Does a security dashboard show privacy readiness?
Reviewed by InfraVeritas360 ResearchFirst published Last reviewed
Sources: DPDP Act, 2023 and DPDP Rules, 2025 (MeitY)
Short answer: Only for the security part
Not by itself. A security dashboard shows alerts, patches and controls. It does not show whether notices were given, consent was recorded, requests were answered, vendors signed terms or data was deleted on time. Use it as evidence for the security duty only.
Why it matters
Section 8(5) is one duty among many in Sections 5 to 12.
- Section 8(5) · Rule 6: Protect personal data with reasonable security safeguards. Rule 6 lists the minimum: encryption, masking or tokenisation; access control; logs and monitoring; backups for continuity; keeping logs for at least one year; and security terms in contracts with processors.
- Section 5 · Rule 3: When you ask for consent, give a clear notice that stands on its own: what data, for what purpose, how to withdraw consent, how to use the rights and how to complain to the Data Protection Board. For data collected before the Act, a notice is due as soon as reasonably practicable.
- Sections 11–14 · Rule 14: People can ask for a summary of their data and who it was shared with, ask for correction, completion, updating or erasure, complain, and nominate someone to act for them. You must publish how to do this.
A worked example
An IT company's SOC dashboard is all green. The DPO points out it says nothing about candidate data retention or client deletion requests, which are reported separately.
Steps
- Map what the dashboard covers to Rule 6.
- List the duties it does not cover.
- Give those duties their own evidence.
- Show both to management side by side.
- Avoid one overall green status.
Evidence to keep
- Coverage map
- Evidence for other duties
Common mistakes
- Reporting a green SOC dashboard as DPDP readiness
- No owner for non-security duties
- One colour for everything
Who does what
- Information security / SOC department: A green dashboard is not evidence of privacy readiness.
What a good answer from management sounds like
“Our security dashboard covers Rule 6. Notices, consent, rights and deletion are reported separately with their own evidence.” Effort and time: Light.