# Infofacility

> Compliance software for consent and rights requests, security and GRC services, free tools, and an open library of the laws: DPDP, CERT-In, SEBI, RBI and BRSR section by section, mapped to SOC 2, ISO 27001, ISO 27701, ISO 42001, GDPR, CCPA and the EU AI Act.

How to read the pages: every law, framework, comparison, term and tool page records a review date in its structured data (last checked 4 Nov 2026 or later) and links to the regulator's or standard body's own document. Statutory text is reproduced from the Gazette of India and marked verified only once checked word for word; a page whose text is pending says so. ISO and AICPA text is paraphrased, never reproduced. Status words are fixed: In force, Upcoming, Deadline, Voluntary, Superseded. Nothing here is legal advice.

## Laws

- [Digital Personal Data Protection Act, 2023](https://www.infofacility.com/laws/dpdp-act-2023): India's data protection law: 44 sections in 9 chapters and a Schedule of penalties, coming into force in phases under notification G.S.R. 843(E) of 13 Nov 2025. One page per section, with the statutory text, a plain-English reading, what you must do, and the date each part applies.
  - [s. 1: Short title and commencement](https://www.infofacility.com/laws/dpdp-act-2023/section-1): In force. Names the Act and lets the Central Government bring its sections into force on dates it notifies, with different dates for different sections. That is why the Act arrived in phases: 13 Nov 2025, 13 Nov 2026 and 13 May 2027.
  - [s. 2: Definitions](https://www.infofacility.com/laws/dpdp-act-2023/section-2): In force from 13 Nov 2025. Defines the words the rest of the Act turns on: Data Fiduciary (who decides the purpose and means of processing), Data Principal (the person the data is about), Data Processor, Significant Data Fiduciary, Consent Manager, personal data, digital personal data, personal data breach, processing and the Board. The glossary has one page per term, with the clause that defines it.
  - [s. 3: Application of Act](https://www.infofacility.com/laws/dpdp-act-2023/section-3): Upcoming from 13 May 2027. The Act applies to digital personal data processed in India, including data collected on paper and digitised later, and to processing outside India connected with offering goods or services to people in India. It leaves out data processed for personal or domestic purposes and data a Data Principal has made public themselves or that is public under a legal duty.
  - [s. 4: Grounds for processing personal data](https://www.infofacility.com/laws/dpdp-act-2023/section-4): Upcoming from 13 May 2027. Personal data may be processed only for a lawful purpose, and only on one of two grounds: the Data Principal's consent, or one of the certain legitimate uses listed in s. 7. There is no general legitimate-interests ground as there is under GDPR.
  - [s. 5: Notice](https://www.infofacility.com/laws/dpdp-act-2023/section-5): Upcoming from 13 May 2027. Every request for consent must come with or after a notice that says what personal data is being asked for and why, how the person can exercise their rights and withdraw consent, and how to complain to the Board. For consent taken before the Act applied, the notice must be given as soon as reasonably practicable. Rule 3 sets what the notice must contain and that it must stand on its own, in clear and plain language.
  - [s. 6: Consent](https://www.infofacility.com/laws/dpdp-act-2023/section-6): Upcoming from 13 May 2027. Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the purpose stated. Withdrawing it must be as easy as giving it, and the Data Fiduciary and its processors must then stop processing within a reasonable time unless another law requires otherwise. A person may give, manage, review or withdraw consent through a Consent Manager registered with the Board.
  - [s. 7: Certain legitimate uses](https://www.infofacility.com/laws/dpdp-act-2023/section-7): Upcoming from 13 May 2027. Lists when personal data may be processed without consent: for a purpose the person voluntarily gave the data for and has not objected to; for the State to provide a subsidy, benefit, service, certificate, licence or permit; to perform a function under law or in the interest of sovereignty, integrity or security of the State; to comply with a judgment or order; for a medical emergency, epidemic or disaster; and for employment and to protect the employer from loss. Each use is narrower than GDPR's legitimate interests and must be read on its own terms.
  - [s. 8: General obligations of Data Fiduciary](https://www.infofacility.com/laws/dpdp-act-2023/section-8): Upcoming from 13 May 2027. The section that carries most of the day-to-day duties, in eleven sub-sections. The Data Fiduciary is responsible for compliance even where a Data Processor does the work, must use processors only under a valid contract, keep data complete and accurate where it is used to make a decision about a person or shared with another fiduciary, put technical and organisational measures in place, protect the data with reasonable security safeguards, intimate the Board and every affected Data Principal of a breach, erase data when consent is withdrawn or the purpose is served unless a law requires retention, publish how to reach its Data Protection Officer or the person who answers data questions, and run a grievance redressal mechanism.
  - [s. 9: Processing of personal data of children](https://www.infofacility.com/laws/dpdp-act-2023/section-9): Upcoming from 13 May 2027. Before processing the personal data of a child (anyone under 18) or of a person with a disability who has a lawful guardian, the Data Fiduciary must get verifiable consent from the parent or guardian. It must not process children's data in a way likely to harm a child, and must not track children, monitor their behaviour or target advertising at them. The Central Government can exempt classes of fiduciaries or purposes, and can lower the age for fiduciaries it finds process children's data safely. Rule 10 sets how parental consent is verified and Rule 11 lists the exemptions.
  - [s. 10: Additional obligations of Significant Data Fiduciary](https://www.infofacility.com/laws/dpdp-act-2023/section-10): Upcoming from 13 May 2027. The Central Government may notify a Data Fiduciary or class of them as Significant Data Fiduciaries, weighing the volume and sensitivity of data, the risk to Data Principals' rights, the effect on India's sovereignty and security, and on democracy and public order. A Significant Data Fiduciary must appoint a Data Protection Officer based in India who answers to its board, appoint an independent data auditor, and carry out periodic data protection impact assessments and audits. Rule 12 adds an annual audit and algorithmic due diligence, and lets the Government restrict the transfer of specified data outside India.
  - [s. 11: Right to access information about personal data](https://www.infofacility.com/laws/dpdp-act-2023/section-11): Upcoming from 13 May 2027. A person whose data is processed on consent, or for a State subsidy or service under s. 7(a) or (b), can ask the Data Fiduciary for a summary of the personal data being processed and the processing activities, the identities of every other fiduciary and processor the data was shared with and what was shared, and any other information the Rules prescribe. Sharing with another fiduciary authorised by law to obtain the data for crime prevention or detection is outside the right.
  - [s. 12: Right to correction and erasure of personal data](https://www.infofacility.com/laws/dpdp-act-2023/section-12): Upcoming from 13 May 2027. A person can ask for their personal data to be corrected, completed or updated, and to be erased when it is no longer needed for the purpose it was collected for, unless a law requires it to be kept. The Data Fiduciary must correct inaccurate or misleading data, complete incomplete data and erase data when asked, within the limits of other laws.
  - [s. 13: Right of grievance redressal](https://www.infofacility.com/laws/dpdp-act-2023/section-13): Upcoming from 13 May 2027. A person has the right to readily available means of grievance redressal from the Data Fiduciary or a Consent Manager about anything they do or fail to do under the Act. The fiduciary must respond within the period the Rules prescribe, and the person must use this route before complaining to the Board. Rule 13 sets the period and asks fiduciaries to publish it.
  - [s. 14: Right to nominate](https://www.infofacility.com/laws/dpdp-act-2023/section-14): Upcoming from 13 May 2027. A person can nominate someone else to exercise their rights under the Act if they die or become incapable of doing so. The nomination is made in the manner the Rules prescribe.
  - [s. 15: Duties of Data Principal](https://www.infofacility.com/laws/dpdp-act-2023/section-15): Upcoming from 13 May 2027. Data Principals have duties too: comply with the law when exercising rights, not impersonate anyone, not suppress material information when giving data for a document or identifier issued by the State, not file a false or frivolous grievance or complaint, and give only verifiably authentic information when asking for correction or erasure. The Schedule sets a penalty for breaching these duties.
  - [s. 16: Processing of personal data outside India](https://www.infofacility.com/laws/dpdp-act-2023/section-16): Upcoming from 13 May 2027. A Data Fiduciary may transfer personal data to any country or territory outside India except those the Central Government restricts by notification. Where another Indian law sets a higher bar for a kind of data, that law prevails. Rule 14 adds that a transfer must meet any requirement the Government sets for making the data available to a foreign State or its agencies.
  - [s. 17: Exemptions](https://www.infofacility.com/laws/dpdp-act-2023/section-17): Upcoming from 13 May 2027. Lists where the Act, or parts of it, do not apply: enforcing legal rights or claims, courts and tribunals, prevention and investigation of offences, processing of non-residents' data under a foreign contract, approved mergers and schemes, and finding out a defaulter's assets. The Central Government may exempt its own instrumentalities for security and public order, exempt research, archiving or statistical purposes that follow prescribed standards, and exempt startups and classes of fiduciaries from some duties for a period. Rule 15 sets the standards for the research exemption.
  - [s. 18: Establishment of Board](https://www.infofacility.com/laws/dpdp-act-2023/section-18): In force from 13 Nov 2025. The Central Government establishes the Data Protection Board of India, a body corporate with its head office where the Government notifies. G.S.R. 844(E) of 13 Nov 2025 established it.
  - [s. 19: Composition and qualifications for appointment of Chairperson and members](https://www.infofacility.com/laws/dpdp-act-2023/section-19): In force from 13 Nov 2025. The Board has a Chairperson and the number of Members the Government notifies (G.S.R. 845(E) set the number), appointed by the Central Government, with the qualifications and experience the section lists. At least one Member must be an expert in law.
  - [s. 20: Salary, allowances payable to and term of office](https://www.infofacility.com/laws/dpdp-act-2023/section-20): In force from 13 Nov 2025. Sets the two-year term of the Chairperson and Members, their eligibility for reappointment, and that their pay and conditions are as prescribed and cannot be changed to their disadvantage after appointment.
  - [s. 21: Disqualifications for appointment and continuation as Chairperson and Members of Board](https://www.infofacility.com/laws/dpdp-act-2023/section-21): In force from 13 Nov 2025. Who cannot be appointed or continue: an insolvent, a person convicted of an offence involving moral turpitude, a person of unsound mind, someone removed from Government service, or someone with a financial or other interest likely to affect their functions.
  - [s. 22: Resignation by Members and filling of vacancy](https://www.infofacility.com/laws/dpdp-act-2023/section-22): In force from 13 Nov 2025. How the Chairperson or a Member resigns (three months' notice, or earlier if the Government permits) and how a vacancy is filled.
  - [s. 23: Proceedings of Board](https://www.infofacility.com/laws/dpdp-act-2023/section-23): In force from 13 Nov 2025. The Board decides by majority at meetings or by circulation, its acts are not invalid for a vacancy or defect in appointment, and it may authorise individual Members or officers to perform functions. Rule 20 makes it a digital office: proceedings happen online, without anyone having to appear in person.
  - [s. 24: Officers and employees of Board](https://www.infofacility.com/laws/dpdp-act-2023/section-24): In force from 13 Nov 2025. The Board may appoint the officers and employees it needs, with the Government's approval, on the terms the Rules prescribe.
  - [s. 25: Members and officers to be public servants](https://www.infofacility.com/laws/dpdp-act-2023/section-25): In force from 13 Nov 2025. The Chairperson, Members, officers and employees of the Board are public servants within the meaning of the Indian Penal Code (now the Bharatiya Nyaya Sanhita).
  - [s. 26: Powers of Chairperson](https://www.infofacility.com/laws/dpdp-act-2023/section-26): In force from 13 Nov 2025. The Chairperson has general superintendence of the Board, authorises its officers to perform functions, and exercises the other powers the Rules give.
