring The organization shall monitor DLP activities to ensure controls are operating e...	DAT-014 Data Loss Prevention (DLP)	CISO, DLP Team, SOC, Data Protection Officer	View ↗
DAT-014-R008	DLP Reporting The organization shall report on DLP, providing visibility into DLP activities,...	DAT-014 Data Loss Prevention (DLP)	CISO, DLP Team, SOC, Data Protection Officer	View ↗
DAT-014-R009	DLP Review The organization shall conduct periodic reviews of DLP activities to ensure thei...	DAT-014 Data Loss Prevention (DLP)	CISO, DLP Team, SOC, Data Protection Officer	View ↗
DAT-014-R010	DLP Continuous Improvement The organization shall drive ongoing enhancement of DLP management through a con...	DAT-014 Data Loss Prevention (DLP)	CISO, DLP Team, SOC, Data Protection Officer	View ↗
DAT-015-R001	Data Integrity Framework The organization shall establish a data integrity framework that defines the str...	DAT-015 Data Integrity	Data Owners, Data Stewards, IT Operations, CISO	View ↗
DAT-015-R002	Integrity Protection Controls The organization shall implement controls to protect data integrity, preventing...	DAT-015 Data Integrity	Data Owners, Data Stewards, IT Operations, CISO	View ↗
DAT-015-R003	Data Validation The organization shall validate data integrity, ensuring data is accurate, compl...	DAT-015 Data Integrity	Data Owners, Data Stewards, IT Operations, CISO	View ↗
DAT-015-R004	Integrity Monitoring The organization shall monitor data integrity to detect unauthorized modificatio...	DAT-015 Data Integrity	Data Owners, Data Stewards, IT Operations, CISO	View ↗
DAT-015-R005	Integrity Verification The organization shall verify data integrity through periodic assessments and te...	DAT-015 Data Integrity	Data Owners, Data Stewards, IT Operations, CISO	View ↗
DAT-015-R006	Integrity Incident Management The organization shall manage data integrity incidents, including the detection,...	DAT-015 Data Integrity	Data Owners, Data Stewards, IT Operations, CISO	View ↗
DAT-015-R007	Integrity Assessment The organization shall conduct periodic assessments of data integrity to evaluat...	DAT-015 Data Integrity	Data Owners, Data Stewards, IT Operations, CISO	View ↗
DAT-015-R008	Integrity Reporting The organization shall report on data integrity, providing visibility into integ...	DAT-015 Data Integrity	Data Owners, Data Stewards, IT Operations, CISO	View ↗
DAT-015-R009	Integrity Review The organization shall conduct periodic reviews of data integrity management act...	DAT-015 Data Integrity	Data Owners, Data Stewards, IT Operations, CISO	View ↗
DAT-015-R010	Integrity Continuous Improvement The organization shall drive ongoing enhancement of data integrity management th...	DAT-015 Data Integrity	Data Owners, Data Stewards, IT Operations, CISO	View ↗
DAT-016-R001	Data Masking & Anonymization Framework The organization shall establish a data masking and anonymization framework that...	DAT-016 Data Masking & Anonymization	Data Protection Officer, Data Engineering, Application Owners, Security Engineering	View ↗
DAT-016-R002	Sensitive Data Identification The organization shall identify sensitive data that requires masking, anonymizat...	DAT-016 Data Masking & Anonymization	Data Protection Officer, Data Engineering, Application Owners, Security Engineering	View ↗
DAT-016-R003	Masking Requirements The organization shall define masking requirements that specify how sensitive da...	DAT-016 Data Masking & Anonymization	Data Protection Officer, Data Engineering, Application Owners, Security Engineering	View ↗
DAT-016-R004	Anonymization & Pseudonymization The organization shall implement anonymization and pseudonymization techniques t...	DAT-016 Data Masking & Anonymization	Data Protection Officer, Data Engineering, Application Owners, Security Engineering	View ↗
DAT-016-R005	Data Transformation Validation The organization shall validate that data masking, anonymization, and pseudonymi...	DAT-016 Data Masking & Anonymization	Data Protection Officer, Data Engineering, Application Owners, Security Engineering	View ↗
