1. Consent and Notice

• Notice provided before or at the time of collecting personal data, in plain language
• Notice specifies the data being collected and the purpose of processing
• Consent obtained through a clear affirmative action (no pre-ticked boxes)
• Consent is specific, informed, and freely given
• Mechanism in place for data principal to withdraw consent at any time
• Legitimate use cases (without consent) identified and documented where applicable

2. Data Principal Rights

• Right to access: process in place for data principals to request summary of data processed
• Right to correction and erasure: mechanism to action correction/deletion requests
• Right to grievance redressal: contact point or DPO identified and published
• Right to nominate: mechanism available for data principals to nominate another person to exercise rights on death or incapacity

3. Data Fiduciary Obligations

• Data collected is limited to what is necessary for the stated purpose (data minimisation)
• Data is not retained beyond the period necessary for the stated purpose
• Reasonable security safeguards implemented to prevent personal data breach
• Data processing agreements in place with all data processors
• Significant Data Fiduciary (SDF) status assessed; additional obligations mapped if applicable

4. Data Breach Response

• Incident response plan documented and tested
• Process in place to notify Data Protection Board and affected data principals of breaches
• Notification timelines tracked and assigned to a responsible team

5. Cross-Border Transfers

• All cross-border data transfers identified and mapped
• Restricted countries/territories list monitored for Central Government notifications
• Transfer mechanisms reviewed for each cross-border flow