Eighteen questions, eight domains, a prioritised list of gaps. Nothing leaves your browser.
Begin the assessmentNotice, consent, Data Fiduciary duties, SDF obligations and breach intimation, explained.
Open the guideWe scope against the laws that actually apply to you, then sequence the work by risk.
Start the assessmentAnswer 18 questions and get a prioritised control roadmap instantly.
Start the assessmentTrack 01 assumes no prior knowledge of governance, risk and compliance.
Start Track 01A moderated question board and an expert network of privacy lawyers, auditors and security engineers, across every jurisdiction we cover. Bring a question, or bring your expertise.
Under India’s DPDP Act 2023, a Data Protection Officer is mandatory only for a Significant Data Fiduciary (section 10). Every other Data Fiduciary must still publish the business contact of a person who can answer questions about its processing (section 8(9)).
Under the GDPR, Article 37 requires a DPO for public authorities, or where your core activities involve large-scale, regular and systematic monitoring, or large-scale special-category data. Routine HR processing is usually not a core activity, but large-scale employee monitoring or health and biometric data can change that. If you decide not to appoint, record why. See the DPDP Act guide.
Both laws put the burden of proof on you. GDPR Article 7(1) requires the controller to be able to demonstrate consent; DPDP section 6(10) requires the Data Fiduciary to prove that notice was given and consent obtained. Under both, withdrawing must be as easy as giving consent (GDPR Article 7(3), DPDP section 6(4)).
The DPDP differences: consent follows a standalone notice (section 5) and can be managed through a registered Consent Manager (section 6(7) to 6(9)). Record who consented, when, to which notice version, for which purpose, and when they withdrew. Read Consent under GDPR vs DPDP.
ISO/IEC 42001:2023 is a certifiable management-system standard for AI; no law requires it. Starting before a first release makes sense if customers are asking how you govern AI, or if the EU AI Act may apply to you, because its risk and impact assessments support many of the Act’s duties.
Certification can come later. Most teams begin with a gap assessment, an AI policy, an inventory of AI systems and an impact assessment for the first use case. Read ISO/IEC 42001 before your first AI release.
Send it to enquiry@vedhacon.com and a moderator will pick it up. Please leave out personal data about others and anything confidential. Answers are general information, not legal advice.
Answer community questions in your specialism and help set the standard for accuracy.
Run live sessions on regulation changes, implementation techniques or certification experience.
Write guidance, jurisdiction explainers and analysis for a global professional readership, alongside our whitepapers.
Guide newcomers through the Academy tracks and help them into their first GRC role.
It takes about three minutes. Tell us your specialism and how you would like to contribute, and we will be in touch.
Privacy lawyers, DPOs, auditors, security engineers, AI governance specialists and compliance practitioners in any jurisdiction we cover. Students and career changers can apply to be mentored.
No. Vedhacon never asks for payment to apply for a role or to join the network. If anyone asks you for a fee in our name, please tell us at enquiry@vedhacon.com.
A member of the team reviews your application and replies from enquiry@vedhacon.com, usually to arrange a short introductory call about how you would like to contribute.
Only to assess your application and contact you about the network. It is not sold or used for marketing, and you can ask for it to be erased at any time. Read the privacy notice.
No. Answers are general information reviewed by a moderator. For advice on your own situation, speak to a qualified professional or contact us.
Contribution is credited, flexible, and open to practitioners in every jurisdiction we cover. Newcomers can start with the GRC Academy and ask for a mentor.
Premium membership turns the community into something you build, not just read. Publish under your own byline, keep your contributor profile current, and nominate the practitioners whose work you respect.
900–1,600 words on something you actually ran. Editorial review inside five working days, and you keep the byline and the republication rights.
4,000 words or more, with method, evidence and a reusable artefact. We provide the editor, the design and the launch.
Update the photo, display name, role and links that appear on every answer and article you publish. Changes propagate automatically.
Premium membership is invite-only. Every member can nominate peers whose work raises the standard of the profession.
Contribution and profile tools are part of premium membership. Sign in to open them, or request an invitation.
