IN
DPDP ActIndia · data principal rights
Requests30 daysGrievances 90 days
IncidentsNone setNo fixed hours
Privacy & data protection
Every request, on the clock.
Each regulation brings its own request types and deadlines. Switch between them: the due date is stamped the moment a request arrives, and overdue requests raise alerts.
The life of a request
From an email in the inbox to proof it was handled
Request logged
Type, requester, regulation
Type, requester, regulation
Due date stamped
From the regime's window
From the regime's window
Owner assigned
Reminders as it nears due
Reminders as it nears due
Fulfilled
Resolution notes recorded
Resolution notes recorded
Disposed
Erasure proven with evidence
Erasure proven with evidence
The registers
Four registers, filed in one place
Open a folder. Each one is a working register in CompliLens, not a template.
Rights & consent
Rights requests answered on the clock
A log of consents you have collected and requests people make about their data.
Privacy laws (DPDP, GDPR and others) give people rights and set strict response deadlines.
How it works- In Consent Register, record each consent: who, for what purpose, through which channel, when given and when withdrawn. Use Withdraw when someone takes consent back.
- In Data Principal Requests, log each request: choose the regulation (for example DPDP or GDPR), then the type (access, correction, erasure, grievance, or regime-specific types).
- CompliLens calculates the legal due date automatically from the regulation's response window.
- Track status: Received → In progress → Completed or Rejected, assign an owner and record the resolution.
- Overdue requests show in red, and reminders are sent before the deadline.
| Data principal | Purpose | Channel | Status |
|---|---|---|---|
| a.sharma@… | Marketing email | Web form | Given |
| +91 98•• ••42 | Order updates | Checkout | Given |
| j.wong@… | Analytics | Cookie banner | Withdrawn |
| r.iyer@… | Loyalty | Store | Given |
A customer asks to erase their data under GDPR. The request is logged on day 1, a due date 30 days out is set, and it is completed on day 12 with notes.
Classification
Know how every kind of data must be handled
A list of the kinds of data you hold and how each must be handled.
Not all data is equally sensitive, and laws limit how long you may keep it.
How it works- Add a data category (for example "Customer PII," "Financial records").
- Pick a classification level: Public, Internal, Confidential or Restricted.
- Record the retention period, the legal basis, the disposal method and an owner.
- Restricted categories are also used as a safeguard so AI features avoid exposing related content.
Publicwhile live
Marketing site contentInternal3 years
Wiki and meeting notesConfidential7 years after end
Customer contractsRestricted8 years · excluded from AI
HR and payroll recordsDisposition
Prove data and devices were destroyed properly
A record that data or equipment was properly destroyed.
"We deleted it" needs proof: when, how, by whom, and who verified.
How it works- Add a record: choose customer data, employee data, or asset.
- Link what was disposed of: an asset, a DPDP request, a portal user, or type an external identifier for things not in CompliLens (a paper file, an outside system).
- Record the method, date, who did it and who verified it, plus a disposal reference (for example a destruction certificate number).
- Attach the certificate as evidence.
- Optionally mark the asset as disposed in the same step.
Disposal · Laptop LT-009Verified
| Field | Value |
|---|---|
| Subject | Asset · Corporate laptop |
| Method | Certified disk wipe |
| Disposed by | IT operations |
| Verified by | Compliance manager |
| Reference | CERT-WIPE-2211 |
Regulations
Nine regulatory clocks, built in
A built-in catalog of privacy and cyber laws with their deadlines.
Deadlines differ by country. CompliLens already knows them, so nobody has to look them up.
How it works- The catalog covers CERT-In, DPDP (India), GDPR (EU), UK GDPR, CCPA (California), PDPA (Singapore), LGPD (Brazil), POPIA (South Africa) and the EU AI Act.
- Each entry holds the reporting window (for example 6 or 72 hours) and the types of data-subject requests that law recognises.
- In Context, you select which laws apply to you. Those then appear as options on Incident and Data Subject Request screens.
- CERT-In and DPDP are always on.
| Regime | Incident window | Requests |
|---|---|---|
| CERT-In | 6 hours | — |
| DPDP | — | 30 / 90 days |
| GDPR · UK GDPR | 72 hours | 30 days |
| EU AI Act | 48 hours | — |
| CCPA | — | 45 days |
| PDPA | 72 hours | 30 days |
| LGPD · POPIA | — | 15 · 30 days |
Nine regulations, one register
Every deadline you owe, side by side
Turn a regulation on and its request types, response windows and incident clocks apply across CompliLens straight away.
IN
CERT-InIndia · cyber incidents
RequestsNoneNot a rights law
Incidents6 hoursFrom detection
EU
GDPREuropean Union
Requests30 daysPer request
Incidents72 hoursTo the supervisory authority
UK
UK GDPRUnited Kingdom
Requests30 daysPer request
Incidents72 hoursTo the ICO
EU
EU AI ActSerious AI incidents
RequestsNoneNot a rights law
Incidents48 hoursStrictest tier
US
CCPACalifornia
Requests45 daysOpt-out in 15
IncidentsNone setNo fixed hours
SG
PDPASingapore
Requests30 daysPer request
Incidents72 hoursTo the PDPC
BR
LGPDBrazil
Requests15 daysPer request
IncidentsNone setNo fixed hours
ZA
POPIASouth Africa
Requests30 daysPer request
IncidentsNone setNo fixed hours
Windows are reference values for planning, not legal advice.