These aren't buzzwords. They're the actual machinery of the law, and each one carries a determination your business has to get right.
Which lawful basis applies — §7?
Whether consent is required at all, or one of the legitimate-use exemptions covers the processing.
Is this a consent withdrawal?
Processing has to stop across every system that held the data — without delay, not on your next sprint.
Which data principal right is this — §§11–14?
Access, correction, erasure or grievance each carries its own deadline and its own set of systems to check.
Does this breach trigger CERT-In and the Board?
A 6-hour CERT-In clock and a separate DPDP Board notice, both running from the moment you became aware, not when the investigation is finished.
Is this vendor a Processor under the Third Schedule?
You carry the liability for how they handle the data, whatever your contract with them says.
Are you a Significant Data Fiduciary?
The designation adds obligations: an independent audit, a DPO, periodic impact assessments.
Does this involve a child's data?
Verifiable parental consent, and no tracking or behavioural advertising directed at children.