DPDP, AI & Cyber Governance: Batch 08 Action Guides

10 distinct application pages. The established Finin2min hub remains the canonical source/law layer.

AI Customer Support Bot Exposes Another User’s Data: Incident, Containment and Notification Workflow

For **AI Customer Support Bot Exposes Another User’s Data**, first fix **data/purpose inventory** and the governing date. Reconcile **vendor/model access** to the **notice/consent record**, then complete the operational step only when **retention/deletion** and the evidence agree. If the source is a draft, consultation or strategy report, do not convert it into an operative legal requirement.

P1 — high-intent workflow

Employee Uses Personal Email to Send Customer Data: Data-Leak and Disciplinary Control Checklist

For **Employee Uses Personal Email to Send Customer Data**, first fix **notice/consent/basis** and the governing date. Reconcile **security/incident response** to the **vendor/DPA/model terms**, then complete the operational step only when **rights/governance evidence** and the evidence agree. If the source is a draft, consultation or strategy report, do not convert it into an operative legal requirement.

P1 — high-intent workflow

Vendor Retains Personal Data After Contract Ends: Deletion Evidence and Processor Exit Workflow

For **Vendor Retains Personal Data After Contract Ends**, first fix **vendor/model access** and the governing date. Reconcile **retention/deletion** to the **security/log evidence**, then complete the operational step only when **data/purpose inventory** and the evidence agree. If the source is a draft, consultation or strategy report, do not convert it into an operative legal requirement.

P1 — high-intent workflow

Customer Withdraws Consent but Marketing Continues: System Suppression and Audit-Trail Checklist

For **Customer Withdraws Consent but Marketing Continues**, first fix **security/incident response** and the governing date. Reconcile **rights/governance evidence** to the **retention/deletion proof**, then complete the operational step only when **notice/consent/basis** and the evidence agree. If the source is a draft, consultation or strategy report, do not convert it into an operative legal requirement.

P1 — high-intent workflow

AI Model Trained on Internal Documents with Personal Data: Purpose, Access and Retention Review

For **AI Model Trained on Internal Documents with Personal Data**, first fix **retention/deletion** and the governing date. Reconcile **data/purpose inventory** to the **incident/rights response file**, then complete the operational step only when **vendor/model access** and the evidence agree. If the source is a draft, consultation or strategy report, do not convert it into an operative legal requirement.

P1 — high-intent workflow

Cloud Backup Contains Data Past Retention Period: Deletion, Legal Hold and Recovery Controls

For **Cloud Backup Contains Data Past Retention Period**, first fix **rights/governance evidence** and the governing date. Reconcile **notice/consent/basis** to the **data-flow map**, then complete the operational step only when **security/incident response** and the evidence agree. If the source is a draft, consultation or strategy report, do not convert it into an operative legal requirement.

P1 — high-intent workflow

Company Records Customer Calls Without Clear Notice: Consent, Evidence and Retention Workflow

For **Company Records Customer Calls Without Clear Notice**, first fix **data/purpose inventory** and the governing date. Reconcile **vendor/model access** to the **notice/consent record**, then complete the operational step only when **retention/deletion** and the evidence agree. If the source is a draft, consultation or strategy report, do not convert it into an operative legal requirement.

P1 — high-intent workflow

Data Subject Access Request Covers Multiple Systems: Search, Redaction and Response Checklist

For **Data Subject Access Request Covers Multiple Systems**, first fix **notice/consent/basis** and the governing date. Reconcile **security/incident response** to the **vendor/DPA/model terms**, then complete the operational step only when **rights/governance evidence** and the evidence agree. If the source is a draft, consultation or strategy report, do not convert it into an operative legal requirement.

P1 — high-intent workflow

Cyber Incident Changes Accounting Master Data: Finance-System Integrity and Recovery Review

For **Cyber Incident Changes Accounting Master Data**, first fix **vendor/model access** and the governing date. Reconcile **retention/deletion** to the **security/log evidence**, then complete the operational step only when **data/purpose inventory** and the evidence agree. If the source is a draft, consultation or strategy report, do not convert it into an operative legal requirement.

P1 — high-intent workflow

Deepfake Vendor Invoice Leads to Payment Fraud: Treasury, Bank and Cyber Evidence Workflow

For **Deepfake Vendor Invoice Leads to Payment Fraud**, first fix **security/incident response** and the governing date. Reconcile **rights/governance evidence** to the **retention/deletion proof**, then complete the operational step only when **notice/consent/basis** and the evidence agree. If the source is a draft, consultation or strategy report, do not convert it into an operative legal requirement.

P1 — high-intent workflow