# DPDPA Threat Model Template # LINDDUN + STRIDE per DFD element, tagged to DPDPA sections and DPDP Rules. # # Usage: # 1. Copy this file to your repo as threat-model.yaml (root or per-service) # 2. Fill in the system_info block # 3. Add one entry under dfd_elements for each node and trust boundary in your DFD # 4. Run pipeline/threat-model-gate.yml on every PR that touches this file # # Legal anchor: DPDPA 2023 Section 8(5) (reasonable safeguards) and # Section 10(2)(c)(i) (DPIA for Significant Data Fiduciaries) # Framework: LINDDUN (KU Leuven) + STRIDE (Microsoft) # --------------------------------------------------------------------------- # System Metadata # --------------------------------------------------------------------------- system_info: name: "My System Name" # e.g. "LoanOrigination API" version: "1.0.0" # increment on material DFD changes assessed_by: "" # security engineer or team dpo_reviewed_by: "" # DPO name — required for SDF DPIA last_updated: "2026-04-10" # ISO 8601 classification: "confidential" data_principal_count_estimate: 0 # approximate, for SDF threshold tracking is_significant_data_fiduciary: false # set true if notified by the Central Government per S.10(1) # Whether the Data Fiduciary / system involves any of these triggers: # (Each adds mandatory LINDDUN/STRIDE scope items below) scope_flags: children_data: false # S.9 — stricter consent, no tracking/behavioural ads cross_border_transfer: false # S.16 — Section 16 transfer controls data_processor_boundary: false # S.8(1)-(2) — contractual obligations consent_manager_integration: false # S.6(7)-(9) — zero-knowledge architecture # --------------------------------------------------------------------------- # DFD Elements # Each element is a node (process, store, external entity) or trust boundary # in your Data Flow Diagram. Every element that handles personal data needs # a LINDDUN and STRIDE assessment. # --------------------------------------------------------------------------- dfd_elements: # ------------------------------------------------------------------------- # EXAMPLE — Remove before production use # ------------------------------------------------------------------------- - id: "EX-01" element_type: process # process | store | external_entity | trust_boundary name: "Consent Service" description: "Records and manages Data Principal consent per Section 6(10)" dpdpa_actor: data_fiduciary # data_principal | data_fiduciary | data_processor | consent_manager lawful_basis: consent # consent | legitimate_use | legal_obligation | vital_interest | public_task purposes: - id: "P01" label: "loan_origination" retention_days: 730 # example: set to your purpose-completion period per S.8(7); sectoral laws (SEBI/RBI/IT Act) may require a longer floor retention_legal_anchor: "S.8(7)" # cite applicable sectoral law where it imposes a longer period (e.g. "S.8(7) + SEBI Circular") personal_data_categories: - "email" - "phone" - "consent_timestamp" # LINDDUN Assessment linddun: linkability: present: true description: "Cross-purpose correlation of consent events could reveal behavioural patterns" mitigation: "Partition consent store by purpose; prohibit cross-purpose joins at application layer" mitigation_tested: false # set true once unit/integration test covers this dpdpa_sections: ["S.6(1)"] # add "S.9(3)" if the flow involves children severity: medium # critical | high | medium | low identifiability: present: true description: "Phone number in consent record is a direct identifier" mitigation: "Store HMAC(phone, scoped_key) instead of plaintext; recover only on lawful DSR" mitigation_tested: false dpdpa_sections: ["S.2(t)", "S.8(5)"] severity: high non_repudiation: present: true description: "Immutable consent log conflicts with S.8(7) erasure right" mitigation: "Cryptographic erasure: destroy per-principal DEK; retain event hash without PII" mitigation_tested: false dpdpa_sections: ["S.6(10)", "S.8(7)"] severity: high detectability: present: false description: "Consent service is an internal API; not directly exposed to unauthenticated callers" mitigation: "N/A for this element" dpdpa_sections: [] severity: none disclosure: present: true description: "Consent records written to unencrypted application logs" mitigation: "PII scrubbing middleware strips identifiers before log sink; Rule 6(1)(a) encryption at rest" mitigation_tested: false dpdpa_sections: ["S.8(5)", "S.8(6)", "Rule 6(1)(a)"] severity: high unawareness: present: true description: "Consent notices served only in English despite regional user base" mitigation: "Internationalised notice rendering per Section 5(3) — English or any of the 22 Eighth Schedule languages" mitigation_tested: false dpdpa_sections: ["S.5(1)", "S.5(3)", "Rule 3"] severity: medium non_compliance: present: true description: "No automated purge for records