To ensure the approved privacy notice management requirements are translated into effective operational activities, controls, and services rather than remaining documented intentions.
Define required notice elements, purposes, categories of data, legal basis where applicable, rights, retention, recipients, transfers, and contact details. Maintain version control and jurisdiction-specific variants.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| CIS-V8 | CIS Controls CIS Controls are a prioritized set of cybersecurit... Clause: Control 03 – Data Protection: 3.4 – Enforce Data Retention |
CIS
Best Practice
|
vv8 | View → |
| COBIT2019 | COBIT COBIT is an enterprise governance and management f... Clause: 4.2 – Align, Plan and Organize (APO) > APO14 – Managed Data > APO14.09 – Support data archiving and retention. 4.4 – Deliver, Service and Support (DSS) > DSS05 – Managed Security Services > DSS05.04 – Manage user identity and logical access. |
COBIT
Governance Framework
|
v2019 | View → |
| DORA | Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 30(2)(c) – Availability, authenticity, integrity, security and protection of personal data |
EU
Regulation
|
vCurrent | View → |
| DPDP | Digital Personal Data Protection Act The Digital Personal Data Protection Act, 2023 est... Clause: 5(1)(i)-(iii) – Personal data/purpose, rights and complaint information in notice |
India
Law
|
v2023 | View → |
| GDPR | General Data Protection Regulation (GDPR) The General Data Protection Regulation is a bindin... Clause: Article 12(1) – Transparent information and communication; Article 13 – Information where personal data are collected from the data subject; Article 14 – Information where personal data have not been obtained from the data subject |
EU
Regulation
|
vCurrent | View → |
| IRDAI | IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §2.1-3.3 – Data Classification Process |
India
Guideline
|
vLatest | View → |
| ISO27002 | ISO/IEC 27002 ISO/IEC 27002 is a guidance standard containing a... Clause: 5.34 – Privacy and protection of PII; 5.33 – Protection of records |
ISO
Standard
|
v2022 | View → |
| ISO27701 | ISO/IEC 27701 ISO/IEC 27701 provides requirements and guidance f... Clause: A.7.4.7; A.7.3.6; B.8.3.1; A.7.3.2; A.7.3.3; A.7.4.7 – Retention; A.7.3.6 – Access, correction, and erasure; B.8.3.1 – Obligations to PII principals; A.7.3.2 – Determine information for PII principals; A.7.3.3 – Providing information to PII principals |
ISO
Privacy Standard
|
v2019 | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: ID.AM – Asset Management | ID.AM-07 – Inventories of data and corresponding metadata for designated data types are maintained PR.DS – Data Security | PR.DS-01 – The confidentiality, integrity, and availability of data-at-rest are protected |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.15 – PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY; PT-5 – PRIVACY NOTICE |
NIST
Control Catalog
|
vRev. 5 | View → |
| NPCI-ISR | NPCI Information Security Requirements NPCI information-security requirements define cont... Clause: Security Measures / Controls; Data Privacy |
India
Standard
|
vLatest | View → |
| SEBI-CSCRF | SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 1.1 GV.OC: Organizational Context; 3.3 PR.DS: Data Security |
India
Regulation
|
vLatest | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: P1.1 – Privacy: Notice and Communication of Objectives – The entity provides notice to data subjects about its privacy practices to meet the entity’s objectives related to privacy. The notice is updated and communicated to data subjects in a timely manner for changes to the entity’s privacy practices, including changes in the use of personal information, to meet the entity’s objectives related to privacy. |
AICPA
Audit Framework
|
vLatest | View → |