DAT-016-R006	Non-Production Data Protection The organization shall implement data masking and anonymization for non-producti...	DAT-016 Data Masking & Anonymization	Data Protection Officer, Data Engineering, Application Owners, Security Engineering	View ↗
DAT-016-R007	Masking Effectiveness Monitoring The organization shall monitor masking and anonymization activities to ensure da...	DAT-016 Data Masking & Anonymization	Data Protection Officer, Data Engineering, Application Owners, Security Engineering	View ↗
DAT-016-R008	Masking Reporting The organization shall report on masking and anonymization, providing visibility...	DAT-016 Data Masking & Anonymization	Data Protection Officer, Data Engineering, Application Owners, Security Engineering	View ↗
DAT-016-R009	Masking Review The organization shall conduct periodic reviews of data masking and anonymizatio...	DAT-016 Data Masking & Anonymization	Data Protection Officer, Data Engineering, Application Owners, Security Engineering	View ↗
DAT-016-R010	Masking Continuous Improvement The organization shall drive ongoing enhancement of data masking and anonymizati...	DAT-016 Data Masking & Anonymization	Data Protection Officer, Data Engineering, Application Owners, Security Engineering	View ↗
TPR-001-R001	TPRM Governance Framework The organization shall establish a Third-Party Risk Management governance framew...	TPR-001 Third-Party Risk Management Pr...	Third-Party Risk Management, Procurement, Risk Management, CISO	View ↗
TPR-001-R002	Program Scope The organization shall define a documented scope for the TPRM program that ident...	TPR-001 Third-Party Risk Management Pr...	Third-Party Risk Management, Procurement, Risk Management, CISO	View ↗
TPR-001-R003	Third-Party Classification The organization shall establish a classification schema for third-party relatio...	TPR-001 Third-Party Risk Management Pr...	Third-Party Risk Management, Procurement, Risk Management, CISO	View ↗
TPR-001-R004	Roles & Responsibilities The organization shall clearly define and document the roles and responsibilitie...	TPR-001 Third-Party Risk Management Pr...	Third-Party Risk Management, Procurement, Risk Management, CISO	View ↗
TPR-001-R005	Risk Governance The organization shall establish governance processes for third-party risk manag...	TPR-001 Third-Party Risk Management Pr...	Third-Party Risk Management, Procurement, Risk Management, CISO	View ↗
TPR-001-R006	Program Metrics The organization shall define and track key metrics for the TPRM program that pr...	TPR-001 Third-Party Risk Management Pr...	Third-Party Risk Management, Procurement, Risk Management, CISO	View ↗
TPR-001-R007	Executive Reporting The organization shall provide executive leadership and the board with regular r...	TPR-001 Third-Party Risk Management Pr...	Third-Party Risk Management, Procurement, Risk Management, CISO	View ↗
TPR-001-R008	Program Review The organization shall conduct periodic reviews of the TPRM program to assess it...	TPR-001 Third-Party Risk Management Pr...	Third-Party Risk Management, Procurement, Risk Management, CISO	View ↗
TPR-001-R009	Program Compliance The organization shall ensure the TPRM program complies with applicable legal, r...	TPR-001 Third-Party Risk Management Pr...	Third-Party Risk Management, Procurement, Risk Management, CISO	View ↗
TPR-001-R010	Continuous Improvement The organization shall establish a continuous improvement process for the TPRM p...	TPR-001 Third-Party Risk Management Pr...	Third-Party Risk Management, Procurement, Risk Management, CISO	View ↗
TPR-002-R001	Due Diligence Framework The organization shall establish a due diligence framework that defines the stru...	TPR-002 Third-Party Risk Assessment &...	Third-Party Risk Management, Information Security, Privacy, Finance, Compliance	View ↗
TPR-002-R002	Vendor Risk Assessment The organization shall conduct comprehensive risk assessments of third-party ven...	TPR-002 Third-Party Risk Assessment &...	Third-Party Risk Management, Information Security, Privacy, Finance, Compliance	View ↗
