Chapter 1 of 11 · 3 checks · 2 min
Scope, roles and purpose
Before any technical control, know which rules apply, what role your organisation plays and why each dataset exists. These checks set the frame for the rest.
Find out which privacy laws apply to the data you handle, with your legal or privacy leadMust
Why it matters and how to check
Privacy laws often reach beyond their own borders. The GDPR can apply to an organisation outside the EU that offers goods or services to people in the EU or monitors their behaviour. India's DPDP Act also applies to processing outside India when it is connected with offering goods or services to people in India.
To verify, check there is a written note from your privacy lead or counsel listing the laws that apply to each product or dataset, based on where users are and where the organisation operates. If nobody can produce it, raise the question before building further. Engineers should not decide this alone.
Know whether you act as controller or processor for each datasetShould
Why it matters and how to check
The obligations differ by role. Under the GDPR, a controller decides why and how personal data is processed, and a processor processes it on the controller's behalf. India's DPDP Act uses the terms Data Fiduciary and Data Processor, and makes the Data Fiduciary responsible for compliance even for processing done on its behalf.
To verify, for each major dataset, record whether your organisation is the controller or a processor for a client. If you are a processor, find the client contract and check what it says about use, retention, sub-processors and deletion.
Record the purpose and lawful basis for each use of personal dataMust
Why it matters and how to check
The GDPR requires personal data to be collected for specified, explicit and legitimate purposes and to have a lawful basis, such as consent, a contract or legitimate interests. The DPDP Act ties processing to a lawful purpose with consent or certain legitimate uses. Purpose drives everything else in this checklist: what you may collect, how long you may keep it and who may see it.
To verify, pick three datasets at random and find, for each, a written purpose and lawful basis agreed with your privacy lead. A purpose like "analytics" is too vague; "measuring weekly retention of new sign-ups" is specific enough to test other decisions against.