SCENARIO M05 · PROCESSORS & EVIDENCE
A third-party appointment provider is added overnight. What should the team review?
IN PLAIN ENGLISH
Why you are seeing this step
This field note uses one realistic decision to separate the official source, an editorial interpretation, a practical option, evidence to keep, and any uncertainty that still depends on your facts.
Educational only, not legal advice. Source status is dated 13 May 2027; inspect the official links below before relying on it.
BEST NEXT STEP
The valid contract, safeguards and operating instructions, supported by an updated inventory.
Record the provider’s role, access, purpose, safeguards and instructions before routine use expands.
WHY THE OTHER INSTINCTS MISS
The valid contract, safeguards and operating instructions, supported by an updated inventory.
Correct. The contract and safeguards are legal requirements when operative; the inventory is evidence of how the relationship works.
Only the provider’s sales-page security badges.
Badges do not establish the contract, actual safeguards or processing instructions.
Nothing until a breach occurs.
Processor oversight and safeguards are preventive obligations, not only incident responses.
BUILD THIS EVIDENCE
Signed contract, security schedule, instruction record, data-flow update and approval.
This artefact supports review. It does not certify compliance or replace advice on your facts.
- Guidance type
- legal requirement
- Pinpoint
- Act s. 8(1)–(2), 8(5); Rule 6(1)(f); G.S.R. 843(E) and 846(E)
- Reviewed
- 2026-08-30
- Change note
- Status and pinpoint reviewed against the official Act, final Rules, commencement notification and corrigendum for this educational website.
OFFICIAL SOURCE TRAIL
Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) ↗
Definitions and specified machinery provisions are operative; most substantive duties and rights are notified for later commencement. Check each scenario's status record.
Act s. 1(2); provision-specific section pinpointsDigital Personal Data Protection Rules, 2025 (G.S.R. 846(E)) ↗
Final Rules with phased commencement. Scenario pinpoints identify the particular Rule being taught.
Rule 1(2)–(4), read with the corrigendumDPDP Act commencement notification G.S.R. 843(E) ↗
Appoints immediate, one-year and eighteen-month commencement cohorts for the Act.
G.S.R. 843(E), clauses (a)–(c)