TPR-002-R003	Security Assessment The organization shall conduct security assessments of third-party vendors to ev...	TPR-002 Third-Party Risk Assessment &...	Third-Party Risk Management, Information Security, Privacy, Finance, Compliance	View ↗
TPR-002-R004	Privacy Assessment The organization shall conduct privacy assessments of third-party vendors to eva...	TPR-002 Third-Party Risk Assessment &...	Third-Party Risk Management, Information Security, Privacy, Finance, Compliance	View ↗
TPR-002-R005	Financial Assessment The organization shall conduct financial assessments of third-party vendors to e...	TPR-002 Third-Party Risk Assessment &...	Third-Party Risk Management, Information Security, Privacy, Finance, Compliance	View ↗
TPR-002-R006	Risk Scoring The organization shall apply risk scoring methodologies to quantify and prioriti...	TPR-002 Third-Party Risk Assessment &...	Third-Party Risk Management, Information Security, Privacy, Finance, Compliance	View ↗
TPR-002-R007	Risk Acceptance The organization shall accept third-party risks that exceed defined thresholds,...	TPR-002 Third-Party Risk Assessment &...	Third-Party Risk Management, Information Security, Privacy, Finance, Compliance	View ↗
TPR-002-R008	Assessment Reporting The organization shall report on third-party risk assessments, providing visibil...	TPR-002 Third-Party Risk Assessment &...	Third-Party Risk Management, Information Security, Privacy, Finance, Compliance	View ↗
TPR-002-R009	Assessment Review The organization shall conduct periodic reviews of third-party risk assessment a...	TPR-002 Third-Party Risk Assessment &...	Third-Party Risk Management, Information Security, Privacy, Finance, Compliance	View ↗
TPR-002-R010	Continuous Improvement The organization shall establish a continuous improvement process for third-part...	TPR-002 Third-Party Risk Assessment &...	Third-Party Risk Management, Information Security, Privacy, Finance, Compliance	View ↗
TPR-003-R001	Contract Requirements The organization shall establish contract requirements for third-party relations...	TPR-003 Third-Party Contract & Complia...	Procurement, Legal, Third-Party Risk Management, Compliance, Information Security	View ↗
TPR-003-R002	Security Clauses The organization shall include security clauses in third-party contracts that de...	TPR-003 Third-Party Contract & Complia...	Procurement, Legal, Third-Party Risk Management, Compliance, Information Security	View ↗
TPR-003-R003	Privacy Clauses The organization shall include privacy clauses in third-party contracts that def...	TPR-003 Third-Party Contract & Complia...	Procurement, Legal, Third-Party Risk Management, Compliance, Information Security	View ↗
TPR-003-R004	Audit Rights The organization shall include audit rights clauses in third-party contracts tha...	TPR-003 Third-Party Contract & Complia...	Procurement, Legal, Third-Party Risk Management, Compliance, Information Security	View ↗
TPR-003-R005	Regulatory Obligations The organization shall include regulatory compliance clauses in third-party cont...	TPR-003 Third-Party Contract & Complia...	Procurement, Legal, Third-Party Risk Management, Compliance, Information Security	View ↗
TPR-003-R006	SLA Management The organization shall establish and manage Service Level Agreements with third-...	TPR-003 Third-Party Contract & Complia...	Procurement, Legal, Third-Party Risk Management, Compliance, Information Security	View ↗
TPR-003-R007	Compliance Verification The organization shall verify third-party compliance with contractual obligation...	TPR-003 Third-Party Contract & Complia...	Procurement, Legal, Third-Party Risk Management, Compliance, Information Security	View ↗
TPR-003-R008	Contract Review The organization shall conduct periodic reviews of third-party contracts to ensu...	TPR-003 Third-Party Contract & Complia...	Procurement, Legal, Third-Party Risk Management, Compliance, Information Security	View ↗
