Data protection (DPDP Act 2023)

Compliance register: every data asset is classified (Public / Internal / Confidential / Restricted) with a lawful basis and retention period — personal-data assets by the DPO. Data principals can withdraw consent; the DPO confirms processing has stopped.

DPDP Act 2023 register: DPO classifies personal-data assets. Workflow: “Data Asset Classification”.

You are acting as librarian. Allowed roles: data_steward, dpo, it_director, admin — switch user in the header.

Withdraw consent

Data principal withdraws consent; DPO confirms processing stopped. Workflow: “Consent Withdrawal”.

Compliance register

2 asset(s) are waiting for classification — use “Start classification”.

Id	Asset	System	Personal data	Class	Lawful basis	Retention	Status
3	CCTV footage — library	CCTV NVR	Images of visitors	—	—	—	pending
4	Alumni contact list	Alumni portal	Name, email, phone, employer	—	—	—	pending
1	Student master records	Student ERP	Name, DOB, contact, Aadhaar (masked), photo	Restricted	Legitimate use (education)	84 mo	classified
2	Library circulation log	NewLMS	Member id, borrowing history	Confidential	Legitimate use (education)	36 mo	classified
5	Library opening hours & notices	Website	no	Public	Not applicable	—	classified

Consents

Member	Purpose	Status	Recorded	Withdrawn	Case
Neha Kapoor (200150)	Library notifications by SMS/email	granted	15 Oct 2026	—	—
Asha Verma (210101)	Library notifications by SMS/email	granted	15 Oct 2026	—	—
Rahul Nair (210102)	Library notifications by SMS/email	granted	15 Oct 2026	—	—
Sneha Iyer (210103)	Library notifications by SMS/email	granted	15 Oct 2026	—	—
Sneha Iyer (210103)	Share reading history for recommendations	withdrawn	15 Oct 2026	10 Oct 2026	—