RequirementPreview contractOwning surfacePrimary gateAcceptance evidence
PRV-001PRVData classification and purpose registerCONFIGURATIONsettingsGate 23G03-COV-PRV-001PRV-002PRVTenant/platform Data Fiduciary/Data Processor role model and contractsCONFIGURATIONsettingsGate 23G03-COV-PRV-002PRV-003PRVVersioned notice, consent where applicable, withdrawal, and communication preference evidenceCONFIGURATIONsettingsGate 23G03-COV-PRV-003PRV-004PRVData minimisation including no default Aadhaar/raw biometrics/full offline cacheCONFIGURATIONsettingsGate 23G03-COV-PRV-004PRV-005PRVAccess/correction/update/erasure/grievance workflow with identity verificationCONFIGURATIONsettingsGate 23G03-COV-PRV-005PRV-006PRVPurpose-specific effective-dated retention matrix and legal holdCONFIGURATIONsettingsGate 23G03-COV-PRV-006PRV-007PRVProcessor/subprocessor/region/sharing registerCONFIGURATIONsettingsGate 23G03-COV-PRV-007PRV-008PRVPersonal-data breach record and effective-dated Board/Data Principal notificationCONFIGURATIONsettingsGate 23G03-COV-PRV-008PRV-009PRVLegal-record-preserving restriction/masking/anonymisation instead of unlawful erasureCONFIGURATIONsettingsGate 23G03-COV-PRV-009PRV-010PRVPrivacy request, decision, response, and audit traceabilityCONFIGURATIONsettingsGate 23G03-COV-PRV-010