Complying with
India’s Digital Personal
Data Protection Act (DPDPA)

Meet this requirement with ManageEngine:

Protect personal data by enforcing strong encryption, controlled access, and selective data masking across identities, endpoints, infrastructure, and IT operations.

• Encryption at rest and in transitMeet this requirement with ManageEngine:
• Full-disk encryption on end-user devicesAll end-user devices use full-disk encryption to protect data in case of loss, theft, or compromise.
• Centralized key and certificate managementCryptographic keys and certificates are centrally generated, stored, rotated, and monitored to ensure strong, current encryption across all systems.
• Data masking and redactionPersonal data is masked or redacted in interfaces, reports, dashboards, and data transfers to minimize exposure to only what is necessary.
• Controls against unauthorized data extractionTechnical controls prevent copying personal data to unauthorized or unencrypted removable media.
• Application-level encryption and obfuscationSensitive attributes (emails, phone numbers, IPs, URLs, hostnames, access tokens) are encrypted or obfuscated at the application layer to limit internal exposure.

Meet this requirement with ManageEngine:

Strict, end-to-end control over access to computer resources by enforcing identity-based access controls, least-privilege principles, and continuous oversight across users, administrators, endpoints, and privileged systems.

• Role-based and least-privilege accessAccess to systems, applications, and devices is enforced through RBAC, ensuring users and administrators have only the permissions required for their roles.
• Context-aware access controlAccess decisions are dynamically evaluated using contextual signals such as user identity, device posture, location, IP address, and time of access to reduce unauthorized or high-risk access.
• Automated access life cycle managementUser provisioning, role changes, and deprovisioning are automated to ensure access is granted, modified, or revoked immediately as responsibilities change.
• Privileged access managementAccess to sensitive resources is approval-based and time-bound, using JIT elevation and periodic access reviews to minimize standing privileges.
• Credential isolation and session monitoringPrivileged access is mediated without exposing credentials, and all privileged sessions are monitored, recorded, and auditable.
• Endpoint and device access controlsLocal administrator rights, device-level access, removable media, and peripheral usage are restricted to authorized users.
• Continuous logging and monitoringAll access to computing resources is logged and monitored, with alerts for anomalous or unauthorized activity.

Meet this requirement with ManageEngine:

Continuous and auditable visibility into how personal data is accessed by collecting, correlating, and analyzing access-related events across identities, endpoints, applications, networks, and data flows.

• Centralized access loggingAccess events from directories, endpoints, applications, servers, network devices, and data protection systems are centrally collected and normalized to create a single audit trail.
• Real-time monitoring and analyticsUser and system activity is continuously monitored and analyzed to detect anomalous or suspicious access to systems processing personal data.
• Comprehensive audit trailsLogs capture authentication events, resource access, administrative actions, file operations, data transfers, peripheral usage, and security events to ensure full traceability.
• Alerting and incident responseReal-time alerts flag unusual access patterns, policy violations, and potential security incidents for prompt investigation and response.
• Log retention and forensic supportAccess logs are securely retained to support forensic investigations, internal audits, and regulatory inquiries.
• Audit-ready reporting and visibilityRole-based dashboards, automated reports, and searchable logs provide clear evidence of access to personal data for auditors and stakeholders.
• Cross-source correlationAccess data is correlated across IT and security systems to identify privilege misuse, hidden access paths, and high-risk activity.

Meet this requirement with ManageEngine:

Maintain the availability of systems processing personal data by combining reliable backup mechanisms, rapid recovery capabilities, and operational resilience controls to minimize downtime and data loss.

• Automated and scheduled backupsSystems managing personal data are backed up on a scheduled basis with incremental backups and versioning to enable point-in-time recovery.
• Granular recovery capabilitiesPersonal data and system components can be restored at granular levels (users, objects, attributes, files) to minimize recovery time and disruption.
• Full environment rollbackIdentity and directory environments can be rolled back to known-good states following corruption, misconfiguration, or security incidents.
• Resilient backup storage and retentionBackups are stored in resilient repositories with defined retention policies, supporting recovery from ransomware, disasters, or infrastructure failures.
• Operational system and endpoint recoveryEndpoints and systems can be rapidly restored through centralized remediation, configuration enforcement, and patching.