  - [s. 27: Powers and functions of Board](https://www.infofacility.com/laws/dpdp-act-2023/section-27): Upcoming from 13 May 2027. The Board directs urgent remedial measures when it is told of a personal data breach, inquires into the breach and imposes penalties; it inquires into complaints by Data Principals, references by the Government, and breaches by Consent Managers; and it may direct the parties to mediation or accept a voluntary undertaking. Clause (1)(d), on complaints against Consent Managers, comes into force on 13 Nov 2026 with the rest of the Consent Manager provisions; the rest of the section on 13 May 2027.
  - [s. 28: Procedure to be followed by Board](https://www.infofacility.com/laws/dpdp-act-2023/section-28): Upcoming from 13 May 2027. The Board works as a digital office, following natural justice, and may act on a complaint, a reference or a breach intimation. It may close a complaint it finds has no substance, must give reasons for its decisions, may summon people and documents and inspect records, and may impose costs for a frivolous complaint. It cannot stop a Data Fiduciary from doing business as a whole.
  - [s. 29: Appeal to Appellate Tribunal](https://www.infofacility.com/laws/dpdp-act-2023/section-29): Upcoming from 13 May 2027. An order of the Board can be appealed to the Appellate Tribunal (the Telecom Disputes Settlement and Appellate Tribunal, TDSAT) within 60 days, which may be extended for sufficient cause. The Tribunal works as a digital office and should decide within six months where it can. Its orders can be appealed to the Supreme Court.
  - [s. 30: Orders passed by Appellate Tribunal to be executable as decree](https://www.infofacility.com/laws/dpdp-act-2023/section-30): Upcoming from 13 May 2027. An order of the Appellate Tribunal is executable like a decree of a civil court, and the Tribunal may send it to a court for execution.
  - [s. 31: Alternate dispute resolution](https://www.infofacility.com/laws/dpdp-act-2023/section-31): Upcoming from 13 May 2027. If the Board thinks a complaint could be resolved by mediation or another dispute resolution process, it may direct the parties to try it.
  - [s. 32: Voluntary undertaking](https://www.infofacility.com/laws/dpdp-act-2023/section-32): Upcoming from 13 May 2027. At any stage of a proceeding the Board may accept a voluntary undertaking from the person concerned to take or stop an action, or to publicise it. Accepting it bars further proceedings on that matter, and breaking it is treated as a breach of the Act.
  - [s. 33: Penalties](https://www.infofacility.com/laws/dpdp-act-2023/section-33): Upcoming from 13 May 2027. If the Board finds a significant breach after an inquiry, it may impose a monetary penalty up to the amount the Schedule sets for that breach, after giving the person a chance to be heard. In deciding the amount it weighs the nature, gravity and duration of the breach, the kind of data, whether it was repeated, any gain or loss, mitigation, and proportionality.
  - [s. 34: Crediting sums realised by way of penalties to Consolidated Fund of India](https://www.infofacility.com/laws/dpdp-act-2023/section-34): Upcoming from 13 May 2027. Penalties go to the Consolidated Fund of India, not to the Board or the complainant.
  - [s. 35: Protection of action taken in good faith](https://www.infofacility.com/laws/dpdp-act-2023/section-35): In force from 13 Nov 2025. No suit or proceeding lies against the Government, the Board, its Chairperson, Members, officers or employees for anything done in good faith under the Act.
  - [s. 36: Power to call for information](https://www.infofacility.com/laws/dpdp-act-2023/section-36): Upcoming from 13 May 2027. The Central Government may require the Board, a Data Fiduciary or an intermediary to furnish information, for the purposes of the Act. Rule 23 and the Seventh Schedule to the Rules set the authorised officers and purposes, and let the Government bar disclosure of the request.
  - [s. 37: Power of Central Government to issue directions](https://www.infofacility.com/laws/dpdp-act-2023/section-37): Upcoming from 13 May 2027. Where the Board has penalised a Data Fiduciary twice or more and advises that access to its service should be blocked in the public interest, the Central Government may, after hearing the fiduciary, direct intermediaries to block public access to the information that lets the fiduciary offer goods or services in India.
  - [s. 38: Consistency with other laws](https://www.infofacility.com/laws/dpdp-act-2023/section-38): In force from 13 Nov 2025. The Act adds to, and does not take away from, other laws in force. Where it conflicts with another law, the Act prevails to the extent of the conflict.
  - [s. 39: Bar of jurisdiction](https://www.infofacility.com/laws/dpdp-act-2023/section-39): In force from 13 Nov 2025. No civil court can entertain a matter the Board is empowered to decide, or grant an injunction against anything done under the Act.
  - [s. 40: Power to make rules](https://www.infofacility.com/laws/dpdp-act-2023/section-40): In force from 13 Nov 2025. Lets the Central Government make rules on the matters the Act leaves to be prescribed: notices, consent managers, security safeguards, breach intimation, rights procedures, the Board's working and more. The DPDP Rules, 2025 were made under this section.
  - [s. 41: Laying of rules and certain notification](https://www.infofacility.com/laws/dpdp-act-2023/section-41): In force from 13 Nov 2025. Rules and certain notifications must be laid before each House of Parliament, which may modify or annul them.
  - [s. 42: Power to amend Schedule](https://www.infofacility.com/laws/dpdp-act-2023/section-42): In force from 13 Nov 2025. The Central Government may amend the Schedule of penalties by notification, but may not raise any penalty above double the amount set when the Act was passed.
  - [s. 43: Power to remove difficulties](https://www.infofacility.com/laws/dpdp-act-2023/section-43): In force from 13 Nov 2025. For three years after commencement, the Government may make orders to remove difficulties in giving effect to the Act, consistent with its provisions.
  - [s. 44: Amendments to certain Acts](https://www.infofacility.com/laws/dpdp-act-2023/section-44): In force from 13 Nov 2025. Amends the Information Technology Act, 2000 (omitting s. 43A and changing s. 87), the Telecom Regulatory Authority of India Act, 1997 (making TDSAT the Appellate Tribunal under this Act) and the Right to Information Act, 2005 (narrowing the personal information exemption in s. 8(1)(j)). Sub-sections (1) and (3) are in force; sub-section (2) applies from 13 May 2027.
  - [The Schedule: The Schedule: penalties](https://www.infofacility.com/laws/dpdp-act-2023/schedule): Upcoming from 13 May 2027. Sets the ceiling for each kind of breach: up to Rs 250 crore for failing to take reasonable security safeguards under s. 8(5); up to Rs 200 crore for failing to notify the Board or affected Data Principals of a breach under s. 8(6); up to Rs 200 crore for breaching the duties on children's data under s. 9; up to Rs 150 crore for a Significant Data Fiduciary's additional duties under s. 10; up to Rs 10,000 for a Data Principal's duties under s. 15; the amount a voluntary undertaking would have covered where the undertaking is broken; and up to Rs 50 crore for any other breach. Every figure is a ceiling the Board applies using the factors in s. 33.
- [Digital Personal Data Protection Rules, 2025](https://www.infofacility.com/laws/dpdp-rules-2025): The Rules that make the DPDP Act work: 23 rules and seven schedules notified on 13 Nov 2025, with the consent notice, the security floor, the 72-hour breach report, retention periods, children's consent, the duties of Significant Data Fiduciaries and the Data Protection Board's procedure. One page per rule and schedule, with the notified text, a plain-English reading, what you must do, and the date each part applies.
  - [s. 1: Short title and commencement](https://www.infofacility.com/laws/dpdp-rules-2025/rule-1): In force from 13 Nov 2025. Names the Rules and sets the three commencement dates. Rules 1, 2 and 17 to 21 (the Rules about the Data Protection Board) applied from publication on 13 Nov 2025. Rule 4, on Consent Managers, applies from 13 Nov 2026. Every other Rule, which is where the duties on companies sit, applies from 13 May 2027.
  - [s. 2: Definitions](https://www.infofacility.com/laws/dpdp-rules-2025/rule-2): In force from 13 Nov 2025. Defines four terms the Rules use and borrows every other definition from the Act. "User account" is wide: it includes profiles, pages, handles, email addresses and mobile numbers through which a person reaches your service, which matters for breach intimation under Rule 7 and erasure warnings under Rule 8. "Verifiable consent" means the parent or guardian consent process in Rules 10 and 11, and "techno-legal measures" refers to the digital-office provisions in Rules 20 and 22.
  - [s. 3: Notice given by Data Fiduciary to Data Principal](https://www.infofacility.com/laws/dpdp-rules-2025/rule-3): Upcoming from 13 May 2027. Sets what a consent notice must contain and how it must read. The notice has to stand on its own, without sending the reader to a privacy policy or terms page, and it must use clear and plain language. At the minimum it lists the personal data item by item, states the purpose and describes the goods, services or uses the processing enables.
  - [s. 4: Registration and obligations of Consent Manager](https://www.infofacility.com/laws/dpdp-rules-2025/rule-4): Upcoming from 13 Nov 2026. Creates the registration regime for Consent Managers, the platforms through which a person can give, manage, review and withdraw consent across many Data Fiduciaries. A company that meets the conditions in Part A of the First Schedule (incorporated in India, net worth of at least Rs 2 crore, sound management, independence from Data Fiduciaries, certified interoperable platform) may apply to the Board, which can inquire, register or reject with reasons, and must publish registered Consent Managers on its website.
  - [s. 5: Processing of personal data for provision or issue of subsidy, benefit, service, certificate, licence or permit by State and its instrumentalities](https://www.infofacility.com/laws/dpdp-rules-2025/rule-5): Upcoming from 13 May 2027. Applies when the State or one of its instrumentalities processes personal data to provide a subsidy, benefit, service, certificate, licence or permit under s. 7(b) of the Act, the legitimate use that lets government bodies proceed without consent where the person has already consented to a related use or the data sits in a government database. Such processing must follow the standards in the Second Schedule: lawful, purpose-limited, accurate, retained only while needed, secured, with an intimation to the person and a contact point.
  - [s. 6: Reasonable security safeguards](https://www.infofacility.com/laws/dpdp-rules-2025/rule-6): Upcoming from 13 May 2027. Spells out the "reasonable security safeguards" s. 8(5) of the Act requires, and the floor is specific: encryption, obfuscation, masking or tokenisation of personal data; access control on the computer resources used; logging, monitoring and review so unauthorised access can be detected, investigated and remediated; backups and continuity measures; retention of logs and the personal data for one year to support detection and investigation, unless another law says otherwise; contract clauses that bind every Data Processor to the same safeguards; and technical and organisational measures to make all of this stick.
  - [s. 7: Intimation of personal data breach](https://www.infofacility.com/laws/dpdp-rules-2025/rule-7): Upcoming from 13 May 2027. Sets the two-track breach intimation that s. 8(6) of the Act requires. To each affected person: without delay, through their user account or any registered mode of communication, a concise and plain description of the breach (nature, extent, timing), the consequences likely for them, what you have done and are doing to mitigate risk, what they can do to protect themselves, and a contact who can answer questions.
  - [s. 8: Time period for specified purpose to be deemed as no longer being served](https://www.infofacility.com/laws/dpdp-rules-2025/rule-8): Upcoming from 13 May 2027. Three retention rules. First, the large platforms listed in the Third Schedule (e-commerce entities and social media intermediaries with two crore or more registered users in India, online gaming intermediaries with fifty lakh or more) must erase a person's personal data three years after they last approached the platform or exercised a right, or three years after the Rules commenced, whichever is latest, unless another law requires retention. Data needed to let the person into their account or to redeem a virtual token (a wallet balance, say) is excepted.
  - [s. 9: Contact information of person to answer questions about processing](https://www.infofacility.com/laws/dpdp-rules-2025/rule-9): Upcoming from 13 May 2027. Every Data Fiduciary must publish prominently on its website or app the business contact information of its Data Protection Officer, if it has to have one, or otherwise of a person who can answer questions about how it processes personal data. The same contact must appear in every response to a rights request. Only Significant Data Fiduciaries must appoint a DPO under s. 10 of the Act; everyone else still needs a named, published contact.
  - [s. 10: Verifiable consent for processing of personal data of child](https://www.infofacility.com/laws/dpdp-rules-2025/rule-10): Upcoming from 13 May 2027. Before processing a child's personal data (anyone under 18), a Data Fiduciary must obtain verifiable consent from the parent and check, with due diligence, that the person claiming to be the parent is an identifiable adult. The check uses reliable identity and age details the company already holds, or details the parent provides voluntarily, directly or through a virtual token issued by an authorised entity such as a Digital Locker service provider (DigiLocker).
