Trending Articles

Introduction DPDPA Clause 6 sets specific conditions for consent as a lawful basis for processing personal data. Consent must be free, specific, informed, unconditional, and unambiguous. It must be as easy to withdraw as it is to give. The controller must be able to demonstrate that consent was given. These are not abstract principles. Each … Continue reading DPDPA Consent Management: What Explicit, Informed, and Withdrawable Looks Like Technically

Introduction Most IT teams at regulated organisations experience compliance audits as events. A notice arrives. A scramble begins. Access records are pulled from multiple systems. Provisioning history is reconstructed from email threads and IT tickets. Privileged session logs are exported and reformatted. Access review evidence is assembled from spreadsheets. The process takes weeks, involves multiple … Continue reading Continuous Compliance Posture: Why Audit Readiness Requires Infrastructure, Not Preparation

Introduction IRDAI ICS Annexure III Item 14 requires that all access to organisational systems be authenticated through a centralised authentication mechanism. This is not a recommendation to deploy SSO for user convenience. It is a compliance obligation with a specific architectural requirement: a single identity source, a unified authentication layer covering all systems, consistent MFA … Continue reading IRDAI Item 14: Centralised Authentication as a Compliance Requirement

Indian companies with EU customers, EU operations, or EU-based employees are subject to the General Data Protection Regulation regardless of where the company is incorporated. Article 3 of GDPR establishes extraterritorial scope: any organisation that offers goods or services to EU residents, or that monitors their behaviour, falls within the regulation. For Indian ITeS companies … Continue reading GDPR for Indian Companies: What EU Data Protection Law Requires From Your Technical Infrastructure

SOC 2 Type II has become a commercial prerequisite for Indian ITeS and BPO companies serving enterprise clients in North America and Europe. Enterprise procurement teams increasingly require a current SOC 2 Type II report before awarding contracts involving access to their systems, data, or infrastructure. For ITeS companies handling healthcare data, financial records, or … Continue reading SOC 2 Type II for Indian ITeS and BPO: Implementing Trust Services Criteria

ISO 27001:2022 reorganised the Annex A control set from 114 controls across 14 domains to 93 controls across four themes. The identity and access management controls that were previously spread across multiple domains are now consolidated primarily within Theme 5 (Organisational Controls) and Theme 8 (Technological Controls). The reorganisation did not reduce the technical requirements. … Continue reading ISO 27001:2022 Annex A Access Controls: A Technical Guide for IT and Security Teams

The Insurance Regulatory and Development Authority of India’s Information and Cyber Security Guidelines, 2023 apply to all insurers, re-insurers, and IRDAI-regulated intermediaries operating in India. The guidelines contain 348 checklist items in Annexure III covering identity and access management, endpoint security, privileged access, audit trails, user behaviour monitoring, and remote access controls. They are not … Continue reading IRDAI ICS Guidelines: Technical Requirements for Indian Insurance Companies

The Securities and Exchange Board of India’s Cybersecurity and Cyber Resilience Framework applies to all SEBI-regulated entities: stock brokers, depository participants, asset management companies, portfolio managers, investment advisers, registrars and transfer agents, and market infrastructure institutions. It is one of the most technically detailed cybersecurity frameworks issued by any Indian regulator, with 232 guidelines in … Continue reading SEBI CSCRF Explained: Technical Requirements for Capital Markets Entities

The Reserve Bank of India’s 2023 Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices applies to all RBI-regulated entities: scheduled commercial banks, urban cooperative banks, NBFCs, and payment system operators. It is not a guidance document. It is a mandatory framework with 103 compliance items spanning governance, access controls, audit trails, privileged … Continue reading RBI IT Governance and Cybersecurity Framework: What Regulated Entities Must Implement