# DPDPA Threat Modeling Quick Reference

**LINDDUN + STRIDE mapped to DPDPA obligations. Print and keep at your workstation.**

---

## LINDDUN → DPDPA

| Category | Privacy Property | Key DPDPA Sections | One-Line Test | Example Finding |
|----------|-----------------|-------------------|---------------|----------------|
| **L**inkability | Unlinkability | S.6(1); S.9(3) for children | Can two flows be joined to reveal a pattern beyond the consented purpose? | Ad platform correlates browsing across purposes without separate consent |
| **I**dentifiability | Anonymity | S.2(t), S.6(1), S.8(7) | Can quasi-identifiers in this store re-identify a "de-identified" Data Principal? | PIN code + DoB + gender = re-identification of health dataset |
| **N**on-repudiation | Plausible deniability | S.6(10), S.8(7) | Does the audit log prevent a Data Principal from exercising erasure rights? | Immutable consent ledger stores PII that cannot be erased |
| **D**etectability | Undetectability | S.8(5) | Does an HTTP status code or timing difference reveal whether a resource exists? | Signup API returns 409 for existing phone — reveals health app membership |
| **D**isclosure | Confidentiality | S.2(u), S.8(5), S.8(6), Rule 6(1)(a) | Is personal data written to a location accessible beyond the minimum-necessary set? | PII in unencrypted CloudWatch logs visible to entire SRE team |
| **U**nawareness | Transparency | S.5(1), S.5(3), S.11, Rule 3 | Does the Data Principal know what is collected, why, and in their language? | Background analytics SDK with no regional-language notice |
| **N**on-compliance | Compliance | All sections | Is any processing past its retention period, outside its purpose, or missing a control? | Records retained 8 years when purpose ended after 2 years |

---

## STRIDE → DPDPA

| Category | Violated Property | Key DPDPA Sections | One-Line Test | Example Finding |
|----------|-----------------|-------------------|---------------|----------------|
| **S**poofing | Authentication | S.6(1), S.11, S.12 | Can an attacker submit DSR requests or consent grants as another Data Principal? | Leaked email used to submit Section 12 erasure for victim's records |
| **T**ampering | Integrity | S.2(u), S.6(10), Rule 6(1)(a) | Can an attacker modify consent or personal data in transit or at rest? | SQL injection flips `consent_status = 'active'` without consent |
| **R**epudiation | Non-repudiation | S.6(10), Rule 7(2)(b)(vi) | Can the Fiduciary prove consent was given or breach notification was sent? | No delivery receipt; Fiduciary cannot prove Board was notified within 72h |
| **I**nformation Disclosure | Confidentiality | S.2(u), S.8(5), S.8(6), Rule 6(1)(a) | Can personal data escape the intended trust boundary? | Public S3 bucket exposes KYC document store |
| **D**enial of Service | Availability | S.2(u), Rule 6(1)(d) | Can an attack deny Data Principals the ability to exercise rights? | Ransomware locks consent DB — Data Principals cannot withdraw consent |
| **E**levation of Privilege | Authorisation | S.6(1), S.8(1)–(2) | Can a caller access personal data outside their consented purpose or DPA scope? | Processor engineer queries production PII outside contracted scope |

