Interactive Checklist

C-16 Security & Access Control Chief Security Officer (CSO / CISO)

The Security Safeguard Decision Checklist

Technical controls verification checklist demonstrating 'reasonable security safeguards' under Section 8(5) and Rule 6 to prevent personal data breaches.

Statutory Source: s.8(4)/(5) + r.6 + Ch. 15: the safeguard-control map rows, reasonableness decision records, log retention

Total Verification Points: 7 Audit Checks

C-16s.8(4)/(5) + r.6 + Ch. 15: the safeguard-control map rows, reasonableness decision records, log retention

The Security Safeguard Decision Checklist

The safeguard catalogue build list

Readiness Score

0 / 7 checks

Encryption at Rest: AES-256 (or equivalent) encryption enforced across all database tables, disks, and backups.

Section 8(5) & Rule 6(1)

Encryption in Transit: Mandatory TLS 1.3 across all public web endpoints and internal service-to-service RPCs.

Section 8(5) & Rule 6(1)

Multi-Factor Authentication (MFA): Enforced for all administrative, developer, and database access points.

Rule 6(1)

Least-Privilege RBAC: Role-based access controls strictly limiting employee access to personal data based on job role.

Rule 6(1)

Network Perimeter Isolation: Web Application Firewalls (WAF), VPC isolation, and automated DDoS mitigation active.

Rule 6(1)

Immutable Security Audit Logging: Centralized SIEM logging of all data access, export, and administrative actions.

Rule 6(2)

Periodic Vulnerability & Penetration Testing: Scheduled VAPT and third-party code security audits completed.

Rule 6(1)

State automatically persisted in browser localStorage

Statutory Grounding & Legal Perimeter

Mandatory statutory clauses, rules, and gazette requirements enforceable under this checklist.

Enforceable Provisions:

Section 8(5)

Rule 6

Section 33

Statutory Context:

This checklist is directly anchored in s.8(4)/(5) + r.6 + Ch. 15: the safeguard-control map rows, reasonableness decision records, log retention. Failure to maintain verifiable affirmative proof of compliance exposes the enterprise to severe adjudication penalties under Section 33 (Schedule) of the DPDP Act.

Target Architecture & Impacted Systems

Enterprise applications, stores, and integration surfaces evaluated by this checklist.

View Full Systems Topology (SYS-001..014) →

In-Scope System Nodes:

SYS-005 Architecture Spec →

Analytics & AI/ML Training Environment

Model training and algorithm development node gated against unconsented data

SYS-006 Architecture Spec →

HRMS & Applicant Tracking System

Internal employer database holding employee payroll and candidate records

SYS-008 Architecture Spec →

Foreign-Region Secondary Backup Replica

Offshore disaster recovery replica; isolated pending cross-border transfer checks

SYS-014 Architecture Spec →

Restore Quarantine & Sandbox Store

Isolated test environment ensuring recovered backups pass tombstone replay

Associated Operational Controls (54 OBLs)

Control Master Matrix obligations directly tested by this checklist.

Open Control Matrix →

OBL-11 Workpaper →

Control Dossier OBL-11

OBL-17 Workpaper →

Control Dossier OBL-17

Audit & Implementation Guidance

Best practices for establishing evidence, avoiding traps, and conducting periodic assurance.

Evidence Retention Standard

Do not rely solely on policy documents or statements of intent. Ensure verifiable evidence artifacts (cryptographic logs, test manifests, signed DPA agreements, or automated crawler receipts) are archived for at least 1 year.

Common Implementation Trap

Avoid declaring compliance based on frontend UI alone. The Data Protection Board evaluates the full data pipeline, including database persistence, read replicas, cache invalidation, and third-party processor synchronization.

Previous Checklist

C-15 — The Transfer Flow Checklist

Next Checklist

C-17 — The SDF Readiness Checklist