Compliance, in plain language

Under India's DPDP Act, the entity that determines the purpose and means of processing personal data.

India's Digital Personal Data Protection Act 2023 — the national law governing how personal data is processed.

A structured assessment of privacy risks before starting high-risk processing of personal data.

A request by an individual to access, correct, or erase the personal data an organisation holds about them.

A model for quantifying information and cyber risk in financial terms rather than qualitative ratings.

The international standard for building and certifying an Information Security Management System (ISMS).

A measurable signal that provides early warning of rising risk exposure before it materialises.

A maintained inventory of how an organisation collects, uses, shares, and stores personal data.

A control that splits sensitive tasks across people so no single person can complete a risky action alone.

An AICPA attestation report on the controls a service organisation uses to protect customer data.

The ISO 27001 document listing which controls apply, why, and their implementation status.

The practice of assessing and monitoring the security and compliance risk that vendors introduce.

A public page where a company shares its security posture, certifications, and compliance documents.

A periodic review confirming each person's system access is still appropriate for their role.