Knowledge Center
Compliance
Framework-by-framework guides to certification, attestation, and regulatory requirements.
Compliance
Security Awareness Training Requirements: ISO 27001, PCI DSS, HIPAA and NIST
Training is one of the most commonly audited controls because it is easy to ask for evidence and easy to fail to produce it. This guide summarizes what the main frameworks ask for, what auditors typically test, how to bu
9 min read
Compliance
Third-Party and Vendor Risk Management Under the DPDP Act
Most organizations rely on dozens or hundreds of vendors that touch personal data: cloud hosts, SaaS tools, payment processors, marketing platforms, call centers, and consultants. Each is a potential point of failure and
9 min read
Compliance
Significant Data Fiduciary Under the DPDP Act: Who Is Covered and What Changes
Most data fiduciaries must meet the Act's baseline duties. Some are expected to meet more. Whether an organization is an SDF is not self-declared: the Government designates it, considering factors in the Act. This guide
8 min read
Compliance
DPDP Data Retention and Erasure: How Long Can Businesses Keep Personal Data?
Storage limitation — keeping personal data no longer than necessary — is one of the seven principles on which the DPDP Act rests, alongside consent and transparency, purpose limitation, data minimisation, accuracy, secur
9 min read
Compliance
Data Mapping and Records of Processing Under the DPDP Act: Why Spreadsheets Aren't Enough
Most DPDP obligations cannot be met without a data inventory. You cannot notify individuals about purposes you have not listed, respond to an erasure request without knowing where copies are, assess a breach without know
9 min read
Compliance
Data Breach Response Under the DPDP Act: What Businesses Should Prepare For
A breach response is a set of decisions made quickly under pressure: what happened, whose data is affected, who must be told, and what to do about it. Under the DPDP framework, those decisions have legal consequences. Th
9 min read
Compliance
Cross-Border Data Transfers Under the DPDP Act: What Businesses Need to Know
Many Indian organizations send personal data abroad every day: cloud hosting, global SaaS tools, offshore support, group companies, and payment and analytics providers. Under the DPDP framework, the question is not wheth
8 min read
Compliance
DPDP Act Compliance Checklist: What Indian Businesses Need to Do
Compliance with a privacy law is easier when it is broken into concrete tasks with owners. This checklist is organized around what the DPDP Act and Rules ask of a data fiduciary. It is a readiness aid, not legal advice:
10 min read
Compliance
Children's Data Under the DPDP Act: Age Verification and Parental Consent in Practice
Children's data is one of the most heavily protected categories in the DPDP framework, and the age threshold — eighteen — is higher than in many other countries' laws. Any organization with an app, website, school or tut
8 min read
Compliance
SEBI CSCRF and VAPT: Requirements for Stock Brokers, Depositories and AMCs
Earlier SEBI guidance on VAPT was issued in separate circulars for stock brokers, depository participants, and mutual funds and asset management companies. The CSCRF brings SEBI's cybersecurity expectations into a single
9 min read
Compliance
What Is DPDP? India's Digital Personal Data Protection Framework Explained
Organizations that process the personal data of individuals in India are increasingly expected to show, not just assert, that they handle that data responsibly. This guide covers what DPDP is, why it matters, who it appl
8 min read
Compliance
Why Consent Management Matters Under DPDP: A Practical Guide for DPOs and Organizations
Consent management is an operational discipline that organizations need whether or not a specific regulatory deadline is imminent — but under DPDP, it also carries specific statutory requirements once those provisions ta
12 min read
Compliance
SOC 2: The Complete Guide to Trust Services Criteria and Compliance
SOC 2 (System and Organization Controls 2) is an attestation framework developed by the AICPA that evaluates how a service organization manages customer data, based on five Trust Services Criteria. Unlike a certification
8 min read
Compliance
PCI DSS: The Complete Guide to Payment Card Data Security Compliance
The Payment Card Industry Data Security Standard (PCI DSS) is a global security standard for any organization that stores, processes, or transmits cardholder data. It's maintained by the PCI Security Standards Council, f
8 min read
Compliance
ISO 27001: The Complete Guide to Information Security Management Certification
ISO/IEC 27001 is the internationally recognized standard for an Information Security Management System (ISMS) — a systematic, risk-based approach to managing an organization's information security. Unlike a checklist of
9 min read
Compliance
GDPR: The Complete Guide to EU Data Protection Compliance
The General Data Protection Regulation (GDPR) is the European Union's comprehensive data protection law, in force since May 2018. It governs how organizations collect, process, and store personal data of individuals in t
8 min read
Compliance
DPDP Act 2023: The Complete Guide to India's Digital Personal Data Protection Law
India's Digital Personal Data Protection Act, 2023 (DPDP Act) received Presidential assent on August 11, 2023, becoming the country's first comprehensive law governing how organizations collect, process, and store digita
7 min read