Meet this requirement with ManageEngine:

Enables organizations to meet log-retention obligations by enforcing configurable, long-term storage of access logs and audit records related to personal data, while preserving integrity and ensuring retrievability for review and investigation.

• Configurable long-term log retentionLog and audit data is retained for at least 365 days, with configurable retention periods to meet regulatory and organizational requirements.
• Automated archiving with tiered storageLogs are automatically archived into tiered storage, keeping recent data searchable while securely preserving older records for compliance.
• Uniform retention enforcementRetention policies are consistently applied across identity systems, endpoints, and monitoring platforms to prevent coverage gaps.
• Tamper-resistant log storageArchived logs are stored in integrity-protected, tamper-resistant formats to prevent unauthorized modification or deletion.
• Scalable storage backendsLong-term retention is supported across scalable on-premises and off-site or cloud storage.
• Audit-ready access to historical logsArchived logs can be restored and queried for audits, investigations, and regulatory reviews.

Meet this requirement with ManageEngine:

Supports data fiduciaries in operationalizing contractual requirements by providing centralized contract governance, traceability of data processors, and technical controls that enable verification and enforcement of agreed security safeguards.

• Centralized management of processor contracts and DPAsProcessor contracts and DPAs are centrally stored, versioned, and managed to ensure security safeguard clauses are captured and audit-ready.
• Traceability between processors, contracts, and systemsContracts are linked to vendors, services, and assets, providing clear visibility into which processors handle specific systems and personal data.
• Contract life cycle governanceRenewal tracking, alerts, and historical records support periodic review of processor obligations and prevent lapses in contractual safeguards.
• Security-by-design in onboarding and procurementContract management is integrated with procurement and approval workflows to ensure security requirements are enforced at processor onboarding.
• Controlled and contract-aligned processor accessThird-party access is enforced through role-based, time-bound, and JIT mechanisms aligned with contractual restrictions.
• Active monitoring of processor activityProcessor privileged sessions can be monitored, supervised, and terminated in real time to enforce contractual security obligations.
• Verification of processor security postureCentralized visibility into processor endpoint security, patching, encryption, and access controls enables validation of contractual compliance.

Meet this requirement with ManageEngine:

Recover from personal data breaches quickly, remediate root causes, and produce clear, auditable evidence of corrective actions required for breach notifications.

• Rapid service and data restorationSystems processing personal data can be quickly restored using incremental backups and multiple recovery options to minimize data loss and downtime.
• Containment and isolation of compromised systemsAffected endpoints and environments can be isolated, locked, or wiped remotely to stop further exposure before services are restored.
• Targeted remediation and rollbackMalicious activity, unauthorized data transfers, and misconfigurations are blocked, removed, or rolled back to return systems to a known-secure state and prevent recurrence.
• Reinforcement of security baselinesAccess controls, endpoint policies, and device restrictions are reapplied to ensure recovered systems meet required security baselines prior to resuming operation.
• Ransomware recovery controlsEncryption activity is halted, affected data is restored via rollback mechanisms, and lateral spread is contained before confirming recovery.
• Documented remediation evidenceAll containment, recovery, and remediation actions are logged with timestamps to provide verifiable evidence of mitigation measures.

Meet this requirement with ManageEngine:

Generate, preserve, and review verifiable evidence logs required to substantiate breach notifications, mitigation disclosures, and regulatory reporting.

