# DPDPA Zero Trust — Quick Reference Card

## Statutory Anchor

> **Section 8(5):** Data Fiduciary must protect personal data by taking reasonable security safeguards to prevent personal data breach.  
> **Section 8(4):** Data Fiduciary must implement appropriate technical and organisational measures (TOMs) to ensure effective observance of the Act and Rules.  
> **Penalty:** May extend to ₹250 crore for breach of S.8(5) (the Schedule, item 1; S.33(1)).

---

## Rule 6(1) Minimum Safeguards Checklist (in force 13 May 2027)

| # | Obligation (paraphrased) | ZTA Pillar | Done? |
|---|----------------------|-----------|-------|
| 6(1)(a) | Data security measures: encryption, obfuscation, masking or virtual tokens | Data, Application | ☐ |
| 6(1)(b) | Control access to the computer resources used by the Data Fiduciary or Data Processor (least privilege is the engineering reading; the Rule does not name it) | Identity, Device, Network | ☐ |
| 6(1)(c) | Visibility on access through logs, monitoring and review, to detect, investigate and remediate unauthorised access | Visibility | ☐ |
| 6(1)(d) | Continued processing if confidentiality, integrity or availability is compromised (e.g. backups) | Network, Data | ☐ |
| 6(1)(e) | Retain those logs and personal data for one year, unless another law requires otherwise | Visibility | ☐ |
| 6(1)(f) | Security-safeguard clauses in Data Processor contracts | All | ☐ |
| 6(1)(g) | TOMs to ensure effective observance of the safeguards (control reviews, testing) | All | ☐ |

---

## ZTA Pillar → DPDPA → ISO 27001:2022 → NIST CSF 2.0

| Pillar | DPDPA Rule | Key ISO Controls | NIST CSF 2.0 |
|--------|-----------|-----------------|-------------|
| Identity | 6(1)(b) | A.5.15, A.5.16, A.5.17, A.5.18, A.8.2, A.8.5 | PR.AA-01, PR.AA-03, PR.AA-04, PR.AA-05 |
| Device | 6(1)(b), 6(1)(g) | A.8.1, A.8.7, A.8.8 | PR.PS-01, PR.PS-02 |
| Network | 6(1)(b), 6(1)(d) | A.8.20, A.8.21, A.8.22 | PR.IR-01 |
| Application | 6(1)(a), S.8(5) | A.8.24, A.8.25, A.8.26 | PR.DS-02, PR.DS-10 |
| Data | 6(1)(a) | A.5.34, A.8.11, A.8.12 | PR.DS-01, PR.DS-02, PR.DS-10 |
| Visibility | 6(1)(c), 6(1)(e), 6(1)(g) | A.8.15, A.8.16 | DE.CM-01, DE.CM-09 |

---

## Common Legal Traps

| Trap | Correct Interpretation |
|------|----------------------|
| "Under DPDPA you have 72 hours before you must notify a breach" | **Wrong.** Rule 7 has two clocks: each affected Data Principal (7(1)) and the Board (7(2)(a)) are told "without delay"; the detailed Board report is due within 72 hours, extendable on written request (7(2)(b)). |
| "S.9 covers sensitive personal data" | **Wrong.** S.9 covers children (**under 18**) and, under S.9(1), persons with disability who have a lawful guardian. No sensitive-data category exists in DPDPA 2023. |
| "Cross-border transfers need an approved country list" | **Wrong.** S.16 is a negative-list model. Default is permissive; Central Govt restricts specific countries. |
| "DPDPA sets a 7-year retention floor" | **Wrong.** Rule 6(1)(e) (security logs) and Rule 8(3) (personal data, traffic data and processing logs) set a **one-year** minimum. 7 years comes from sectoral law (SEBI/RBI/IT Act); name that law. |

---

## Audit Logger Minimum Fields (Rule 6(1)(c))

```
timestamp | principal | resource | action | outcome | device_id | session_id | integrity_hash
```

- `integrity_hash`: SHA-256 of `json.dumps(event, sort_keys=True, ensure_ascii=False)`
- Log retention: ≥ 1 year (Rules 6(1)(e) and 8(3)); apply any longer sectoral requirement, naming the law
- `ensure_ascii=False`: mandatory — prevents hash divergence for non-ASCII names

---

## 6-Week Roadmap (Summary)

```
Wk 1-2  ▶  Foundation:  Data inventory + IAM baseline audit
Wk 2-3  ▶  Identity:    OPA deploy + JIT access + MFA
Wk 3-4  ▶  Network:     Micro-segmentation + mTLS + device posture
Wk 4-5  ▶  Data:        Encryption audit + pseudonymisation pipeline
Wk 5-6  ▶  Visibility:  Audit logging + SIEM wiring + quarterly schedule
```

---

*Generated by StateCheck Security content pipeline. Legal text sourced from DPDPA 2023 and DPDP Rules 2025 gazette. Verify all verbatim quotes against official gazette before publication.*