  - [s. 11: Verifiable consent for processing of personal data of person with disability who has lawful guardian](https://www.infofacility.com/laws/dpdp-rules-2025/rule-11): Upcoming from 13 May 2027. Where the Data Principal is a person with disability who has a lawful guardian, the Data Fiduciary must take verifiable consent from the guardian and verify that the guardian was appointed by a court, a designated authority under the Rights of Persons with Disabilities Act, 2016, or a local level committee under the National Trust Act, 1999. The rule defines who counts as a person with disability for this purpose: someone who, despite adequate support, is unable to take legally binding decisions.
  - [s. 12: Exemptions from certain obligations applicable to processing of personal data of child](https://www.infofacility.com/laws/dpdp-rules-2025/rule-12): Upcoming from 13 May 2027. Lifts the parental-consent requirement (s. 9(1)) and the ban on tracking, behavioural monitoring and targeted advertising (s. 9(3)) for the Data Fiduciaries listed in Part A of the Fourth Schedule, such as clinical and mental health establishments, healthcare professionals, educational institutions, creches and school transport providers, and for the purposes listed in Part B, such as functions under law, benefits for a child, email-only accounts, real-time location for safety, keeping harmful content from children, and confirming that a user is not a child. Each exemption carries a condition that limits the processing to what that purpose needs.
  - [s. 13: Additional obligations of Significant Data Fiduciary](https://www.infofacility.com/laws/dpdp-rules-2025/rule-13): Upcoming from 13 May 2027. Adds four duties for Significant Data Fiduciaries, the class the Central Government notifies under s. 10 of the Act. Once every twelve months from notification: a Data Protection Impact Assessment and an audit, with the assessor or auditor sending a report of significant observations to the Board. Due diligence that algorithmic software used to host, display, upload, modify, publish, transmit, store, update or share personal data is not likely to pose a risk to Data Principals' rights. And, for categories of personal data the Central Government specifies on a committee's recommendation, a localisation duty: that data and the traffic data about its flow may not leave India.
  - [s. 14: Rights of Data Principals](https://www.infofacility.com/laws/dpdp-rules-2025/rule-14): Upcoming from 13 May 2027. Sets the mechanics for the rights in ss. 11 to 14 of the Act. Data Fiduciaries and Consent Managers must publish on their website or app how a person makes a rights request and what identifiers (username, customer ID, application number, email, mobile number) they will need. A person exercises rights by asking the Data Fiduciary they gave consent to, using those means. Grievances must be answered within a published period of at most 90 days, backed by technical and organisational measures that make the system work. A person may nominate one or more individuals to exercise their rights for them.
  - [s. 15: Transfer of personal data outside the territory of India](https://www.infofacility.com/laws/dpdp-rules-2025/rule-15): Upcoming from 13 May 2027. Personal data may be transferred outside India, subject to whatever requirements the Central Government specifies by general or special order about making the data available to a foreign State or to a person or entity under its control or an agency of it. The Act's s. 16 lets the Government restrict transfers to notified countries; this rule adds a second, order-based layer aimed at foreign government access. No such order has been issued yet.
  - [s. 16: Exemption from Act for research, archiving or statistical purposes](https://www.infofacility.com/laws/dpdp-rules-2025/rule-16): Upcoming from 13 May 2027. Processing that is necessary for research, archiving or statistical purposes falls outside the Act altogether, provided it follows the standards in the Second Schedule (lawful, purpose-limited, accurate, time-limited, secured, accountable). This is the exemption the Act authorises in s. 17(2)(b).
  - [s. 17: Appointment of Chairperson and other Members](https://www.infofacility.com/laws/dpdp-rules-2025/rule-17): In force from 13 Nov 2025. Sets up two Search-cum-Selection Committees that recommend people for appointment to the Data Protection Board of India: one chaired by the Cabinet Secretary for the Chairperson, one chaired by the MeitY Secretary for the other Members, each with the Law Secretary and two outside experts. The Central Government appoints from their recommendations. A vacancy or defect in a committee does not invalidate its work.
  - [s. 18: Salary, allowances and other terms and conditions of service of Chairperson and other Members](https://www.infofacility.com/laws/dpdp-rules-2025/rule-18): In force from 13 Nov 2025. The Chairperson's and Members' salary, allowances and other terms of service are those in the Fifth Schedule: a consolidated Rs 4.5 lakh a month for the Chairperson and Rs 4 lakh for other Members, without house or car, with travel, medical and leave entitlements pegged to Central Government pay levels 17 and 15.
  - [s. 19: Procedure for meetings of Board and authentication of its orders, directions and instruments](https://www.infofacility.com/laws/dpdp-rules-2025/rule-19): In force from 13 Nov 2025. How the Board meets and decides: the Chairperson calls meetings and sets the agenda; one-third of the members is a quorum; decisions go by majority with the chair holding a casting vote; a Member with an interest in an item steps aside; the Chairperson can act alone in an emergency and ratify at the next meeting; matters can be decided by circulation. Sub-rule (9) matters most to companies: an inquiry under s. 27 of the Act must finish within six months of the complaint, intimation or reference, extendable by three months at a time for recorded reasons.
  - [s. 20: Functioning of Board as digital office](https://www.infofacility.com/laws/dpdp-rules-2025/rule-20): In force from 13 Nov 2025. The Board works as a digital office. It keeps the power to summon people and examine them on oath, but it may run proceedings through techno-legal measures so that nobody has to appear in person.
  - [s. 21: Terms and conditions of appointment and service of officers and employees of Board](https://www.infofacility.com/laws/dpdp-rules-2025/rule-21): In force from 13 Nov 2025. The Board may appoint officers and employees with the Central Government's prior approval, on the terms in the Sixth Schedule, which provides for deputation from government and public bodies for up to five years, and for staff taken from the National Institute for Smart Government on market-linked pay.
  - [s. 22: Appeal to Appellate Tribunal](https://www.infofacility.com/laws/dpdp-rules-2025/rule-22): Upcoming from 13 May 2027. Appeals against the Board's orders and directions go to the Appellate Tribunal (the TDSAT, under s. 29 of the Act), filed digitally in the form the Tribunal decides. The fee is the same as for an appeal under the TRAI Act, 1997, payable through UPI or another RBI-authorised system, and the Tribunal's Chairperson may reduce or waive it. The Tribunal is not bound by the Code of Civil Procedure, follows natural justice, and also runs as a digital office.
  - [s. 23: Calling for information from Data Fiduciary or intermediary](https://www.infofacility.com/laws/dpdp-rules-2025/rule-23): Upcoming from 13 May 2027. The Central Government, acting through the officers named in the Seventh Schedule, may require any Data Fiduciary or intermediary to furnish information for the purposes listed there: use of personal data in the interest of sovereignty, integrity or security of the State; performance of functions or disclosures required under law; and assessing whether to notify a Significant Data Fiduciary. Where disclosure would prejudice sovereignty, integrity or security, the Government can require the company not to tell the affected person or anyone else without the authorised person's written permission.
  - [s. First Schedule: Consent Managers: conditions for registration and obligations](https://www.infofacility.com/laws/dpdp-rules-2025/first-schedule): Upcoming from 13 Nov 2026. Part A lists what an applicant must be before the Board registers it as a Consent Manager: a company incorporated in India with the technical, operational and financial capacity for the role; sound finances and management; net worth of at least Rs 2 crore; adequate business prospects and capital structure; directors and senior management of good repute; constitutional documents that lock in the conflict-of-interest obligations and can only be changed with the Board's approval; operations in Data Principals' interests; and independent certification that its interoperable consent platform meets the Board's published standards.
  - [s. Second Schedule: Standards for processing by the State and for research, archiving and statistics](https://www.infofacility.com/laws/dpdp-rules-2025/second-schedule): Upcoming from 13 May 2027. Eight standards that apply both to State processing under s. 7(b) of the Act (Rule 5) and to processing for research, archiving or statistical purposes exempted under s. 17(2)(b) (Rule 16). Processing must be lawful, limited to the stated use or purpose, limited to the personal data necessary, reasonably accurate and complete, retained only while needed or while another law requires, protected by reasonable security safeguards including at Data Processors, and the person who decides the purpose and means is accountable for all of this. For State processing there is one more: the person must be given an intimation, with a contact point and a link to where they can exercise their rights, and the processing must follow any other applicable Central Government policy or law.
  - [s. Third Schedule: Retention periods for large platforms](https://www.infofacility.com/laws/dpdp-rules-2025/third-schedule): Upcoming from 13 May 2027. Three classes of Data Fiduciary and one time period. E-commerce entities with two crore or more registered users in India, online gaming intermediaries with fifty lakh or more, and social media intermediaries with two crore or more must erase a person's personal data three years from the date the person last approached them for the specified purpose or exercised a right, or from the commencement of the Rules, whichever is latest. Two purposes are excepted and may continue: letting the person access their user account, and letting them access a virtual token (a wallet balance or credit) issued by or for the platform that can be used to get money, goods or services.
  - [s. Fourth Schedule: Children's data: who is exempt from parental consent and the tracking ban, and on what conditions](https://www.infofacility.com/laws/dpdp-rules-2025/fourth-schedule): Upcoming from 13 May 2027. Part A exempts five classes of Data Fiduciary from s. 9(1) (verifiable parental consent) and s. 9(3) (no tracking, behavioural monitoring or targeted advertising at children), each on a condition: clinical establishments, mental health establishments and healthcare professionals, for health services to the child; allied healthcare professionals, for a treatment and referral plan; educational institutions, for tracking and behavioural monitoring in the course of education or for the safety of enrolled children; creches and day-care carers, for the safety of children in their care; and transport providers engaged by schools or creches, for tracking children's location during travel.
  - [s. Fifth Schedule: Terms and conditions of service of the Chairperson and Members](https://www.infofacility.com/laws/dpdp-rules-2025/fifth-schedule): In force from 13 Nov 2025. The Chairperson receives a consolidated salary of Rs 4.5 lakh a month and each Member Rs 4 lakh, without house or car. They may contribute to the Board's provident fund but earn no pension or gratuity. Travel within and outside India, medical assistance and leave follow Central Government rules at pay level 17 for the Chairperson and level 15 for Members. The Central Government sanctions the Chairperson's leave; the Chairperson sanctions Members' leave. The Conduct Rules and disciplinary rules of the civil service apply, and there are no sitting fees or sumptuary allowances.
  - [s. Sixth Schedule: Terms and conditions of appointment and service of the Board's officers and employees](https://www.infofacility.com/laws/dpdp-rules-2025/sixth-schedule): In force from 13 Nov 2025. The Board staffs itself by deputation from the Central and State Governments, autonomous and statutory bodies and public sector enterprises for up to five years at a time, and may also take staff from the National Institute for Smart Government on market-linked pay. Gratuity, travel, medical assistance, leave, leave travel concession and conduct and discipline rules follow the Central Government's, with anything not covered referred to the Central Government for a final decision.
  - [s. Seventh Schedule: Purposes for which the Central Government may call for information, and who may ask](https://www.infofacility.com/laws/dpdp-rules-2025/seventh-schedule): Upcoming from 13 May 2027. Three purposes and the officer authorised for each. Use of personal data by the State in the interest of sovereignty and integrity of India or security of the State: an officer notified under s. 17(2)(a) of the Act and designated by the Central Government or the head of the instrumentality. Use of personal data by the State to perform a function or make a disclosure required by law: the person authorised under that law. Assessing whether to notify a Data Fiduciary as a Significant Data Fiduciary: an officer in MeitY designated by its Secretary.

