Skip to content
TrustOS

Articles

The questions that take real thought.

Nine longer pieces in three series. Each one works through a hard part of the Act with Indian examples.

Breach under the DPDP Act

3 parts

  1. Part 1 of 3

    Meeting the reasonable security safeguards

    Rule 6 of the DPDP Rules sets out what reasonable security safeguards means. Each measure has a practical form in an ordinary Indian company's systems and vendor contracts.

    18 min read

  2. Part 2 of 3

    Discovering a personal data breach

    You can only report what you can see. Detection rests on what the DPDP Act counts as a breach, the logs Rule 6 asks for and how those logs are monitored, and the moment of awareness needs a timestamp.

    18 min read

  3. Part 3 of 3

    Reporting to the Board and your users

    After a personal data breach you owe two sets of notices: one to the people affected and two to the Data Protection Board. Each has required contents, and the work has to fit inside the 72 hour window.

    18 min read

Consent under the DPDP Act

3 parts

  1. Part 1 of 3

    Preparing for registered Consent Managers

    Registered Consent Managers will let people give, review and withdraw consent across many companies from one place. Most of the work to receive that consent happens inside your own systems.

    18 min read

  2. Part 2 of 3

    Handling the personal data of children

    Under the DPDP Act everyone under 18 is a child. You need a parent's verifiable consent first, and some processing stays off limits whatever consent you hold.

    17 min read

  3. Part 3 of 3

    Processing under the legitimate uses

    Section 7 of the DPDP Act lets you process personal data without consent in a short, closed list of situations. A business will rely on only a few of them, and each needs a record of the ground used.

    19 min read

The DPDP Act in practice

3 parts

  1. Part 1 of 3

    The engineering work inside the DPDP Act

    Most DPDP Act commentary is written by lawyers for lawyers. Six of its core duties end up as databases, scheduled jobs and logs that your teams have to build and run.

    23 min read

  2. Part 2 of 3

    When systems cannot do what the policy promises

    A complete set of privacy documents says what you intend. The DPDP Act judges what your systems actually do. The gap between the two can be found and measured.

    21 min read

  3. Part 3 of 3

    Building DPDP Act compliance that survives an audit

    An examiner does not ask whether you have a retention policy. They pick a data category and ask to see proof it was deleted. A programme built in the right order can answer.

    21 min read

See it with your data

Show us where your personal data lives. We will show you TrustOS running on it.

A 30 minute walkthrough on Google Meet with someone who knows the Act and the product. You leave with a view of your first phase, the owners and the effort.

Book a demoTake the gap assessment
Or get a rollout proposal in two minutes
  1. Step 1A 30 minute demo on Google MeetWith someone who knows the Act and the product.
  2. Step 2Your systems and purposesWe walk one product's personal data through TrustOS.
  3. Step 3A first phase you can planModules, owners and effort, written down for you to keep.