# DPDP Act Compliance Assessment Record

## Organisation Details

| Field | Value |
|-------|-------|
| Organisation Name | Zenith Global Enterprises India Pvt Ltd |
| CIN | U74999MH2015PTC123456 |
| Address | 10F, Peninsula Business Park, Senapati Bapat Marg, Lower Parel, Mumbai 400013 |
| Industry | International Logistics and Freight Forwarding |
| Assessment Date | 14 March 2026 |
| Grievance Officer | Rajesh Sharma, Head of Compliance — Mumbai |

## Processing Activity Register

| Activity ID | Description | Ground | Section | Data Categories | Retention |
|------------|-------------|--------|---------|-----------------|-----------|
| PAR-IN-001 | Customer freight services | Consent (Section 6) | Section 6 | Name, phone, email, address, shipping details | Contract + 8 years (Limitation Act) |
| PAR-IN-002 | Employee HR management | Legitimate use — employment | Section 7(f) | Name, Aadhaar (hashed), PAN, address, salary | Employment + 8 years |
| PAR-IN-003 | Marketing communications | Consent (Section 6) | Section 6 | Name, email, company, industry | Until consent withdrawal |
| PAR-IN-004 | Tax compliance | Legitimate use — legal obligation | Section 7(c) | Name, PAN, transaction records | 8 years (Income Tax Act) |
| PAR-IN-005 | Customs clearance | Legitimate use — legal obligation | Section 7(c) | Name, passport, customs ID, shipment details | 5 years (Customs Act) |

## Consent Manager Integration

| Element | Detail |
|---------|--------|
| Consent Manager | DigiConsent India Pvt Ltd (Registration No. CM-2025-001) |
| Integration Status | Live — API integration with customer portal and HRMS |
| Dashboard URL | zenithglobal.in/privacy-dashboard |
| Languages Supported | English, Hindi |
| Monthly Consent Transactions | ~50,000 |
| Consent Record Retention | 7 years per draft DPDP Rules |

## SDF Assessment

| Criterion | Assessment | Score |
|-----------|-----------|-------|
| Volume of data principals | 500,000+ in India | Medium-High |
| Sensitivity of data | Financial data, identity documents | Medium |
| Risk to data principal rights | Moderate (logistics, not profiling) | Medium |
| Sovereignty / security impact | Low (commercial operations) | Low |
| Overall SDF designation likelihood | Medium — monitoring notifications | — |

## Data Principal Rights Log

| Request ID | Date | Type | Data Principal | Deadline | Status |
|-----------|------|------|---------------|----------|--------|
| DPR-IN-2026-001 | 10 Jan 2026 | Access (S.11) | Priya Sharma | 9 Feb 2026 | Completed |
| DPR-IN-2026-002 | 25 Jan 2026 | Erasure (S.12) | Amit Patel | 24 Feb 2026 | Completed |
| DPR-IN-2026-003 | 15 Feb 2026 | Correction (S.12) | Sneha Reddy | 17 Mar 2026 | Completed |
| DPR-IN-2026-004 | 5 Mar 2026 | Access (S.11) | Vikram Singh | 4 Apr 2026 | In progress |

## Cross-Border Transfer Register

| Transfer Flow | Destination | Restricted? | Sectoral Restriction | Status |
|---------------|-------------|-------------|---------------------|--------|
| Customer data → EU HQ | Germany | No | None | Active |
| Employee data → Regional HR | Singapore | No | None | Active |
| Payment data → Global Treasury | UK | No | RBI localisation for payment system data | Active with localisation |
| Logistics data → APAC | Japan | No | None | Active |

## Compliance Checklist

| Requirement | Section | Status | Evidence |
|------------|---------|--------|----------|
| Notice provided before consent | Section 5 | Compliant | Privacy notice in English and Hindi |
| Consent mechanism (free, specific, informed) | Section 6 | Compliant | Consent management platform |
| Consent Manager integration | Section 6(7) | Compliant | DigiConsent India API live |
| Legitimate use documented for non-consent processing | Section 7 | Compliant | Processing register |
| Reasonable security safeguards | Section 8(4) | Compliant | ISO 27001 certified; IS 17428 aligned |
| Data processor contracts | Section 8(2) | Compliant | Written contracts with all processors |
| Breach notification procedure | Section 8(6) | Compliant | 72-hour notification workflow |
| Children's data protections | Section 9 | Compliant | No children's data processed |
| Grievance officer designated | Section 13 | Compliant | Rajesh Sharma appointed |
| Data retention and deletion | Section 8(7) | Compliant | Automated lifecycle management |