Bonus tools

What it’s for

Three tools for the conversations around compliance: getting budget signed off, deciding who holds which DPDPA role when everyone reports to the owner, and lining DPDPA up against the security and privacy frameworks you may already use.

What you fill in

1. 1

   Cost-of-inaction brief

   Not insurance: from 13 May 2027 the Board can impose a penalty only after an inquiry finds a significant breach, and a hearing. A table of every penalty ceiling in the Act, the seven factors the Board weighs, and a first step that starts from your Reality Check.

2. 2

   Roles in a hairball org

   Six steps: who the Data Fiduciary is, what a Data Processor is (not your own team), where an SDF's DPO reports, why a Consent Manager is a separate registered company, publishing a contact and answering grievances within the period you publish (90 days at most), and following the data for transfers and retention. Then a worksheet.

3. 3

   Crosswalk: README

   683 DPDPA requirements (342 from the Act, 341 from the Rules), each checked against five frameworks with a relationship type and a strength score.

4. 4

   Crosswalk: framework tabs

   ISO 27001, NIST Privacy Framework, NIST 800-171, NIST 800-53 and GDPR, all in the same layout: relationship, control, strength and rationale.

5. 5

   Crosswalk: coverage and Dashboard tabs

   All five frameworks side by side, and the totals: 421 of 683 requirements relate to at least one framework, and none is an exact Equal.

From the video

Two frames from the walkthrough. The worked example is a fictional online store.

Basis Act s.33(1); Act s.33(2)(a) to (g); Act s.10(2)(a). How we arrived here