If your company collects phone numbers, emails or addresses — and almost every company does — the DPDP Act applies to you. The good news: showing you’re careful is more practical than it sounds.
Who it’s for
Any business in India that collects customer or employee data
You’ll learn
- · What the DPDP Act expects
- · How testing proves you are careful
- · Where to start
Reading time
8 min read
DPDP Act 2023
India- The requirement
- Reasonable security safeguards to prevent personal data breaches.
- Auditors look for
Documented testing of systems holding personal data
Remediation records
Breach-detection and response capability
- How we help
- Show “reasonable security practices” with documented testing of systems that hold personal data.
- 1
Reasonable security safeguards
The DPDP Act requires organizations that process personal data to take reasonable security safeguards to prevent personal data breaches. It does not prescribe a single technical standard, which makes documented evidence of your security practices important.
- 2
Where testing fits
Regular penetration testing of the applications, APIs and mobile apps that collect or store personal data shows that you actively look for weaknesses and fix them.
Keep the reports, remediation records and retest results — together they form a clear record of your security practices.
- 3
A practical starting point
Start by listing the systems that hold personal data, test the most exposed ones first, and set a regular testing cadence. Pair testing with monitoring so that a breach is detected quickly if one does occur.
- 4
Which systems to start with
Start where personal data is most exposed: customer sign-up and login, account pages, mobile apps and the APIs behind them. Then move to internal systems such as HR and CRM tools.
If you use third-party processors, ask how they protect the data you share with them — your responsibility does not end at your own servers.
- 5
Building a record you can show
Keep a simple folder for each assessment: the scope, the report, remediation tickets and the retest result. Together they show a regulator or customer that you identify risks and act on them.
Review this record at least once a year, and after any major product change.
What you should do
- Map the systems that collect or store personal data
- Prioritize customer-facing apps, APIs and mobile apps
- Keep reports, remediation records and retest results
- Define who handles a suspected data breach
What our team does
- Test the systems that hold personal data first
- Rate findings by business and privacy impact
- Provide remediation guidance your developers can act on
- Supply audit-ready reports and retest evidence
- Help you map where personal data lives
- Prioritize findings that expose personal data
- Package reports so they are easy to share during reviews
We help teams turn “are we compliant?” into a clear, documented answer.
— The CRIS InfoTech security team