Interactive Checklist

C-06 Security & Incident Response Chief Security Officer (CSO / CISO)

The Breach Intimation Checklist

Incident response dossier checklist ensuring complete intimation to the Data Protection Board and affected Data Principals under Rule 7.

Statutory Source: s.8(6) + r.7 content set: nature/extent/timing, consequences, mitigation, self-protection, contact (Ch. 16; A.8 row)

Total Verification Points: 8 Audit Checks

C-06s.8(6) + r.7 content set: nature/extent/timing, consequences, mitigation, self-protection, contact (Ch. 16; A.8 row)

The Breach Intimation Checklist

The two-step clock, itemised — before the incident, not during

Readiness Score

0 / 8 checks

Incident Detection & Triage: Exact timestamp of breach confirmation, impacted systems, and root cause identified.

Section 8(6) & Rule 7(1)

Nature & Extent Determination: Categories of personal data exposed (e.g. financial, identity, health) and estimated principal count.

Rule 7(2)(a)

Potential Consequences Analysis: Assessment of likely harm, identity theft, financial loss, or safety risks to Data Principals.

Rule 7(2)(b)

Mitigation & Containment Measures: Immediate corrective actions taken by the fiduciary to secure perimeter and halt data leakage.

Rule 7(2)(c)

Safety Advice for Principals: Actionable steps Data Principals should take to protect themselves (e.g. password resets, card blocks).

Rule 7(2)(d)

DPO Contact Channels: Dedicated helpline, email, and portal where affected Principals can obtain support.

Rule 7(2)(e)

DPBI Form Submission: Intimation dispatched to the Data Protection Board in the prescribed format without delay.

Section 8(6) & Rule 7(1)

CERT-In 6-Hour Dual Clock: Parallel incident intimation filed with CERT-In within 6 hours of confirmation.

CERT-In Directions 2022

State automatically persisted in browser localStorage

Statutory Grounding & Legal Perimeter

Mandatory statutory clauses, rules, and gazette requirements enforceable under this checklist.

Enforceable Provisions:

Section 8(6)

Rule 7

Section 33

Statutory Context:

This checklist is directly anchored in s.8(6) + r.7 content set: nature/extent/timing, consequences, mitigation, self-protection, contact (Ch. 16; A.8 row). Failure to maintain verifiable affirmative proof of compliance exposes the enterprise to severe adjudication penalties under Section 33 (Schedule) of the DPDP Act.

Target Architecture & Impacted Systems

Enterprise applications, stores, and integration surfaces evaluated by this checklist.

View Full Systems Topology (SYS-001..014) →

In-Scope System Nodes:

SYS-005 Architecture Spec →

Analytics & AI/ML Training Environment

Model training and algorithm development node gated against unconsented data

SYS-006 Architecture Spec →

HRMS & Applicant Tracking System

Internal employer database holding employee payroll and candidate records

SYS-010 Architecture Spec →

Consent Ledger & Policy Decision Point

Immutable consent event store and Policy Decision Point issuing authority tokens

SYS-014 Architecture Spec →

Restore Quarantine & Sandbox Store

Isolated test environment ensuring recovered backups pass tombstone replay

Associated Operational Controls (54 OBLs)

Control Master Matrix obligations directly tested by this checklist.

Open Control Matrix →

OBL-12 Workpaper →

Control Dossier OBL-12

OBL-18 Workpaper →

Control Dossier OBL-18

Audit & Implementation Guidance

Best practices for establishing evidence, avoiding traps, and conducting periodic assurance.

Evidence Retention Standard

Do not rely solely on policy documents or statements of intent. Ensure verifiable evidence artifacts (cryptographic logs, test manifests, signed DPA agreements, or automated crawler receipts) are archived for at least 1 year.

Common Implementation Trap

Avoid declaring compliance based on frontend UI alone. The Data Protection Board evaluates the full data pipeline, including database persistence, read replicas, cache invalidation, and third-party processor synchronization.

Previous Checklist

C-05 — The Withdrawal Parity Test

Next Checklist

C-07 — The Children's Product Gate