---

## DPDPA Sections Quick-Lookup

| Section / Rule | Obligation | Threat Model Hook |
|----------------|-----------|-------------------|
| S.2(t) | Personal data definition | Identifiability scope |
| S.2(u) | Personal data breach definition | STRIDE: I, D (triggers notification) |
| S.5(1) | Notice before collection | LINDDUN: Unawareness |
| S.5(3) | Notice option in English or any Eighth Schedule language | LINDDUN: Unawareness |
| S.6(1) | Consent + purpose limitation | LINDDUN: Linkability; STRIDE: E |
| S.6(10) | Burden of proof on Fiduciary | LINDDUN: N(on-rep); STRIDE: R |
| S.8(1)–(2) | Processor accountability | STRIDE: E; LINDDUN: N(comp) |
| S.8(5) | Reasonable security safeguards | All STRIDE + LINDDUN categories |
| S.8(6) | Breach notification | STRIDE: I, D → triggers Rule 7 |
| S.8(7) | Erasure when purpose complete | LINDDUN: N(rep), N(comp) |
| S.9(2)–(3) | Children: no processing likely to harm their well-being (9(2)); no tracking, behavioural monitoring or targeted ads (9(3)) | LINDDUN: L (9(3)), I, U |
| S.10(2)(c)(i) | SDF DPIA obligation | Full LINDDUN + STRIDE exercise |
| S.11–12 | Access, correction, erasure rights | STRIDE: S (DSR spoofing) |
| S.16 | Cross-border transfer | LINDDUN: N(comp) |
| Rule 3 | Notice content (itemised data, purposes, withdrawal, rights, complaint) | LINDDUN: Unawareness |
| Rule 6(1)(a) | Data security measures: encryption, obfuscation, masking, tokens | STRIDE: I, T |
| Rule 6(1)(b) | Access controls | STRIDE: E; LINDDUN: L |
| Rule 6(1)(c) | Logging / monitoring | STRIDE: R; LINDDUN: N(comp) |
| Rule 6(1)(d) | Backups + availability | STRIDE: D |
| Rule 6(1)(e) | Keep logs + personal data 1 year for breach detection | STRIDE: R; LINDDUN: N(comp) |
| Rule 6(1)(f) | Data Processing Agreements | STRIDE: E; LINDDUN: N(comp) |
| Rule 7(1), 7(2)(a) | Breach intimation to Data Principals + Board "without delay" | STRIDE: R |
| Rule 7(2)(b) | Detailed Board report within 72h (extendable on written request) | STRIDE: R |
| Rule 8 | Erasure periods (8(1)–(2)); 1-year minimum retention (8(3)) | LINDDUN: N(comp) |
| Rule 13(1)–(3) | SDF annual DPIA + audit, report to Board; algorithmic due diligence | Full LINDDUN + STRIDE |

---

## DFD Annotation Cheat Sheet

Add these 4 fields to every DFD element that handles personal data:

```
[Element Name]
 Actor:     data_principal | data_fiduciary | data_processor | consent_manager
 Basis:     consent | legitimate_use | legal_obligation | vital_interest
 Purpose:   loan_origination | kyc_verification | marketing | ...
 Retention: Xd (e.g. 2555d = 7 years if a sectoral law requires it) — S.8(7) anchor
```

**Trust boundary crossings:**
- → Data Processor: Rule 6(1)(f) DPA required
- → Outside India: Section 16 transfer control required
- → Data Principal: Section 5 notice must have been sent

---

## CI/CD Gate — Quick Checks

**PR includes threat-model.yaml change?**
- Every new DFD element needs ≥1 LINDDUN + ≥1 STRIDE finding
- Every `present: true` finding needs a `mitigation` string + `dpdpa_sections` list
- Gate: `pipeline/threat-model-gate.yml` fails build if any finding is incomplete

**PR changes Terraform or K8s manifests?**
- OPA policy `policies/dpdpa_purpose_scope.rego` evaluates encryption, purpose scope, retention, Section 16 transfer
- Gate: `conftest test --policy policies/dpdpa_purpose_scope.rego`

**System is an SDF (is_significant_data_fiduciary: true)?**
- `dpia-template.md` must exist alongside `threat-model.yaml`
- Gate: `pipeline/threat-model-gate.yml` job `dpia-coverage` blocks if missing

---

## Severity Rating Guide

| Severity | Definition | Example |
|----------|-----------|---------|
| **Critical** | Direct Section 2(u) breach vector; immediate exploitation possible | Unauthenticated access to personal data store |
| **High** | Indirect breach vector or material DPDPA obligation unmet | No encryption at rest; no consent withdrawal mechanism |
| **Medium** | Privacy harm possible under specific conditions; obligation gap | Cross-purpose data join without consent; no language support |
| **Low** | Process gap unlikely to cause material harm | Minor logging gap; borderline retention overage |

**Rule:** Any Critical or High finding blocks production deployment.

---

## Files in This Package

| File | Use When |
|------|---------|
| `threat-model-template.yaml` | Creating or updating a threat model for a DPDPA system |
| `dpia-template.md` | Completing a DPIA (mandatory for SDFs; recommended for all) |
| `dfd-annotation-guide.md` | Annotating DFDs before the LINDDUN + STRIDE exercise |
| `policies/dpdpa_purpose_scope.rego` | OPA policy bundle for CI/CD IaC evaluation |
| `pipeline/threat-model-gate.yml` | GitHub Actions gate for design-phase threat model validation |

**StateCheck Security | DPDPA Compliance Resources**
[https://statechecksecurity.com/free-assessment](https://statechecksecurity.com/free-assessment)