Consent withdrawal across your vendor chain
What should happen after a customer withdraws consent—and how does the business demonstrate that it happened?
Read the guide Data Privacy & DPDPA
Follow the data. Understand the duty.
Consent, retention, Processor accountability and incident decisions, examined at the point where policy meets operations.
The contextData Privacy & DPDPA.
Data Privacy & DPDPA.
The questions behind the work.
A privacy review begins with the processing activity: whose data is involved, who decides the purpose and means, and what each participant actually does. A Data Fiduciary and a Processor have different roles; the contract label is evidence, not the final answer. GDPR terminology should not be imported into an Indian assessment without checking the applicable statutory ground.
Read the practice notesFive decisions.
Five decisions.
Examined in detail.
Verifying data deletion when a vendor leaves
A deletion certificate is useful only when its scope matches the data and systems that need to be addressed.
Read the guideEmployee monitoring: necessity before collection
A practical legal review of screen capture, productivity analytics, location tracking and workplace surveillance.
Read the guideThe legal decision record after a data incident
Separate what is known, what needs investigation and which reporting obligations may already be running.
Read the guideWhen a deletion request meets a legal hold
How to preserve relevant evidence without turning a dispute into an indefinite retention exception.
Read the guideThe applicable framework
DPDP Act, 2023: sections 4–8, 11–13 and 16, as relevant. The substantive duties discussed here form part of the phased commencement programme; distinguish readiness work from duties already in force. Existing IT, cybersecurity and sector-specific requirements need their own assessment.