## Frameworks

- [What is the CCPA?](https://www.infofacility.com/frameworks/ccpa): The California Consumer Privacy Act is California's privacy law, operative since 1 January 2020 and amended by the California Privacy Rights Act from 1 January 2023. It applies to for-profit businesses doing business in California that cross a revenue, volume or data-sale threshold, wherever they are based, and is enforced by the California Privacy Protection Agency and the Attorney General.
- [What is the GDPR?](https://www.infofacility.com/frameworks/gdpr): The General Data Protection Regulation is the European Union's data protection law, applied since 25 May 2018. It binds organisations established in the EU and those outside it, including Indian companies, that offer goods or services to people in the EU or monitor their behaviour. Fines reach EUR 20 million or 4 percent of worldwide turnover, whichever is higher.
- [What is ISO 27001?](https://www.infofacility.com/frameworks/iso-27001): ISO/IEC 27001:2022 is the international standard for an information security management system, or ISMS: the risk assessment, policies, controls, internal audit and management review an organisation runs to protect information. Published on 25 October 2022, it is certifiable, with a three-year certificate and annual surveillance audits, and its Annex A lists 93 reference controls in four themes.
- [What is ISO 27701?](https://www.infofacility.com/frameworks/iso-27701): ISO/IEC 27701 is the international standard for a privacy information management system, or PIMS: the governance, controls and records an organisation runs to handle personally identifiable information as a controller or processor. The second edition, published in October 2025, is an independent management system standard that can be certified on its own and is built to align with ISO/IEC 27001.
- [What is ISO 42001?](https://www.infofacility.com/frameworks/iso-42001): ISO/IEC 42001 is the international standard for an AI management system, or AIMS: the policies, roles, risk and impact assessments and controls an organisation runs to develop or use AI responsibly. Published in December 2023, it is certifiable like ISO 27001, with a three-year certificate and annual surveillance audits. Its Annex A lists 38 reference controls.
- [What is SOC 2?](https://www.infofacility.com/frameworks/soc-2): SOC 2 is an attestation report, not a certificate. A CPA firm examines a service organisation's controls against the AICPA's Trust Services Criteria for security and, optionally, availability, processing integrity, confidentiality and privacy, and issues an opinion. A Type 1 report covers control design at a point in time; a Type 2 report covers operating effectiveness over a period.

