Compliance track · 3 min
DPDP: who is who in your identity data
Fiduciary, principal and the consent record that ties them.
The idea
1Two main roles
The Data Principal is the person the data is about. The Data Fiduciary decides why and how it is processed.
2Your employees are Data Principals
For workforce identity, your employer is usually the Data Fiduciary and each employee a Data Principal.
3Consent is one ground, with a record
Where you rely on consent, keep what was agreed, when, and how to withdraw. AuthMantra includes consent records.
4Routines, not a badge
Grievances, data export and erasure need an owner. AuthMantra provides tools; your counsel decides how the Act applies.
Try it
Build a consent record
Tick what the record holds. See what is missing.
This exercise needs JavaScript. Here is the answer key.
- Purpose in one sentence: A plain statement of what the data is used for
- Which data: The fields covered, such as work email and phone
- Wording shown: The exact text the person saw
- Notice version: Which version of the notice applied
- Time of agreement: When, to the second
- How to withdraw: The route, as easy as agreeing
- Withdrawal time: Recorded if the person withdraws
Check yourself
1 of 3 Who is the Data Principal?
2 of 3 A consent record is useful because
3 of 3 Who decides how the Act applies to you?
Answer key
- Who is the Data Principal? The person the data is about. For workforce data, the employee or contractor.
- A consent record is useful because It shows what was agreed, and when. It is evidence you can inspect.
- Who decides how the Act applies to you? Your compliance counsel. Tools produce evidence. Counsel interprets the law.
Go deeper
Field notes
Runbooks
DPDP readiness checklist for employee identity dataRunbookBlueprints
Audit & DPDP evidenceBlueprintLexicon