How can ManageEngine support DPDP Act compliance?
With ManageEngine Log360, organizations can align with DPDP Act requirements through centralized log collection and correlation across systems that store personal data, continuous auditing of who accessed which records and when, real-time detection of personal data breaches with automated alerting to support notification timelines to the Data Protection Board and affected Data Principals, file integrity monitoring over personal data repositories, and secure, tamper-evident log retention. These capabilities help implement reasonable security safeguards, enforce accountability, and produce the audit evidence expected during regulatory scrutiny.
Chapter IIDigital Personal Data Protection Act, 2023 — Chapter II: Obligations of Data Fiduciary
| Clause | Functionality | Explanation |
|---|---|---|
| Section 8(3) Where personal data is likely to be used to make a decision that affects the Data Principal, or is to be disclosed to another Data Fiduciary, ensure that the personal data processed is complete, accurate, and consistent. | Log360 - file integrity monitoring, change auditing, real-time alerts | Log360 partially addresses this clause. Through file integrity monitoring and change auditing in the DataSecurity Plus module, Log360 detects and alerts on unauthorised or unexpected modification of files that hold personal data, protecting data integrity. Ensuring that the data is factually accurate and complete is a data-quality function that AD360 and Log360 do not perform; the customer maintains this through application-level validation or a data-management process. |
Rule 6Digital Personal Data Protection Rules, 2025 — Rule 6: Reasonable security safeguards
| Clause | Functionality | Explanation |
|---|---|---|
| Rule 6(1)(c) Visibility on the accessing of personal data through appropriate logs, monitoring, and review, to enable detection of unauthorised access, its investigation, and remediation to prevent recurrence. | Log360 - centralized log management, real-time correlation engine, Active Directory change auditing, UEBA, MITRE-mapped threat detection, tamper-proof logs, audit-ready reports
AD360 - access certification, historical audit reports |
Log360 centralises logs from across the environment, correlates them in real time, audits Active Directory changes, and applies UEBA and MITRE-mapped detections to identify unauthorised access, with tamper-proof logs and audit-ready reports supporting investigation and remediation. AD360 adds access certification and historical audit reports for periodic review of who can reach personal data. Together they deliver the visibility, monitoring, and review the clause requires. |
| Rule 6(1)(e) Retention of logs and personal data for a period of one year to enable detection of unauthorised access and its investigation and the prevention of recurrence. | Log360 - centralized log retention, secure log archival, tamper-proof logs, historical audit reports | Log360 retains and securely archives log data, with configurable retention that meets the one-year minimum, and keeps the records tamper-proof and available through historical audit reports for investigation. Retention of the underlying personal data for the same period is governed by each data store's own retention configuration; Log360 covers the log-retention portion of the clause. |
Rule 7Digital Personal Data Protection Rules, 2025 — Rule 7: Intimation of personal data breach
| Clause | Functionality | Explanation |
|---|---|---|
| Rule 7 On becoming aware of a personal data breach, detect and contain it, and take measures to mitigate its impact. | Log360 - Vigil IQ threat detection, real-time correlation engine, UEBA, threat intelligence, Incident Workbench, SOAR playbooks
AD360 - UBA-driven identity threat detection |
Log360 detects a personal data breach through its Vigil IQ detection engine, real-time correlation, UEBA, and threat intelligence, and its SOAR playbooks contain the incident by isolating endpoints and disabling accounts. AD360's UBA-driven identity threat detection surfaces compromised accounts so they can be locked. Together they let the Data Fiduciary identify and contain a breach on becoming aware of it. |
| Rule 7 Intimate the affected Data Principal and the Data Protection Board, describing the nature, extent, and timing of the breach, its likely consequences, and the remedial and mitigation measures taken. | Log360 - Incident Workbench timelines, Zia Insights summaries, tamper-proof logs, forensic audit reports | Log360 partially addresses this clause. Its Incident Workbench reconstructs incident and user timelines, Zia Insights generates plain-language summaries, and tamper-proof logs and forensic reports establish the nature, extent, timing, and remedial measures the intimation must describe. Sending the intimation to the Board and to each affected Data Principal within the prescribed timeframe is a procedural and communication action performed by the Data Fiduciary. |
Rule 8Digital Personal Data Protection Rules, 2025 — Rule 8: Retention and erasure of personal data
| Clause | Functionality | Explanation |
|---|---|---|
| Rule 8 Retain processing logs and maintain records of erasure actions to demonstrate that personal data was deleted as required. | Log360 - file deletion auditing, tamper-proof audit trails, audit-ready reports | Log360 audits file deletion events and retains tamper-proof audit trails and audit-ready reports that record when personal data was deleted, providing the verification this clause requires. Retention periods for these records are configurable to meet the one-year minimum for processing logs. |