# India DPDP Act 2023 SE-002 — Role-Based Access Control (RBAC) & Least Privilege

- Source: https://support.icompaas.com/compliance/india-dpdp-act-2023/se-002-role-based-access-control-rbac-least-privilege
- Section: [Compliance](https://support.icompaas.com/compliance) › [Digital Personal Data Protection Act, 2023 (India)](https://support.icompaas.com/compliance/india-dpdp-act-2023) › Security (SE)
- Last updated: 2026-06-05
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**India DPDP Act 2023**·Control `SE-002`·high·Component: **Security**

## What this control requires

> Implement role-based access control (RBAC) for all systems containing personal data, enforcing least-privilege access. Conduct quarterly access reviews. Disable credentials unused for 90 days. Enforce MFA for all users with access to personal data systems. Objective: Prevent unauthorised access to personal data by limiting access to only those with a legitimate business need, in accordance with Rule 6(1).
> 
> — India DPDP Act 2023, Control SE-002

### In plain English

Implement role-based access control (RBAC) for all systems containing personal data, enforcing least-privilege access. In practice, this means you can prove you implement role-level controls on a defined cadence.

## Why it matters

Penalties under the DPDP Act reach ₹250 crore per instance of significant non-compliance, and the Act applies extra-territorially to any entity processing personal data of individuals in India in connection with offering goods or services.

This control is rated **high**. Auditors expect a named owner, a remediation SLA, and a tooling artefact that evidences continuous operation.

## What an auditor looks for

Indian DPAs and statutory auditors will look for: documented consent capture and revocation flows, a designated Data Protection Officer (for Significant Data Fiduciaries), breach-notification workflows tied to Data Protection Board notification timelines, and Records of Processing that match the consent notice the user saw.

Within **Security**, the assessor will trace your implementation back to the catalogue reference (Control SE-002) and look for objective evidence on the latest two assessment cycles.

## How to implement

1.  Write a short policy stating intent, scope and named owner.
2.  Encode it as a platform guardrail — SCP, Azure Policy initiative, Organisation Policy, or repository policy.
3.  Wire a monitoring signal that catches drift (CSPM rule, SIEM rule, scheduled query, Workspace alert) and ticket it.
4.  Review on a documented cadence and capture the review in the risk register or compliance tracker.

### Operational checklist

-   **Implement.** Document the trigger, the owner and the cadence.
-   **Conduct.** Document the trigger, the owner and the cadence.
-   **Review.** Document the trigger, the owner and the cadence.
-   **Scope:** role, based access control (rbac), least privilege.

## Evidence to collect

-   **Identity Scan.** IAM / IdP exports — Entra ID, Okta, IAM Identity Center, Workspace directory — showing accounts, roles, MFA state and last sign-in.
-   **Policy Document.** A signed and version-controlled policy / standard / procedure document.

Signed policies, procedures, and registers document the safeguard. IAM analytics confirm RBAC, MFA, and access reviews. Focus: Role-Based Access Control (RBAC) & Least Privilege.

## How it maps to other frameworks

Computed from shared tags, control component and key-operation subjects — handy when you are reconciling controls across an audit.

-   [**NIST SP 800-171 Rev. 3 3.1.7** — Least Privilege - Privileged Functions](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-1-7-least-privilege-privileged-functions)
-   [**ISO/IEC 27701:2025 A.3.9** — Access rights](https://support.icompaas.com/compliance/iso-27701-2025/a-3-9-access-rights)
-   [**NIST SP 800-53 Rev. 5 AC-6(10)** — Prohibit Non-Privileged Users From Executing Privileged Functions](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5/ac-6-10-prohibit-non-privileged-users-from-executing-privileged-functions)
-   [**ISO/IEC 27001:2022 A.8.2** — Privileged access rights](https://support.icompaas.com/compliance/iso-27001-2022/a-8-2-privileged-access-rights)
-   [**CIS Controls v8 6.7** — Centralize Access Control](https://support.icompaas.com/compliance/cis-controls-v8/6-7-centralize-access-control)

## References

-   [Ministry of Electronics and Information Technology (India) — India DPDP Act 2023](https://www.meity.gov.in/content/digital-personal-data-protection-act-2023)
-   Catalogue identifier: `Control SE-002`

Topics: identity accessprivileged accessdata protectionidentity managementaccess reviewmulti factor auth

## Related compliance guidance

- [India's DPDP Act 2023: a practical compliance guide for cloud teams](https://support.icompaas.com/compliance/india-dpdp-act-2023): Start with the full DPDP Act implementation guide — scope, roadmap, evidence and how the assessment runs.
- [GDPR compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/gdpr): Most teams extend an existing GDPR programme to India; this guide shows where the lawful bases, timelines and breach rules differ.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): Rule 6's reasonable security safeguards map almost one-to-one onto ISO 27001 Annex A controls you may already operate.