Every regulation from Day 01 mapped to a CRO-trackable risk. Download = Excel-ready CSV.
RISK-01 • Data Residency → RBI-2018Critical
Payment data stored outside India
Control: Geo-fence storage to IN region, block S3 cross-region replication | Likelihood: High
RISK-02 • Cross-Border Transfer → DPDP-16Critical
Aadhaar/PAN transferred without consent/notify
Control: DPDP consent ledger + allowlist transfer to approved regions only | Likelihood: Medium
RISK-03 • Card Data Storage → RBI-TOKENHigh
Actual card number stored by merchant
Control: Tokenization vault, PAN truncation | Likelihood: High
RISK-04 • Purpose Limitation → GDPR-5Medium
Model uses more PII than needed
Control: Data minimisation check in feature store | Likelihood: Medium
RISK-05 • Model Risk → ERM-MODELHigh
AI model using PII without risk register
Control: Model risk register, evals, approval workflow | Likelihood: High
RISK-06 • Breach Notification → GDPR-33Critical
Breach not reported in 72h
Control: 72h breach SOP + automated alerting | Likelihood: Low
RISK-07 • Audit & Traceability → RBI-CYBERHigh
No audit trail for data access
Control: Immutable audit logs for all data/model access | Likelihood: Medium
RISK-08 • Consent Management → DPDP-CONSENTHigh
Consent not withdrawable / not logged
Control: Consent artifact store, revocation propagation | Likelihood: Medium