TPR-003-R009	Contract Maintenance The organization shall maintain third-party contracts, including amendments, ren...	TPR-003 Third-Party Contract & Complia...	Procurement, Legal, Third-Party Risk Management, Compliance, Information Security	View ↗
TPR-003-R010	Continuous Improvement The organization shall establish a continuous improvement process for contract a...	TPR-003 Third-Party Contract & Complia...	Procurement, Legal, Third-Party Risk Management, Compliance, Information Security	View ↗
TPR-004-R001	Monitoring Framework The organization shall establish a third-party continuous monitoring framework t...	TPR-004 Third-Party Continuous Monitor...	Third-Party Risk Management, Security Operations, Procurement, Service Management	View ↗
TPR-004-R002	Continuous Risk Monitoring The organization shall continuously monitor third-party risks, including securit...	TPR-004 Third-Party Continuous Monitor...	Third-Party Risk Management, Security Operations, Procurement, Service Management	View ↗
TPR-004-R003	Security Performance Monitoring The organization shall monitor third-party security performance, including secur...	TPR-004 Third-Party Continuous Monitor...	Third-Party Risk Management, Security Operations, Procurement, Service Management	View ↗
TPR-004-R004	Incident Coordination The organization shall coordinate security incidents involving third-party vendo...	TPR-004 Third-Party Continuous Monitor...	Third-Party Risk Management, Security Operations, Procurement, Service Management	View ↗
TPR-004-R005	Fourth-Party Oversight The organization shall oversee fourth-party relationships, including subcontract...	TPR-004 Third-Party Continuous Monitor...	Third-Party Risk Management, Security Operations, Procurement, Service Management	View ↗
TPR-004-R006	Compliance Monitoring The organization shall monitor third-party compliance with legal, regulatory, an...	TPR-004 Third-Party Continuous Monitor...	Third-Party Risk Management, Security Operations, Procurement, Service Management	View ↗
TPR-004-R007	Performance Reporting The organization shall report on third-party performance monitoring, providing v...	TPR-004 Third-Party Continuous Monitor...	Third-Party Risk Management, Security Operations, Procurement, Service Management	View ↗
TPR-004-R008	Assurance Reviews The organization shall conduct periodic assurance reviews of third-party risk ma...	TPR-004 Third-Party Continuous Monitor...	Third-Party Risk Management, Security Operations, Procurement, Service Management	View ↗
TPR-004-R009	Monitoring Review The organization shall conduct periodic reviews of third-party monitoring activi...	TPR-004 Third-Party Continuous Monitor...	Third-Party Risk Management, Security Operations, Procurement, Service Management	View ↗
TPR-004-R010	Continuous Improvement The organization shall establish a continuous improvement process for third-part...	TPR-004 Third-Party Continuous Monitor...	Third-Party Risk Management, Security Operations, Procurement, Service Management	View ↗
TPR-005-R001	Vendor Onboarding The organization shall onboard third-party vendors and service providers, ensuri...	TPR-005 Third-Party Lifecycle & Offboa...	Third-Party Risk Management, Procurement, Legal, IT Operations, Information Security	View ↗
TPR-005-R002	Relationship Management The organization shall manage third-party relationships throughout the lifecycle...	TPR-005 Third-Party Lifecycle & Offboa...	Third-Party Risk Management, Procurement, Legal, IT Operations, Information Security	View ↗
TPR-005-R003	Change Management The organization shall manage changes in third-party relationships, including ch...	TPR-005 Third-Party Lifecycle & Offboa...	Third-Party Risk Management, Procurement, Legal, IT Operations, Information Security	View ↗
TPR-005-R004	Contract Renewal The organization shall manage third-party contract renewals, ensuring contracts...	TPR-005 Third-Party Lifecycle & Offboa...	Third-Party Risk Management, Procurement, Legal, IT Operations, Information Security	View ↗
