Privacy management
Privacy records for GDPR, the DPDP Act, PDPA and PDPL
Privacy laws ask for the same core records: what personal data you process and why, how you answer requests from individuals, and what consent you hold. Certifyi keeps your privacy frameworks, privacy risks and cookie consent in the same workspace as your security programme.
In short
GDPR, the DPDP Act, PDPA and PDPL use different words for much the same duties: know what you process, answer individuals on time and be able to prove consent. Certifyi holds those laws in its framework catalogue, keeps privacy risks in the same register as security risks, and provides cookie consent for your websites.
Records of processing (Article 30)
Article 30 of the GDPR requires a record of each processing activity. The DPDP Act, PDPA and PDPL ask for similar information in different forms. For each activity, record:
- The purpose, and the lawful basis you rely on
- The categories of individuals and of personal data
- Recipients, including processors
- Transfers to other countries and the safeguard used
- Retention periods and a description of the security measures
Keep each activity linked to the systems and vendors that handle the data. When a vendor changes or a system is retired, you can then see which activities are affected.
Data subject requests
Each request needs a log entry from the day it arrives: the type of request, the law it falls under, who is handling it and when the response is due. Access, rectification, erasure, portability and objection requests each need different steps.
Response deadlines differ by law and by request, and some can be extended. Confirm the deadline that applies with your DPO or adviser and record it on the request.
| Request | Type | Regulation | Received | Due | Status |
|---|---|---|---|---|---|
| DSR-2024-041 | Erasure | GDPR | 2 Oct | 1 Nov | In progress |
| DSR-2024-042 | Access | GDPR | 5 Oct | 4 Nov | Completed |
| DSR-2024-043 | Portability | DPDP | 8 Oct | 7 Nov | In progress |
| DSR-2024-044 | Objection | PDPL | 10 Oct | 9 Nov | Pending review |
A request log with the type, regulation and due date of each request. Example data, not a customer record.
Consent records
If you rely on consent, a regulator will ask four things: when it was given, for what purpose, how it was collected and whether it has since been withdrawn. Keep those four facts for every consent you rely on.
Cookie consent
Certifyi includes cookie consent for your websites. Ask us how it would fit the sites you run.
Where Certifyi fits
GDPR, the DPDP Act, PDPA and PDPL are in the Certifyi framework catalogue. Map a control once and reuse the mapping across those laws and your security frameworks.
Privacy risks go in the risk register with a likelihood, impact, treatment and owner. Third parties that process personal data for you are assessed in vendor risk.
What it covers
The privacy work that sits most naturally beside security and risk.
-
Privacy frameworks
GDPR, the DPDP Act, PDPA and PDPL in the framework catalogue, with controls mapped once and reused.
-
Privacy risks
Privacy risks in the same register as security risks, each with an owner and a treatment.
-
Vendors
Processors and other third parties assessed through vendor risk.
-
Cookie consent
Cookie consent for the websites you run.
Related modules
Privacy work touches each of these: personal data breaches, privacy risks, personal data used by AI systems, and third parties that process data for you.
How Certifyi helps
Privacy in the same workspace as security
Privacy frameworks, privacy risks and cookie consent, managed in the same place as your compliance programme.
-
DSR management
Log, track and fulfil requests, with the regulation and due date on each one.
-
Cookie consent
Cookie consent for your websites.
-
Privacy frameworks
GDPR, the DPDP Act, PDPA and PDPL, with controls mapped once and reused across them.
-
Privacy risks
Privacy risks held in the risk register with an owner and a treatment plan.
Questions
Privacy management questions
Which privacy laws are in the framework catalogue?
GDPR, India’s DPDP Act, PDPA and Saudi Arabia’s PDPL. Map a control once and reuse the mapping across them.
How should data subject requests be handled?
Log each request when it arrives, classify it by type and by the law it falls under, assign a handler and record the due date. Keep a note of each step taken, because a regulator may ask to see it.
How do vendors fit in?
Third parties that process personal data for you are taken through intake and risk assessment in vendor risk, using the vendor portal rather than email.
Is privacy management a separate add-on?
No. It sits in the same workspace as your compliance and risk programme.
Bring your privacy work into the same workspace as security
Book a demo to see how Certifyi handles GDPR, the DPDP Act and other privacy laws next to your security programme.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them