## Comparisons

- [CCPA vs DPDP](https://www.infofacility.com/compare/ccpa-vs-dpdp): The California Consumer Privacy Act as amended by the CPRA, and India's Digital Personal Data Protection Act, 2023 side by side, on the same criteria, with the Civil Code section or DPDP section behind every cell. Written for an Indian company that built its privacy programme for US customers on an opt-out model and is now being asked about consent at home, and for the reverse.
- [CERT-In vs DPDP breach rules](https://www.infofacility.com/compare/cert-in-vs-dpdp-breach-rules): India's two incident reporting regimes side by side: the CERT-In Directions of 28 Apr 2022 under the IT Act, and the personal data breach duty under s. 8(6) of the DPDP Act with Rule 7 of the DPDP Rules 2025. Written for a company that already reports to CERT-In and is working out what the DPDP clock adds, and for one that has built a DPDP playbook and forgotten the 6 hours.
- [GDPR vs DPDP](https://www.infofacility.com/compare/gdpr-vs-dpdp): The EU's General Data Protection Regulation and India's Digital Personal Data Protection Act, 2023 side by side, on the same criteria, with the article or section behind every cell. Written for a company that already does one and is being asked about the other.
- [ISO 27001 vs ISO 42001](https://www.infofacility.com/compare/iso-27001-vs-iso-42001): ISO/IEC 27001:2022 (information security) and ISO/IEC 42001:2023 (AI management) side by side, on the same criteria, with the clause or Annex A reference behind every cell. Written for a company that holds 27001 and is being asked about 42001 by a customer, or is deciding whether to extend one management system rather than build two.
- [SOC 2 vs ISO 27001](https://www.infofacility.com/compare/soc-2-vs-iso-27001): The AICPA's SOC 2 attestation report and the ISO/IEC 27001:2022 certification side by side, on the same criteria, with the Trust Services Criteria reference or clause behind every cell. Written for an Indian company that holds one and is being asked for the other, usually by a US customer or an Indian regulator.

## Products

- [DSAR, the rights request desk](https://www.infofacility.com/products/dsar): Answer every rights request inside its legal clock, whichever law it comes under. Access, correction, erasure and nomination requests in one queue, each on its own legal clock.
- [Consent and Preference Management](https://www.infofacility.com/products/consent-preference-management): Collect consent the law will accept, and let people take it back as easily as they gave it. Consent notices and records that meet DPDP Rule 3, Art. 7 GDPR and CCPA opt-outs, with withdrawal as easy as giving.
- [Cookie consent and privacy notices](https://www.infofacility.com/products/cookie-consent-privacy-notices): Ask for cookie consent properly, and keep your privacy notice true to what you do. A cookie and tracker banner that records consent per purpose, and privacy notices written from your data map.
- [Breach management](https://www.infofacility.com/products/breach-management): Run a breach from the first alert to the last notice, with all the clocks in one place. CERT-In's 6 hours, the 72 hours under DPDP and GDPR, and US state deadlines, in one workflow.
- [GRC workspace](https://www.infofacility.com/products/grc-workspace): Keep DPIAs, audits, vendors and deadlines in one place your auditor can read. DPIAs and audits, processor and vendor records, and a compliance calendar, in one place.
- [MCP server and API](https://www.infofacility.com/products/mcp-server-api): Give your AI agents the law as it is written, with the citation for every answer. The library served to AI agents and your own systems: sections, rules, terms and tracker entries, each with its citation.

## Services

- [VAPT and penetration testing](https://www.infofacility.com/services/vapt-penetration-testing): Security. Find what an attacker would find, and fix it before an auditor or a customer's security review does. Timeline: 2 to 4 weeks a test. Price on request.
- [Application security](https://www.infofacility.com/services/application-security): Security. Catch security flaws before they ship, without slowing your releases. Timeline: 4 to 8 weeks. Price on request.
- [Red teaming](https://www.infofacility.com/services/red-teaming): Security. See how far a determined attacker would get, and whether your team would notice. Timeline: 4 to 6 weeks. Price on request.
- [Network and cloud security review](https://www.infofacility.com/services/network-cloud-security-review): Security. Find and fix the weak points in your network and cloud configuration. Timeline: 2 to 3 weeks. Price on request.
- [Vulnerability assessment](https://www.infofacility.com/services/vulnerability-assessment): Security. Know which vulnerabilities you have this month, and which ones matter. Timeline: Monthly or quarterly. Price on request.
- [ISO 27001 certification support](https://www.infofacility.com/services/iso-27001-certification): GRC. Get ISO 27001 certified, with an information security management system your team can run after the audit. Timeline: 3 to 6 months. Price on request.
- [ISO 27701 privacy management](https://www.infofacility.com/services/iso-27701-privacy): GRC. Certify how you handle personal data, with each control mapped to DPDP and GDPR. Timeline: 2 to 4 months. Price on request.
- [ISO 42001 AI management system](https://www.infofacility.com/services/iso-42001-ai-management): GRC. Get your AI management certified to ISO 42001, so customers and regulators can see how your AI is governed. Timeline: 3 to 6 months. Price on request.
- [SOC 2 Type 2 readiness](https://www.infofacility.com/services/soc-2-type-2-readiness): GRC. Prepare for a SOC 2 Type 2 audit and get a report your enterprise customers will accept. Timeline: 8 to 12 weeks, then the observation period. Price on request.
- [DPDP readiness and implementation](https://www.infofacility.com/services/dpdp-readiness): GRC. Be ready for 13 May 2027, when every DPDP duty applies. Timeline: 6 to 12 weeks. Price on request.
- [GDPR and CCPA compliance](https://www.infofacility.com/services/gdpr-ccpa-compliance): GRC. Sell into the EU and California without privacy holding up the deal. Timeline: 6 to 10 weeks. Price on request.
- [EU AI Act compliance](https://www.infofacility.com/services/eu-ai-act-compliance): GRC. Know which of your AI systems the EU AI Act touches, and what each one needs. Timeline: 6 to 12 weeks. Price on request.
- [BRSR and ESG reporting](https://www.infofacility.com/services/brsr-esg-reporting): GRC. File BRSR and BRSR Core disclosures that stand up to assessment or assurance. Timeline: 8 to 12 weeks. Price on request.
- [Fractional DPO and vCISO](https://www.infofacility.com/services/fractional-dpo-vciso): GRC. Have a named person own privacy or security, without a full-time hire. Timeline: Monthly. Price on request.
- [Security and privacy training](https://www.infofacility.com/services/security-privacy-training): GRC. Give each person the training their role needs, with records an auditor can check. Timeline: Half a day to two days. Price on request.

## Tools

- [Breach notification clock](https://www.infofacility.com/tools/breach-notification-clock): every breach reporting deadline that applies to a company (DPDP, CERT-In, SEBI CSCRF, RBI, GDPR, US states) from the moment it becomes aware, with the clause that sets each one.
- DPDP penalty exposure calculator (Planned, for businesses): Which Schedule penalties your gaps expose you to, item by item, up to Rs 250 crore.
- DPDP readiness check (Planned, for businesses): A short check that scores your readiness and names the section behind each gap.
- Am I a Significant Data Fiduciary? (Planned, for businesses): The factors in s. 10(1), as questions, with what follows if the answer is yes.
- BRSR Core readiness check (Planned, for businesses): Where your BRSR Core disclosures stand against the assessment or assurance your company now needs.
- SOC 2 or ISO 27001? (Planned, for businesses): Which one your customers will accept, what each takes, and when to do both.
- Compliance calendar feed (Planned, for businesses): Every DPDP, CERT-In, SEBI and RBI date in a calendar feed you can subscribe to.
- Know your rights (Planned, for everyone): What you can ask a company to do with your data under DPDP, GDPR and CCPA, and how long it has to answer.
- Rights request letter (Planned, for everyone): Write a request to any company to see, correct or erase your data, citing the law that applies.
- Was I told about a breach correctly? (Planned, for everyone): Check the breach notice you received against what the law says it must contain.

## Tracker

- [India regulatory tracker](https://www.infofacility.com/tracker): 22 dated entries from MeitY, the Data Protection Board, CERT-In, SEBI, RBI and IRDAI, each linking to the document.
  - 13 May 2027 · MeitY · DPDP Act and Rules: every remaining provision comes into force: Notice, consent, security safeguards, breach intimation, retention and erasure, children's data, Significant Data Fiduciary duties, Data Principal rights, appeals and the Schedule's penalties (up to Rs 250 crore) become enforceable eighteen months after the Rules were notified. (Upcoming)
  - around 31 Mar 2027 · SEBI · BRSR Core assessment or assurance reaches the top 1,000 listed entities (FY 2026-27): The last step of the glide path set on 12 Jul 2023: the top 1,000 listed entities by market capitalisation must have their BRSR Core for FY 2026-27 assessed or assured, and assessment or assurance of value chain disclosures becomes voluntary from the same year. (Upcoming)
  - around 13 Nov 2026 · DPB · Rule 4 of the DPDP Rules 2025 and s. 6(9) of the Act take effect: Consent Manager registration opens: One year after the Rules, companies that want to act as Consent Managers can apply to the Board under Rule 4 and the First Schedule; they must be companies incorporated in India with a net worth of at least Rs 2 crore and meet the Schedule's conditions on independence and interoperability. (Upcoming)
  - 4 Nov 2026 · CERT-In · Artificial Intelligence (AI) Security Auditing Guidelines (CISG-2026-04): CERT-In's guidance on auditing the security of AI systems, issued as a guideline rather than a Direction under s. 70B(6); expect CERT-In empanelled auditors and sector regulators to draw on it, and read it alongside ISO/IEC 42001. (Voluntary)
  - 6 May 2026 · DPB · Appointment to the posts of Chairperson and other Members in the Data Protection Board of India (F. No. 2(1)/2026-Pers.I): MeitY invites applications for the Board's Chairperson and four Members, at least one with legal expertise; the Board, established on 13 Nov 2025, needs them in place before it can hear complaints or impose penalties. (Upcoming)
  - 26 Feb 2026 · CERT-In · Cyber Security Framework and Guidelines for Space including Satellite Communication (CISG-2026-01): Advisory guidelines, released with SIA-India, for satellite operators, ground stations, equipment vendors and space enterprises; not a Direction under s. 70B(6), so they bind you only where a regulator or a contract adopts them. (Voluntary)
  - 10 Dec 2025 · MeitY · Corrigenda to the Digital Personal Data Protection Rules, 2025 (G.S.R. 892(E)): Eight typographical corrections to G.S.R. 846(E), including the clause reference "(a) to (g)" on page 38; nothing substantive changes, but quote the Rules from the corrected text. (In force)
  - 13 Nov 2025 · MeitY · Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E)): The Rules that make the Act work, in three phases: Rules 1, 2 and 17 to 21 (the Board) at once, Rule 4 (Consent Managers) one year later, and Rules 3, 5 to 16, 22 and 23 (notice, security safeguards, breach intimation within 72 hours, retention, children, Significant Data Fiduciaries, rights, appeals) eighteen months later, on 13 May 2027. (In force)
  - 13 Nov 2025 · MeitY · Commencement of provisions of the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)): Brings the Board provisions (ss. 18 to 26), the definitions and the rule-making powers into force at once; s. 6(9), on Consent Manager registration, after one year; and the operative duties, rights and penalties (ss. 3 to 17 and 27 to 34 among them) after eighteen months, on 13 May 2027. (In force)
  - 13 Nov 2025 · DPB · Establishment of the Data Protection Board of India (G.S.R. 844(E)): The Central Government establishes the Board under s. 18, with its head office in the National Capital Region; a companion notification, G.S.R. 845(E), fixes four Members. The Chairperson and Members are appointed separately; MeitY called for applications on 6 May 2026. (In force)
  - 31 Aug 2025 · SEBI · CSCRF compliance deadline for SEBI regulated entities (extended by SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2025/96): The last extension, by two months from 30 Jun 2025, for all REs except MIIs, KRAs and QRTAs; from this date your cyber audits by CERT-In empanelled auditors run on the CSCRF calendar and the first audit cycle has closed. (Deadline)
  - 28 Aug 2025 · SEBI · Technical Clarifications to Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities (REs) (SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2025/119): CSCRF scope is limited to systems used exclusively for SEBI-regulated activity, controls equivalent to another regulator's framework count as compliance, mobile app security and ISO 27001 certification become recommendatory, VAPT reports are submitted as summaries, portfolio managers are re-categorised by AUM, and REs must follow CERT-In's cyber security audit policy guidelines. (In force)

