DPDP Compliance Is Not Enough: Can You Prove What Happened After a Data Breach?
India’s Digital Personal Data Protection framework is changing the way organisations think about personal data.
The Digital Personal Data Protection Rules, 2025 were notified in November 2025. The substantive obligations, including the security safeguards and breach-reporting rules discussed below, come into force in May 2027, so organisations have a limited window in which to prepare.
Much of the discussion understandably focuses on compliance: consent, lawful processing, data retention, access controls, third-party processors, breach management and the responsibilities of organisations handling personal data.
But there is another question that deserves equal attention:
If a data breach happens tomorrow, will you actually be able to determine what happened?
That is where digital forensic readiness becomes important.
Compliance asks one question. An investigation asks another.
A compliance assessment may establish that an organisation has appropriate policies, processes and security controls.
But after an incident, management may suddenly need answers to very different questions:
- When did the incident begin?
- Which systems were accessed?
- Which accounts were involved?
- What personal data may have been exposed?
- Was the information viewed, copied, modified or deleted?
- How long did the attacker have access?
- Can we reconstruct the sequence of events?
- Do we have reliable evidence to support our conclusions?
Having a policy saying that security events are logged is very different from having the logs necessary to reconstruct an incident six months later.
This is the gap between being compliant on paper and being capable of investigating an incident in practice.
Consider a simple scenario
Imagine an employee account is compromised.
The attacker accesses a cloud application containing customer information. The compromise is discovered several weeks later.
The organisation now needs to establish the potential impact.
The security team checks its systems and discovers that authentication and firewall logs have been kept for a year, in line with the one-year minimum in the DPDP Rules, but the cloud application’s own activity was never logged, and timestamps across systems do not agree.
The organisation may know that an incident occurred.
What it cannot confidently determine is what the attacker actually did.
That uncertainty can quickly become a business, legal and regulatory problem.
The DPDP Rules set a floor here. Rule 6 requires reasonable security safeguards, including the retention of relevant logs for at least one year. But retention is not the same as investigability. A year of logs does not guarantee that the right activity was captured, that timestamps agree across systems, that evidence has been preserved, or that anyone knows who decides when to investigate.
The Rules also raise the stakes after a breach. Affected individuals and the Data Protection Board must be informed without delay, and a detailed report must reach the Board within 72 hours. Establishing what happened, and which personal data was affected, is an investigative task, and it will have to be done under time pressure.
This is where forensic readiness matters
Digital forensic readiness does not mean every organisation needs its own forensic laboratory or a large incident-response team.
It means designing systems and processes so that useful evidence will exist before an incident occurs.
For example, an organisation should consider whether:
- Identity activity can be reconstructed.Can you determine who logged in, from where, using which account and when?
- Access to sensitive information is traceable.Can you determine which users or applications accessed important personal-data repositories?
- Relevant logs are retained for an appropriate period.Collecting logs is of little value if they disappear before an incident is discovered. The DPDP Rules set a one-year minimum, which is best treated as a floor rather than a target.
- Endpoint and cloud activity can be investigated.Can security teams reconstruct activity across laptops, servers, SaaS applications and cloud infrastructure?
- Time is consistent across systems.An investigation becomes considerably harder when different systems record events using inconsistent timestamps.
- Evidence can be preserved.If an incident becomes serious, can relevant evidence be collected and protected without compromising its integrity?
- Responsibilities are already defined.Who decides when an incident requires forensic investigation? Who preserves evidence? Who communicates with management, legal teams, customers or regulators?
These capabilities are useful far beyond regulatory compliance.
They help organisations respond to ransomware, insider threats, account compromise, intellectual-property theft, fraud and other cyber incidents.
DPDP readiness and forensic readiness should therefore meet
A mature privacy programme should not stop at asking:
“Do we have the required controls?”
It should also ask:
“Could we demonstrate what happened if those controls failed?”
That leads to a more useful way of thinking about readiness:
DPDP Readiness
Are the organisation’s privacy, governance and security controls appropriate?
Cybersecurity Readiness
Are reasonable technical measures in place to reduce the probability and impact of an incident?
Digital Forensic Readiness
If an incident occurs, can the organisation investigate it and establish reliable facts?
These are not competing disciplines.
They reinforce one another.
A readiness score should reveal this difference
Consider an organisation receiving the following assessment (an illustrative example, not real assessment data):
At first glance, that may look reassuring.
But suppose the same assessment finds:
That tells management something much more useful.
The organisation may have established many of the necessary privacy processes and controls, but if a serious incident occurs, it could struggle to reconstruct events, identify affected data or support its conclusions with reliable evidence.
The percentage itself is not the objective.
Understanding the gap is.
Smaller organisations should pay particular attention
Large enterprises may already operate SIEM platforms, security operations centres, endpoint detection systems, centralised logging and established incident-response procedures.
Smaller organisations often do not have the same resources.
Logs may exist across Microsoft 365, Google Workspace, firewalls, endpoints, cloud platforms and business applications without anyone knowing exactly what is retained or for how long.
This does not automatically mean spending heavily on security technology.
A forensic-readiness exercise can begin with relatively straightforward questions:
- What personal data do we hold?
- Where is it stored?
- Who can access it?
- What activity is logged?
- How long are those logs retained?
- Could we reconstruct an incident using what we have today?
The answers often reveal practical improvements that can be made before purchasing additional technology.
From compliance readiness to evidence readiness
The objective of privacy and cybersecurity programmes should not simply be to produce documentation for an audit.
They should help organisations prevent incidents, detect them, respond effectively and understand what actually happened.
That is why VigilON believes organisations should increasingly consider DPDP readiness and digital forensic readiness together.
One prepares the organisation to protect personal data.
The other prepares it to establish the facts when something goes wrong.
Because after a data breach, one of the most difficult answers an organisation can give is:
“We don’t know.”