TPR-005-R005	Vendor Termination The organization shall terminate third-party relationships, ensuring termination...	TPR-005 Third-Party Lifecycle & Offboa...	Third-Party Risk Management, Procurement, Legal, IT Operations, Information Security	View ↗
TPR-005-R006	Data Return The organization shall return organizational data by third parties at the end of...	TPR-005 Third-Party Lifecycle & Offboa...	Third-Party Risk Management, Procurement, Legal, IT Operations, Information Security	View ↗
TPR-005-R007	Data Destruction The organization shall ensure the destruction of organizational data by third pa...	TPR-005 Third-Party Lifecycle & Offboa...	Third-Party Risk Management, Procurement, Legal, IT Operations, Information Security	View ↗
TPR-005-R008	Access Revocation The organization shall revoke third-party access to organizational systems, faci...	TPR-005 Third-Party Lifecycle & Offboa...	Third-Party Risk Management, Procurement, Legal, IT Operations, Information Security	View ↗
TPR-005-R009	Offboarding Verification The organization shall verify that all offboarding activities have been complete...	TPR-005 Third-Party Lifecycle & Offboa...	Third-Party Risk Management, Procurement, Legal, IT Operations, Information Security	View ↗
TPR-005-R010	Continuous Improvement The organization shall establish a continuous improvement process for third-part...	TPR-005 Third-Party Lifecycle & Offboa...	Third-Party Risk Management, Procurement, Legal, IT Operations, Information Security	View ↗
TPR-006-R001	Concentration Risk Framework The organization shall establish a third-party concentration risk framework that...	TPR-006 Third-Party Concentration Risk...	Third-Party Risk Management, Enterprise Risk, Procurement, Operational Resilience	View ↗
TPR-006-R002	Critical Dependency Identification The organization shall identify critical dependencies on third-party vendors, in...	TPR-006 Third-Party Concentration Risk...	Third-Party Risk Management, Enterprise Risk, Procurement, Operational Resilience	View ↗
TPR-006-R003	Concentration Assessment The organization shall conduct concentration assessments to evaluate the level o...	TPR-006 Third-Party Concentration Risk...	Third-Party Risk Management, Enterprise Risk, Procurement, Operational Resilience	View ↗
TPR-006-R004	Geographic Concentration The organization shall assess geographic concentration risks, including the conc...	TPR-006 Third-Party Concentration Risk...	Third-Party Risk Management, Enterprise Risk, Procurement, Operational Resilience	View ↗
TPR-006-R005	Technology Concentration The organization shall assess technology concentration risks, including the conc...	TPR-006 Third-Party Concentration Risk...	Third-Party Risk Management, Enterprise Risk, Procurement, Operational Resilience	View ↗
TPR-006-R006	Mitigation Planning The organization shall develop mitigation plans for identified concentration ris...	TPR-006 Third-Party Concentration Risk...	Third-Party Risk Management, Enterprise Risk, Procurement, Operational Resilience	View ↗
TPR-006-R007	Concentration Monitoring The organization shall monitor concentration risks to ensure risks are tracked a...	TPR-006 Third-Party Concentration Risk...	Third-Party Risk Management, Enterprise Risk, Procurement, Operational Resilience	View ↗
TPR-006-R008	Concentration Reporting The organization shall report on concentration risk, providing visibility into c...	TPR-006 Third-Party Concentration Risk...	Third-Party Risk Management, Enterprise Risk, Procurement, Operational Resilience	View ↗
TPR-006-R009	Periodic Review The organization shall conduct periodic reviews of concentration risk management...	TPR-006 Third-Party Concentration Risk...	Third-Party Risk Management, Enterprise Risk, Procurement, Operational Resilience	View ↗
TPR-006-R010	Continuous Improvement The organization shall establish a continuous improvement process for third-part...	TPR-006 Third-Party Concentration Risk...	Third-Party Risk Management, Enterprise Risk, Procurement, Operational Resilience	View ↗

Digital Personal Data Protection Act:2023