## Glossary

- [AI management system (AIMS)](https://www.infofacility.com/glossary/aims): ISO/IEC 42001:2023 · clause 4.4. The policies, roles, processes and controls through which an organisation governs its development or use of AI systems, built on the same clause structure as ISO/IEC 27001 and certifiable against ISO/IEC 42001, published in December 2023. It covers AI-specific risks (bias, transparency, safety, accountability) alongside security, and expects you to assess impacts on individuals and society as well as on the organisation. It is the only certifiable AI governance standard, and the main route companies use to show EU AI Act readiness.
- [AI policy](https://www.infofacility.com/glossary/ai-policy): ISO/IEC 42001:2023 · clause 5.2, control A.2.2. The top-management statement that sets the organisation's direction for AI: which principles it commits to, what it will and will not build or use, how it handles risk, and who is accountable. Clause 5.2 requires the policy to fit the organisation's purpose, give a framework for AI objectives, commit to meeting requirements and to continual improvement, and be communicated; Annex A control A.2.2 repeats the requirement and A.2.3 adds alignment with other policies. Auditors expect it to be approved, dated and traceable to the controls you operate.
- [AI risk assessment](https://www.infofacility.com/glossary/ai-risk-assessment): ISO/IEC 42001:2023 · clause 6.1.2. The process of identifying, analysing and evaluating the risks that AI systems pose to your organisation's objectives, so that you can decide which to treat. Clause 6.1.2 requires defined criteria, repeatable results and identified risk owners; clause 6.1.3 then requires a risk treatment plan drawing on the Annex A controls. Annex C lists AI-specific risk sources, such as data quality, lack of transparency and automation bias, to help you be systematic.
- [AI system impact assessment](https://www.infofacility.com/glossary/ai-system-impact-assessment): ISO/IEC 42001:2023 · clauses 6.1.4 and 8.4, control A.5. A documented assessment of the consequences an AI system may have for individuals, groups and society: fairness, safety, privacy, livelihoods, the environment. Clause 6.1.4 requires you to define a process for it and clause 8.4 to run it at planned intervals and when a significant change is proposed; Annex A objective A.5 adds the controls. It differs from an AI risk assessment, which looks at risk to the organisation, and overlaps with a Data Protection Impact Assessment under DPDP s. 10(2)(c) and GDPR Art. 35 where personal data is involved.
- [Annex A (ISO 27001)](https://www.infofacility.com/glossary/annex-a): ISO/IEC 27001:2022 · Annex A. The normative list of 93 reference information security controls in ISO/IEC 27001:2022, grouped into four themes: organisational (37), people (8), physical (14) and technological (34). You do not have to implement all of them; you compare your risk treatment against the list to check nothing is missing and record the result in the Statement of Applicability. ISO/IEC 27002:2022 gives implementation guidance for each control.
- [Annex A (ISO 42001)](https://www.infofacility.com/glossary/annex-a-iso-42001): ISO/IEC 42001:2023 · Annex A. The normative list of 38 AI-specific reference controls in ISO/IEC 42001:2023, under nine objectives from A.2 to A.10: policies related to AI, internal organisation, resources for AI systems, assessing impacts, the AI system life cycle, data for AI systems, information for interested parties, use of AI systems, and third-party and customer relationships. As with ISO 27001 you select controls from the list through risk treatment and justify exclusions in a Statement of Applicability. Annex B gives implementation guidance for each control.
- [Appellate Tribunal (TDSAT)](https://www.infofacility.com/glossary/appellate-tribunal): DPDP Act 2023 · s. 2(a), s. 29. The Telecom Disputes Settlement and Appellate Tribunal, which hears appeals against the Data Protection Board's orders and directions. You have 60 days to appeal (s. 29(2)), and the Tribunal is to work as a digital office as far as practicable. Rule 22 of the DPDP Rules 2025 sets the procedure and takes effect on 13 May 2027, with the rest of the Act's enforcement provisions.
- [Assessment or assurance (BRSR Core)](https://www.infofacility.com/glossary/assessment-or-assurance): SEBI · circular SEBI/HO/CFD/CFD-PoD-1/P/CIR/2025/42, 28 Mar 2025. The choice SEBI gave listed entities on 28 Mar 2025 for independent verification of BRSR Core: "assurance", an engagement by a professional under assurance standards, or "assessment", a third-party check under the standards the Industry Standards Forum developed with SEBI. Before this circular, reasonable assurance was mandatory. The same circular made value chain ESG disclosures voluntary for the top 250 entities from FY 2025-26 and their assessment or assurance voluntary from FY 2026-27; the glide path to the top 1,000 in FY 2026-27 is unchanged.
- [Bridge letter](https://www.infofacility.com/glossary/bridge-letter): AICPA · SOC 2 reporting practice (not a defined term). A short letter from the service organisation, not the auditor, covering the gap between the end of the last SOC 2 Type 2 period and the date a customer needs assurance for. It states whether the controls described in the report have changed materially and whether management knows of any failures since. It is not audited, so treat it as management's representation; most buyers accept one for a gap of up to about three months.
- [BRSR](https://www.infofacility.com/glossary/brsr): SEBI LODR Regulations 2015 · Reg. 34(2)(f); circular SEBI/HO/CFD/CMD-2/P/CIR/2021/562, 10 May 2021. The Business Responsibility and Sustainability Report, the ESG disclosure that the top 1,000 listed entities by market capitalisation must file with their annual report, mandatory from FY 2022-23 after a voluntary year. It is structured on the nine principles of the National Guidelines on Responsible Business Conduct, with essential indicators every filer answers and leadership indicators that are voluntary. It replaced the older Business Responsibility Report.
- [BRSR Core](https://www.infofacility.com/glossary/brsr-core): SEBI · circular SEBI/HO/CFD/CFD-SEC-2/P/CIR/2023/122, 12 Jul 2023. A subset of the BRSR: key performance indicators under nine ESG attributes (greenhouse gas footprint, water footprint, energy footprint, circularity and waste, employee well-being and safety, gender diversity, inclusive development, fairness to customers and suppliers, and openness of business) that must be independently verified. The 12 Jul 2023 circular set a glide path by market capitalisation: the top 150 listed entities in FY 2023-24, 250 in FY 2024-25, 500 in FY 2025-26 and 1,000 in FY 2026-27. It originally required reasonable assurance; since 28 Mar 2025 you may choose assessment or assurance.
- [CERT-In Directions 2022](https://www.infofacility.com/glossary/cert-in-directions-2022): CERT-In · Directions No. 20(3)/2022-CERT-In under s. 70B(6) of the IT Act 2000. The binding directions CERT-In issued on 28 Apr 2022 to all service providers, intermediaries, data centres, body corporates and government organisations, effective 60 days after issue. They require you to report the cyber security incidents listed in Annexure I to CERT-In within 6 hours of noticing them, keep logs of all ICT systems for a rolling 180 days within India, synchronise system clocks to the NIC or NPL time servers, and designate a point of contact; data centre, VPS, cloud and VPN providers must also keep validated customer records for five years. Non-compliance is punishable under s. 70B(7) of the IT Act with imprisonment of up to one year, a fine, or both.
- [Certain legitimate uses](https://www.infofacility.com/glossary/certain-legitimate-uses): DPDP Act 2023 · s. 2(d), s. 7. The grounds on which a Data Fiduciary may process personal data without consent: a purpose for which you volunteered the data and have not objected, state functions and benefits, legal obligations and court orders, medical emergencies and epidemics, disaster response, and employment-related purposes, among those listed in s. 7. Together with consent (s. 6) they are the only two lawful bases under the Act (s. 4). There is no general "legitimate interests" ground.
- [Child (DPDP)](https://www.infofacility.com/glossary/child-dpdp): DPDP Act 2023 · s. 2(f). An individual who has not completed eighteen years of age. The threshold is higher than GDPR's 16, which member states may lower to 13, and the CCPA's 13 and 16. For a child you need verifiable parental consent, must not process data in a way likely to harm the child's well-being, and must not track, monitor behaviour or target advertising (s. 9), subject to the exemptions in Rule 12 and the Fourth Schedule of the DPDP Rules 2025 for purposes such as health care and education.
- [Complementary user entity controls](https://www.infofacility.com/glossary/complementary-user-entity-controls): AICPA DC section 200 · description criteria. Controls that a service organisation assumes its customers (user entities) will operate for the Trust Services Criteria to be met, listed in the system description. Typical examples: managing your own user accounts in the vendor's product, reviewing access reports, and telling the vendor when staff leave. When you read a vendor's SOC 2, check this list, because the auditor's opinion assumes you are doing these things; the sibling term, complementary subservice organisation controls, covers the vendor's own suppliers.
- [Consent (s. 6)](https://www.infofacility.com/glossary/consent): DPDP Act 2023 · s. 6. Your agreement to processing for a specified purpose, which must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the personal data necessary for that purpose. You can withdraw it as easily as you gave it (s. 6(4)); withdrawal does not undo processing already done, but the fiduciary must stop within a reasonable time and make its processors stop too (s. 6(6)). Any part of a consent that infringes the Act or another law is invalid to that extent (s. 6(2)).
