Know the information
Map collection points, purposes, systems, vendors, retention practices and internal ownership of personal data.
PRACTICE AREA / 01
Data privacy & cybersecurity
Understand the data. Prepare for the incident.
How personal data moves through a business, the documents that govern it, and the legal side of preparing for a personal-data breach or cyber incident.
SUBJECTS WITHIN THIS AREA
What a review may cover.
Review the documents
Consider privacy notices, consent journeys where relevant, processor terms and records of decisions against the DPDP Act and Rules.
Prepare for incidents
Set out who decides during a breach or cyber incident, what vendors must report, and which reporting timelines apply to the business.
DOCUMENTS & PRACTICAL OUTPUTS
From questions
to a working record.
Depending on the agreed scope, the work may involve the following. Deliverables and responsibilities are confirmed before an engagement.
- Personal-data inventory and applicability note
- Prioritised readiness review and action register
- Privacy notice and processor-agreement schedule
- Breach and incident escalation map, prepared alongside technical specialists
A PRACTICAL STARTING POINT
Questions to
bring to the table.
Use these prompts to organise your thinking. Your answers stay on this page and are not submitted or saved. This is not an assessment or certification.
0 of 5 topics considered
Select the topics you have considered.
COMMON QUESTIONS
A little more context.
The DPDP framework commences in phases. Applicability and dates must be checked for the particular activity.
MeitY: DPDP Act and Rules ↗Does a privacy policy establish compliance?
A document is one part of readiness. The actual data flows, systems, security measures and day-to-day practices need to be considered together.
Do all DPDP duties start on the same date?
No. The Act, the Rules and the commencement notifications must be read together; some duties apply now and others from later dates.
Does this area include technical security testing?
No. Penetration testing and technical audits require qualified security specialists. The legal work covers duties, contracts, records and reporting.
RELATED READING
Updates in this area.
DPDP Rules, 2025: what a small or mid-sized business must do, and by when
India's data protection law arrives in three phases ending on 13 May 2027; this note sets out, from the Act and the Gazette text of the Rules, what a business with customer and employee data has to put in place.
28 OCT 2026 · Law stated as at this dateRead ↗