To provide ongoing visibility into the effectiveness and compliance of privacy by design, enabling timely detection, escalation, and correction of issues.
Define monitoring activities, indicators, thresholds, logs, review frequency, and escalation criteria. Investigate deviations and track corrective actions to closure.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| IRDAI | IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §2.1-3.5 – Data Privacy |
India
Guideline
|
vLatest | View → |
| SEBI-CSCRF | SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 1.1 GV.OC: Organizational Context; 3.3 PR.DS: Data Security |
India
Regulation
|
vLatest | View → |
| DORA | Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 9(2) – ICT security policies, procedures, protocols and tools for resilience and data security Article 9(3) – ICT solutions/processes for secure data transfer and prevention of loss, unauthorised access and data compromise Article 12(1)(a) – Backup policies/procedures based on data criticality or confidentiality |
EU
Regulation
|
vCurrent | View → |
| ISO27002 | ISO/IEC 27002 ISO/IEC 27002 is a guidance standard containing a... Clause: 5.34 – Privacy and protection of PII |
ISO
Standard
|
v2022 | View → |
| PCI-DSS | PCI DSS PCI DSS is an industry security standard maintaine... Clause: 3.5.1 – PAN is rendered unreadable anywhere it is stored |
PCI
Standard
|
v4 | View → |
| COBIT2019 | COBIT COBIT is an enterprise governance and management f... Clause: 4.2 – Align, Plan and Organize (APO) > APO13 – Managed Security > APO13.02 – Define and manage an information security and privacy risk treatment plan. 4.5 – Monitor, Evaluate and Assess (MEA) > MEA03 – Managed Compliance with External Requirements > MEA03.04 – Obtain assurance of external compliance. |
COBIT
Governance Framework
|
v2019 | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: GV.OC – Organizational Context | GV.OC-03 – Legal, regulatory, and contractual requirements regarding cybersecurity — including privacy and civil liberties obligations — are understood and managed |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.12 – PLANNING; PL-5 – PRIVACY IMPACT ASSESSMENT |
NIST
Control Catalog
|
vRev. 5 | View → |
| DPDP | Digital Personal Data Protection Act The Digital Personal Data Protection Act, 2023 est... Clause: 8(4) – Appropriate technical and organisational measures; 8(5) – Reasonable security safeguards |
India
Law
|
v2023 | View → |
| NPCI-ISR | NPCI Information Security Requirements NPCI information-security requirements define cont... Clause: Security Measures / Controls; Data Privacy |
India
Standard
|
vLatest | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC5.1 – Control Activities – COSO Principle 10: The entity selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels. P1.1 – Privacy: Notice and Communication of Objectives – The entity provides notice to data subjects about its privacy practices to meet the entity’s objectives related to privacy. The notice is updated and communicated to data subjects in a timely manner for changes to the entity’s privacy practices, including changes in the use of personal information, to meet the entity’s objectives related to privacy. |
AICPA
Audit Framework
|
vLatest | View → |
| ISO27701 | ISO/IEC 27701 ISO/IEC 27701 provides requirements and guidance f... Clause: A.7.4.1; A.7.4.2; A.7.4.4; A.7.4.9; A.7.4.1 – Limit collection; A.7.4.2 – Limit processing; A.7.4.4 – PII minimization objectives; A.7.4.9 – PII transmission controls |
ISO
Privacy Standard
|
v2019 | View → |