- [Consent Manager](https://www.infofacility.com/glossary/consent-manager): DPDP Act 2023 · s. 2(g), s. 6(7) to (9). A company registered with the Data Protection Board that gives you one place to give, manage, review and withdraw consent across many Data Fiduciaries, through an accessible, transparent and interoperable platform. It acts on your behalf and is accountable to you (s. 6(8)). Rule 4 and the First Schedule of the DPDP Rules 2025 set the registration conditions, which include being a company incorporated in India with a net worth of at least Rs 2 crore; Rule 4 takes effect one year after the Rules, around 13 Nov 2026.
- [Cyber security incident (CERT-In)](https://www.infofacility.com/glossary/cyber-security-incident): CERT-In Rules 2013 · Rule 2(1)(h); CERT-In Directions 2022 · Annexure I. Any real or suspected adverse event in relation to cyber security that violates an applicable security policy and results in unauthorised access, denial of service or disruption, unauthorised use of a computer resource, or changes to data or information without authorisation. Annexure I of the 2022 Directions lists twenty types you must report to CERT-In within 6 hours, including data breaches and leaks, ransomware and other malware, website defacement, denial of service attacks, attacks on cloud, IoT and AI systems, and incidents affecting digital payments. It is wider than a personal data breach: an incident that touches no personal data still has to be reported.
- [Data Fiduciary](https://www.infofacility.com/glossary/data-fiduciary): DPDP Act 2023 · s. 2(i). The company or person who decides why and how personal data is processed. Under DPDP the Data Fiduciary carries the duties: notice, consent, security safeguards, breach reporting, erasure and answering people's requests. If a Data Processor does the work, the fiduciary still answers for it (s. 8(1)).
- [Data Principal](https://www.infofacility.com/glossary/data-principal): DPDP Act 2023 · s. 2(j). The individual the personal data is about. For a child, the term includes the parents or lawful guardian; for a person with a disability, their lawful guardian acting on their behalf. The Act gives you, as Data Principal, rights to information, correction and erasure, grievance redressal and nomination (ss. 11 to 14), and duties of your own, such as not filing false complaints (s. 15).
- [Data Processor](https://www.infofacility.com/glossary/data-processor): DPDP Act 2023 · s. 2(k). Anyone who processes personal data on behalf of a Data Fiduciary. A cloud host, a payroll vendor or an analytics provider is usually a Data Processor. The Act places its duties on the fiduciary, which may engage a processor only under a valid contract (s. 8(2)) and remains responsible for compliance whatever the contract says (s. 8(1)).
- [Data Protection Board of India](https://www.infofacility.com/glossary/data-protection-board-of-india): DPDP Act 2023 · s. 2(c), s. 18. The regulator the Act creates to receive breach intimations and complaints, inquire into them, direct remedial measures and impose the penalties in the Schedule, up to Rs 250 crore for a failure of security safeguards. It works as a digital office (s. 28) and its orders can be appealed to the Telecom Disputes Settlement and Appellate Tribunal (s. 29). The Central Government established it by notification G.S.R. 844(E) on 13 Nov 2025; MeitY invited applications for its Chairperson and Members on 6 May 2026.
- [Data Protection Officer](https://www.infofacility.com/glossary/data-protection-officer): DPDP Act 2023 · s. 2(l), s. 10(2)(a). The individual a Significant Data Fiduciary must appoint to represent it under the Act. The DPO must be based in India, be responsible to the board of directors or a similar governing body, and be the point of contact for the grievance redressal mechanism. Other Data Fiduciaries need not appoint a DPO, but every fiduciary must publish the contact details of a person who can answer questions about its processing (s. 8(9)).
- [Digital personal data](https://www.infofacility.com/glossary/digital-personal-data): DPDP Act 2023 · s. 2(n). Personal data in digital form. The Act applies to personal data collected digitally, and to personal data collected on paper and digitised later (s. 3(a)). Paper records that are never digitised fall outside it, as does data you process for a personal or domestic purpose and data a Data Principal has made publicly available themselves (s. 3(c)).
- [Exception (SOC 2)](https://www.infofacility.com/glossary/exception-soc-2): AICPA · SOC 2 guide, tests of controls (AT-C section 205). An instance where a control did not operate as described during the auditor's testing: a new joiner without an approved access request, a quarterly review done late. The auditor lists exceptions in Section 4 with management's response, and decides whether they are serious enough to qualify the opinion. A report with a few exceptions and a clean opinion is normal; read the exceptions, not just the opinion.
- [Grievance redressal](https://www.infofacility.com/glossary/grievance-redressal): DPDP Act 2023 · s. 13; s. 8(10). Your right to a readily available way to complain to a Data Fiduciary or Consent Manager about how it has handled your personal data or your rights. The fiduciary must set up an effective mechanism (s. 8(10)), publish how to reach it and respond within a stated time; the DPDP Rules 2025 cap that period at 90 days. You must exhaust this route before you complain to the Board (s. 13(3)), and a Significant Data Fiduciary's Data Protection Officer is the point of contact for it (s. 10(2)(a)).
- [High-risk AI system (EU AI Act)](https://www.infofacility.com/glossary/high-risk-ai-system): Regulation (EU) 2024/1689 · Art. 6, Annex III. Under the EU AI Act, an AI system that is either a safety component of a product covered by the EU product laws listed in Annex I, or is used in one of the areas listed in Annex III: biometrics, critical infrastructure, education, employment, access to essential services, law enforcement, migration, and the administration of justice. Providers must run a risk management system, data governance, documentation, logging, human oversight and a conformity assessment before placing it on the EU market; Indian companies that sell such systems into the EU are caught. After the Digital Omnibus on AI (Regulation (EU) 2026/1744, adopted 8 Jul 2026), the Annex III obligations apply from 2 Dec 2027 and the Annex I obligations from 2 Aug 2028.
- [Information security management system (ISMS)](https://www.infofacility.com/glossary/isms): ISO/IEC 27001:2022 · clause 4.4. The set of policies, processes, roles and controls through which an organisation manages information security risk as a continuing activity, not a one-off project. ISO/IEC 27001 is the standard an ISMS is certified against: clauses 4 to 10 set the management requirements and Annex A lists the reference controls. A certificate means an accredited body has audited the system; it does not mean the company cannot be breached.
- [Nomination (s. 14)](https://www.infofacility.com/glossary/nomination): DPDP Act 2023 · s. 14. Your right to name another individual who will exercise your rights under the Act if you die or become incapacitated. "Incapacity" means being unable to exercise your rights because of unsoundness of mind or infirmity of body (s. 14(2)). GDPR has no equivalent: it does not apply to the data of deceased persons at all (Recital 27).
- [Nonconformity](https://www.infofacility.com/glossary/nonconformity): ISO/IEC 27001:2022 · clause 10.2. A failure to meet a requirement of the standard, of your own management system, or of a legal obligation you have brought into scope. Clause 10.2 requires you to react, correct, find the root cause and check that the corrective action worked. Certification bodies grade findings as major (a breakdown that blocks certification until closed) or minor (an isolated lapse, closed through an agreed plan); an "opportunity for improvement" is not a nonconformity.
- [Notice (s. 5)](https://www.infofacility.com/glossary/notice): DPDP Act 2023 · s. 5; DPDP Rules 2025 · Rule 3. The information a Data Fiduciary must give you with, or before, every request for consent: the personal data it wants and the purpose, how you can exercise your rights and withdraw consent, and how to complain to the Board. Rule 3 of the DPDP Rules 2025 requires the notice to stand on its own, in clear and plain language, with an itemised description of the data and of the goods, services or uses it enables, and a link to the fiduciary's website or app. If you consented before the Act commenced, the fiduciary must still send you this notice as soon as reasonably practicable (s. 5(2)), in English or any language in the Eighth Schedule to the Constitution (s. 5(3)).
- [Personal data](https://www.infofacility.com/glossary/personal-data): DPDP Act 2023 · s. 2(t). Any data about an individual who can be identified by it or in relation to it. The test is identifiability, not sensitivity: a name, an email address, a device identifier or a combination of facts all count. The Act has no separate category of sensitive personal data; the same rules apply to all personal data in digital form.
- [Personal data breach](https://www.infofacility.com/glossary/personal-data-breach): DPDP Act 2023 · s. 2(u), s. 8(6). Any unauthorised processing of personal data, or an accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to it, that compromises its confidentiality, integrity or availability; a ransomware attack that only locks data counts. You must intimate the Board and each affected Data Principal (s. 8(6)); Rule 7 of the DPDP Rules 2025 requires both without delay and a fuller report to the Board within 72 hours, or a longer period the Board allows. The penalty for failing to notify is up to Rs 200 crore.
- [PII controller and PII processor](https://www.infofacility.com/glossary/pii-controller-and-pii-processor): ISO/IEC 29100:2024 · clause 3. The two roles the ISO privacy standards attach controls to. A PII controller decides why and how personally identifiable information is processed; a PII processor processes it on the controller's behalf and on its instructions. They map to Data Fiduciary and Data Processor under DPDP and to controller and processor under GDPR, but the standards only tell you which controls to implement; the legal duties come from the law that applies to you.