• Comprehensive evidence loggingAccess events, system activity, data movements, endpoint actions, and malware or ransomware incidents are logged with full context, including actors, timestamps, and affected systems.
• Centralized correlation and breach reconstructionLogs from endpoints, data protection controls, malware defenses, and system events are correlated into a unified investigation view to reconstruct breach timelines and impact accurately.
• Forensic-grade retention and searchabilityEvidence logs are securely retained and searchable over extended periods to support investigations, regulatory inquiries, and validation of breach facts.
• Documented data exposure attemptsRecords of attempted or blocked data transfers, file access, device usage, and malicious activity define the scope of potential personal data exposure and identify affected Data Principals.
• Preserved mitigation and recovery evidenceDetection, containment, cleanup, and recovery actions are logged with timestamps to provide verifiable proof of mitigation and prevention measures.
• Evidence-backed notification and reportingConsolidated evidence supports accurate, plain-language breach notifications and defensible reports to regulators and affected Data Principals.

Meet this requirement with ManageEngine:

Systematically discover, classify, and map where personal data resides across endpoints, file systems, databases, and removable media thereby forming the foundation for compliant retention and deletion.

• Automated personal data discoveryStructured and unstructured data sources are scanned to identify personal data and maintain an inventory of where it is stored.
• Risk-based data classificationDiscovered data is classified by sensitivity and context to distinguish high-risk personal data and apply appropriate retention and deletion rules.
• Endpoint and user-environment visibilityManaged endpoints and user systems are inventoried to identify locations where personal data may exist, including local storage and application data.
• Monitoring of data movement and temporary storageFile transfers involving removable media and peripherals are monitored and logged to map personal data movement and storage paths.
• Identification of incident-affected dataData impacted by malware or ransomware is identified to assess potential exposure and support retention or deletion decisions.
• Discovery reporting for complianceDiscovery reports and risk indicators support defensible decisions on retention scope, mandatory retention, and lawful deletion timelines.

Meet this requirement with ManageEngine:

Apply classification-driven controls that support mandatory one-year retention of personal data and systematic deletion thereafter, unless continued retention is legally required.

• Automated retention enforcementPersonal data is automatically retained and expired based on classification-driven retention policies aligned with regulatory requirements.
• Automated identification of deletion-eligible dataData exceeding mandatory retention periods is continuously identified and flagged for deletion without manual intervention.
• Controlled, system-enforced deletion workflowsDeletion is executed through system-controlled, reviewable workflows to prevent premature erasure while ensuring timely compliance.
• Automated handling of lawful retention exceptionsLegal, regulatory, and investigative holds are system-enforced, automatically excluding applicable data from deletion.
• Audit-ready retention and deletion evidenceAutomated reports and logs provide verifiable evidence of retention enforcement and deletion actions.

Meet this requirement with ManageEngine:

Identifies inactive users and stale data, supporting lawful minimization and deletion of personal data after the mandatory one-year retention period.

• Detection of inactive user accountsUser activity is monitored to identify accounts inactive beyond defined thresholds.
• Evidence-based inactivity recordsHistorical logon and inactivity data is retained to support defensible disablement or deletion decisions.
• Automated handling of stale accountsInactive accounts are automatically disabled, moved, or removed through controlled workflows to reduce risk and unnecessary data retention.
• Review of personal data linked to inactive usersPersonal data associated with inactive accounts is flagged to determine deletion or lawful extended retention.
• Audit-ready inactivity reportingReports capture identified inactive accounts, actions taken, and retention outcomes to evidence compliance with minimization and deletion requirements

Meet this requirement with ManageEngine:

Retain processing and traffic logs for the mandated minimum period and ensure their timely, lawful erasure thereafter.

• Configurable minimum log retentionProcessing and traffic logs are retained for at least one year through configurable retention policies.
• Automated log archivingOlder logs are automatically archived with defined retention windows to preserve availability without impacting system performance.
• Integrity-protected storageArchived logs are encrypted and time-stamped to prevent tampering and preserve evidentiary integrity.
• Automated post-retention deletionLogs are automatically deleted once retention periods expire to prevent unlawful over-retention.
• Consistent retention enforcementRetention policies are applied uniformly across endpoints and systems to avoid compliance gaps.