Data Privacy · Module 06
Structured detection, investigation, containment, remediation and reporting — so an incident stays an incident and does not become a penalty.
Primary DPDP sectionsSec. 8(6)
How it works
Notification becomes a query against the catalogue rather than a three-week investigation — the difference between meeting the window and missing it.
01
Real-time alerting, including unauthorised internal processing
02
Catalogue converts system scope into the exact list of Principals
03
Isolation playbooks per system class, root cause tracked to a fix
04
Board and each affected Principal, generated from that list
05
Impact scored, controls verified, posture updated
Multi-regime clocks run in parallel — DPDP, GDPR and CPRA windows tracked against the same incident.
Capability
Continuous monitoring with real-time alerting, then rapid forensics to establish scope, root cause and the data affected.
Immediate isolation of affected systems, vulnerabilities patched and corrective controls put in to prevent recurrence.
Notifications aligned to DPDP, GDPR and CPRA timelines, full audit trail retained, and impact scored in a post-incident review.
Notification becomes a query against the catalogue rather than a three-week investigation — the difference between meeting the window and missing it.
DPDP alignment
What the Digital Personal Data Protection Act, 2023 requires, and the control that satisfies it.
| Section | What the Act requires | How the product satisfies it |
|---|---|---|
| Sec. 8(6) | In the event of a personal data breach, intimate the Data Protection Board and each affected Data Principal in the form and manner prescribed. | Incident scope resolves through the catalogue into the exact list of affected Principals, and intimations to both the Board and each Principal are generated, tracked and evidenced from that list. |
| Sec. 8(5) | Take reasonable security safeguards to prevent a personal data breach. | Safeguards are evidenced continuously before an incident rather than reconstructed after one — which is what makes the defence available when the Board asks. |
| Sec. 2(u) | A personal data breach includes unauthorised processing, accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access. | The definition is broader than exfiltration, so detection covers unauthorised internal processing and loss of access, not only external attack. |
| Sec. 28 | The Board may inquire into a breach and determine whether penalty is warranted, taking account of mitigating action taken promptly. | The full incident trail — detection, containment, remediation and intimation, each timestamped — is the record the Board weighs when assessing mitigation. |
| Sec. 33 | Penalty is determined by the nature, gravity and duration of the breach, the type of data affected, repetition, and mitigating action. | Every factor the Board weighs is a field in the incident record, so the mitigation argument is evidenced rather than narrated after the fact. |
Up to ₹250 Cr for failing to prevent a breach and a further ₹200 Cr for failing to intimate it — the two largest items in the Schedule, and they can attach to the same incident.
Solutions by industry
The sectors carrying the most DPDP exposure for this control, each with its own threat model and regulators.
A DPDP readiness walkthrough maps your obligations to the controls that already exist, and names the gaps that do not.
