Telecom, travel & logistics

Sectors on this page

• Telecom & Internet Service Providers
• Travel, OTA & Mobility
• Airlines & Aviation
• Hotels & Hospitality
• Logistics, Courier & Supply Chain
• Automotive & Mobility

A few of the questions the readiness assessment asks

1. Does any processing rely on the Data Principal's consent rather than only on a legitimate use?
2. Can a Data Principal read your notice in English or in a language of the Eighth Schedule?
3. Could you notify every affected individual, with all five required elements, without delay after discovering a breach?
4. Do you record the moment you become aware of a breach, and can you file the detailed Data Protection Board report within 72 hours of it?
5. Is there a published grievance channel with recorded response times?
6. Has the Central Government notified you, or a class you belong to, as a Significant Data Fiduciary?

From obligation to audit record

1. Statutory obligations become controls with owners, evidence with reviewers, and a record you can put in front of an auditor.
2. The place the compliance work actually happens: a control per obligation, an owner per control, evidence per requirement, and a queue where somebody reviews it.
3. An append-only audit record behind every decision and every piece of evidence

What you record in DPDPNiti

• A rights request register with identity verification as a recorded step
• Data flows recorded against the activity that relies on them, naming the vendor, the transfer method and whether the data crosses a border
• Rights requests and incidents, each on its own lifecycle, with every transition attributable

Frameworks carried beside the Act

• CERT-In Directions on cyber incident reporting: carried for every organisation

On the roadmap

• Public rights request portalComing
• Cross-border transfer registerComing
• Breach deadline clocksComing