People & workforce

Sectors on this page

• HRTech, Payroll & Workforce
• Recruitment & Staffing

A few of the questions the readiness assessment asks

1. For this processing, do you determine the purpose and means (Data Fiduciary), or do you process on someone else's behalf (Data Processor)?
2. Can you state, for every processing activity, whether it relies on consent or on a legitimate use listed in section 7?
3. Is every vendor that processes personal data on your behalf covered by a current written contract?
4. Do encryption, access control, logging and backups cover every system holding personal data, including your vendors'?
5. Could you produce, for one individual, everything you hold and everyone you shared it with?

From obligation to audit record

1. Statutory obligations become controls with owners, evidence with reviewers, and a record you can put in front of an auditor.
2. The place the compliance work actually happens: a control per obligation, an owner per control, evidence per requirement, and a queue where somebody reviews it.
3. An append-only audit record behind every decision and every piece of evidence

What you record in DPDPNiti

• Hiring, payroll and employee administration registered as their own purposes
• Vendors and sub-processors registered with the contract that governs them
• Rights requests and incidents, each on its own lifecycle, with every transition attributable

Frameworks carried beside the Act

• CERT-In Directions on cyber incident reporting: carried for every organisation

On the roadmap

• Retention schedules and erasure timersComing
• Request owners, deadlines and templatesComing
• Policy attestationComing