- [Privacy information management system (PIMS)](https://www.infofacility.com/glossary/pims): ISO/IEC 27701:2025 · clause 3.23. A management system for the processing of personally identifiable information, built on the same clause structure as an ISMS and certified against ISO/IEC 27701. The second edition, published in October 2025, made ISO/IEC 27701 a stand-alone standard, so you no longer need an ISO/IEC 27001 certificate to hold one; the 2019 edition was an extension to ISO/IEC 27001 and is withdrawn. Annex A sets controls for PII controllers and PII processors, Annex B gives implementation guidance, and Annex D maps the controls to the GDPR, which makes a PIMS a practical scaffold for DPDP duties too.
- [Processing](https://www.infofacility.com/glossary/processing): DPDP Act 2023 · s. 2(x). Any wholly or partly automated operation on digital personal data, from collection and storage through use, sharing and disclosure to erasure and destruction. Almost everything a business does with data is processing. A purely manual operation on paper is not, which is why the Act keys off digital form.
- [RBI IT governance directions 2023](https://www.infofacility.com/glossary/rbi-it-governance-directions-2023): RBI · Master Direction RBI/2023-24/107, DoS.CO.CSITEG/SEC.7/31.01.015/2023-24, 7 Nov 2023. The Reserve Bank of India (Information Technology Governance, Risk, Controls and Assurance Practices) Directions, 2023, in force from 1 Apr 2024 for commercial banks, NBFCs in the top, upper and middle layers, credit information companies and all-India financial institutions. They require a board-level IT Strategy Committee chaired by an independent director with IT expertise, a CISO who does not report to the head of IT, a risk-based information systems audit function, vulnerability assessments every six months and penetration tests every twelve months for critical systems, and half-yearly disaster recovery drills. Cyber incidents must be reported to RBI and to CERT-In as required; the separate Master Direction on Outsourcing of IT Services (10 Apr 2023) covers your vendors.
- [Right to erasure (DPDP)](https://www.infofacility.com/glossary/right-to-erasure): DPDP Act 2023 · s. 12; s. 8(7). Your right to have a Data Fiduciary erase personal data you consented to its processing, unless retention is necessary for the specified purpose or required by law (s. 12(3)). Separately, the fiduciary must erase data of its own accord once you withdraw consent or the purpose is no longer served (s. 8(7)); Rule 8 and the Third Schedule of the DPDP Rules 2025 deem the purpose served after three years without contact for large e-commerce, online gaming and social media platforms, with at least 48 hours' notice to you before erasure. Requests go through the fiduciary's published grievance channel and must be answered within the period it publishes, which the Rules cap at 90 days.
- [Risk treatment plan](https://www.infofacility.com/glossary/risk-treatment-plan): ISO/IEC 27001:2022 · clause 6.1.3 e), clause 8.3. The plan that says what you will do about each information security risk you have assessed, with owners and dates: modify it with controls, retain it, avoid it or share it. Clause 6.1.3 requires you to write the plan, have risk owners approve it and accept the residual risk; clause 8.3 requires you to carry it out and keep evidence. It is the bridge between the risk assessment and the Statement of Applicability.
- [SEBI CSCRF](https://www.infofacility.com/glossary/sebi-cscrf): SEBI · circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113, 20 Aug 2024. SEBI's Cybersecurity and Cyber Resilience Framework for all its regulated entities: stock exchanges and other market infrastructure institutions, brokers, depository participants, mutual funds, portfolio managers, registrars and the rest. It replaced the earlier sector-by-sector circulars with one graded framework (MIIs, Qualified, Mid-size, Small-size and Self-certification REs) built on the functions govern, identify, protect, detect, respond and recover, with periodic cyber audits by CERT-In empanelled auditors and a Cyber Capability Index for the largest entities. After extensions the compliance date for most REs was 31 Aug 2025; the technical clarifications of 28 Aug 2025 made some items recommendatory, including ISO 27001 certification, and let an RE rely on an equivalent framework of another regulator such as RBI.
- [Significant Data Fiduciary](https://www.infofacility.com/glossary/significant-data-fiduciary): DPDP Act 2023 · s. 2(z), s. 10. A Data Fiduciary, or a class of them, that the Central Government notifies under s. 10 after weighing the volume and sensitivity of the data it handles, the risk to Data Principals, and wider interests such as electoral democracy and the security of the State. A Significant Data Fiduciary must appoint a Data Protection Officer based in India, engage an independent data auditor, and carry out periodic Data Protection Impact Assessments and audits. Rule 13 of the DPDP Rules 2025 makes the assessment and audit annual and adds due diligence on algorithmic software; the penalty for breaching s. 10 is up to Rs 150 crore.
- [SOC 2](https://www.infofacility.com/glossary/soc-2): AICPA · SOC for Service Organizations: Trust Services Criteria. An attestation report, issued by a licensed CPA firm under AICPA standards, on a service organisation's controls relevant to security and, optionally, availability, processing integrity, confidentiality and privacy. It is not a certificate: the auditor gives an opinion on your system description and controls against the Trust Services Criteria, and you share the report with customers under NDA. Indian SaaS and IT services companies selling to US buyers meet it as a procurement requirement.
- [Stage 1 audit](https://www.infofacility.com/glossary/stage-1-audit): ISO/IEC 17021-1:2015 · clause 9.3.1.2. The first part of an initial certification audit, in which the certification body reviews your documented management system, scope, risk assessment, Statement of Applicability and internal audit results, and judges whether you are ready for Stage 2. It can be done remotely. The output is a list of areas of concern that could become nonconformities if you do not fix them before Stage 2.
- [Stage 2 audit](https://www.infofacility.com/glossary/stage-2-audit): ISO/IEC 17021-1:2015 · clause 9.3.1.3. The second part of the initial certification audit, in which auditors test that your management system is implemented and effective: they interview staff, sample records and check controls against the Statement of Applicability. Nonconformities found here must be closed, or have an accepted corrective action plan, before the certificate is issued. The certificate then runs for three years, with surveillance audits in between.
- [Statement of Applicability](https://www.infofacility.com/glossary/statement-of-applicability): ISO/IEC 27001:2022 · clause 6.1.3 d). The document that lists every Annex A control, says whether you have included or excluded it, justifies the choice, and records whether each included control is implemented. Auditors read it first, because it ties your risk treatment to the 93 reference controls and shows what the certificate covers. You can add controls from other sources, such as CERT-In or SEBI requirements, and list them alongside.
- [Surveillance audit](https://www.infofacility.com/glossary/surveillance-audit): ISO/IEC 17021-1:2015 · clause 9.6.2. The shorter audit a certification body carries out at least once a calendar year during the three-year certificate cycle to confirm the management system still works: internal audits, management review, handling of complaints and incidents, action on earlier nonconformities and a sample of controls. The first one must take place within twelve months of the certification decision. A recertification audit at the end of year three starts the cycle again.
- [System description](https://www.infofacility.com/glossary/system-description): AICPA DC section 200 · 2018 Description Criteria (revised implementation guidance 2022). Section 3 of a SOC 2 report, written by the service organisation's management, describing the system in scope: services, infrastructure, software, people, data and processes, the control environment, the controls that meet each criterion, subservice organisations, and the controls you expect customers to operate. The auditor gives an opinion on whether it is fairly presented against the AICPA's description criteria. It is where a reader learns what the report does and does not cover.
- [Trust Services Criteria](https://www.infofacility.com/glossary/trust-services-criteria): AICPA TSC · TSP section 100 (2017, revised points of focus 2022). The control criteria a SOC 2 report is written against, published by the AICPA's Assurance Services Executive Committee. There are five categories: security (the common criteria, CC1 to CC9, which every report includes), availability, processing integrity, confidentiality and privacy. Each criterion has points of focus that guide, but do not dictate, the controls you need; the 2022 revision updated the points of focus without changing the criteria.
- [Type 1 vs Type 2 report](https://www.infofacility.com/glossary/type-1-vs-type-2-report): AICPA · SOC 2 guide, AT-C section 205. A Type 1 report gives the auditor's opinion on whether your controls were suitably designed at a point in time. A Type 2 report adds an opinion on whether they operated effectively over a period, typically three to twelve months, and includes the tests performed and their results. Buyers ask for Type 2; a Type 1 is a first step when you have not yet run the controls long enough to test them.
- [Verifiable parental consent](https://www.infofacility.com/glossary/verifiable-parental-consent): DPDP Act 2023 · s. 9(1); DPDP Rules 2025 · Rule 10. The consent a Data Fiduciary must obtain from a parent or lawful guardian before processing a child's personal data, or that of a person with a disability who has a lawful guardian. "Verifiable" means you must check that the person consenting is an adult and is who they claim to be; Rule 10 of the DPDP Rules 2025 lets you rely on identity and age details you already hold, or on details or a virtual token issued by a body entrusted by law or by a Digital Locker service provider. Breaching s. 9 carries a penalty of up to Rs 200 crore.

## About

- [About, editorial policy and corrections](https://www.infofacility.com/about): who writes Infofacility, how pages are sourced and how to report an error (info@infofacility.com).