Your technical and organisational safeguards mapped directly against Rule 6 of the DPDP Rules 2025 — not a generic security checklist repurposed with a DPDPA label on it. This is the deep-dive security review the Gap Assessment's own security line-item points toward when more than a summary finding is needed.
Nothing here gets assumed from a generic security framework and relabelled — each area is mapped to what Rule 6 actually specifies.
Encryption, access controls and monitoring measures assessed against what Rule 6 actually specifies as reasonable security safeguards.
The policies, roles and training that support the technical controls — not the technical layer assessed in isolation.
Who can reach personal data, and whether that access actually matches real job need.
Whether the organisation would actually detect an incident quickly enough to meet its own notification timelines.
The security posture of the systems and vendors personal data actually passes through, not just your own environment.
Every finding traces back to what was actually tested against the Rule — not assumed.
The deep-dive complement to the Gap Assessment's own security coverage — not a duplicate of it.
Identify the systems, environments and data stores that hold personal data.
Sets the boundary for everything Rule 6 gets tested against in the stages that follow.
Test technical and organisational safeguards directly against Rule 6 requirements.
Tested directly — configurations and practices checked hands-on, not inferred from a policy document.
Score every gap by exposure and remediation effort.
Every finding cites the specific safeguard tested and how it fell short of Rule 6.
Walk through findings with technical and leadership stakeholders and sequence the fixes.
Split for two audiences — the technical detail for the team doing the fixing, the summary for whoever's approving the budget.
30 minutes to talk through scope, no obligation.
Book a Consultation