beyond retention period" mitigation: "Scheduled monthly retention purge job; alerts on overdue records" mitigation_tested: false dpdpa_sections: ["S.8(7)", "Rule 8"] severity: high # STRIDE Assessment stride: spoofing: present: true description: "Section 12 erasure/correction requests could be submitted on behalf of another Data Principal" mitigation: "Independent identity verification (OTP + consent_id) before DSR processing" mitigation_tested: false dpdpa_sections: ["S.11", "S.12"] severity: high tampering: present: true description: "SQL injection via malformed purpose_id could alter consent_status" mitigation: "Parameterised queries; ORM with schema validation; signed event log" mitigation_tested: false dpdpa_sections: ["S.2(u)", "S.6(10)", "Rule 6(1)(a)"] severity: critical repudiation: present: true description: "No cryptographic proof that breach notification was sent to Data Principal" mitigation: "Delivery receipt logged with HMAC signature; Rule 7(2)(b)(vi) timeline recorded" mitigation_tested: false dpdpa_sections: ["S.6(10)", "Rule 7(2)(b)(vi)"] severity: high information_disclosure: present: true description: "CloudWatch log group accessible to all IAM users in account; contains consent events" mitigation: "Resource-based policy restricting log access to consent-service role only" mitigation_tested: false dpdpa_sections: ["S.2(u)", "S.8(5)", "Rule 6(1)(a)"] severity: high denial_of_service: present: true description: "Flood of consent grant/revoke requests could degrade service; Data Principals cannot exercise rights" mitigation: "Rate limiting per principal_id; circuit breaker; consent service runs in separate replica set" mitigation_tested: false dpdpa_sections: ["S.2(u)", "Rule 6(1)(d)"] severity: medium elevation_of_privilege: present: true description: "Data Processor engineer with production DB access can query consent records outside DPA scope" mitigation: "Column-level encryption; processor role restricted to purpose-scoped view; contractual obligation per Rule 6(1)(f)" mitigation_tested: false dpdpa_sections: ["S.8(1)", "S.8(2)", "Rule 6(1)(f)"] severity: high # ------------------------------------------------------------------------- # BLANK TEMPLATE — Copy for each additional DFD element # ------------------------------------------------------------------------- - id: "" # e.g. "DF-02", "ST-01", "EE-01", "TB-01" element_type: process # process | store | external_entity | trust_boundary name: "" description: "" dpdpa_actor: data_fiduciary lawful_basis: consent purposes: [] personal_data_categories: [] linddun: linkability: present: false description: "" mitigation: "" mitigation_tested: false dpdpa_sections: [] severity: none identifiability: present: false description: "" mitigation: "" mitigation_tested: false dpdpa_sections: [] severity: none non_repudiation: present: false description: "" mitigation: "" mitigation_tested: false dpdpa_sections: [] severity: none detectability: present: false description: "" mitigation: "" mitigation_tested: false dpdpa_sections: [] severity: none disclosure: present: false description: "" mitigation: "" mitigation_tested: false dpdpa_sections: [] severity: none unawareness: present: false description: "" mitigation: "" mitigation_tested: false dpdpa_sections: [] severity: none non_compliance: present: false description: "" mitigation: "" mitigation_tested: false dpdpa_sections: [] severity: none stride: spoofing: present: false description: "" mitigation: "" mitigation_tested: false dpdpa_sections: [] severity: none tampering: present: false description: "" mitigation: "" mitigation_tested: false dpdpa_sections: [] severity: none repudiation: present: false description: "" mitigation: "" mitigation_tested: false dpdpa_sections: [] severity: none information_disclosure: present: false description: "" mitigation: "" mitigation_tested: false dpdpa_sections: [] severity: none denial_of_service: present: false description: "" mitigation: "" mitigation_tested: false dpdpa_sections: [] severity: none elevation_of_privilege: present: false description: "" mitigation: "" mitigation_tested: false dpdpa_sections: [] severity: none # --------------------------------------------------------------------------- # Residual Risk Summary (filled by assessor after all elements are complete) # --------------------------------------------------------------------------- residual_risks: - element_id: "" threat_type: "" # LINDDUN category or STRIDE category description: "" accepted_by: "" # DPO or CISO name accepted_date: "" review_date: "" # next scheduled review # --------------------------------------------------------------------------- # Sign-Off # --------------------------------------------------------------------------- sign_off: security_engineer: name: "" date: "" dpo: name: "" date: "" ciso: name: "" date: ""