Digital Personal Data Protection Act · Control DS-001 · Priority: high · Component: Data Subject Rights

What this control covers

Implement a documented DSAR procedure covering the Right to Be Informed (Sec 11). The procedure must enable the organisation to provide data principals with: (i) summary of personal data being processed; (ii) description of processing activities; (iii) identities of all data fiduciaries with whom data has been shared and description of shared data; and (iv) any other information prescribed by Rules. Maintain a data sharing register to enable accurate fulfilment of (iii). Objective: Ensure data principals can exercise their information rights efficiently and within prescribed timelines, with accurate and complete responses.

Why it matters

Encryption and key management make data unreadable to attackers and unintelligible under data-breach safe-harbour clauses — a meaningful regulatory benefit.

How to implement

AWS

Default to SSE-KMS with customer-managed keys for S3/EBS/RDS/Secrets Manager. Use S3 Bucket Keys and S3 Block Public Access at the account level, and turn on S3 Object Lock on backup buckets for ransomware resilience.

Azure

Store secrets in Key Vault (HSM-backed where required) with soft-delete + purge protection; use customer-managed keys for Storage, SQL, and Azure Disk Encryption. Tag PII data via Microsoft Purview.

GCP

Use Cloud KMS with customer-managed encryption keys (CMEK) for BigQuery, GCS, and Compute. Sensitive Data Protection (DLP API) inspects/de-identifies PII at scale.

Google Workspace

Enable client-side encryption for Drive/Docs and turn on Drive Labels + DLP rules to prevent external sharing of regulated data classes.

On-premises

Maintain a policy library with a documented review cadence (annual minimum); store in your GRC tool with attestation tracking. Map each policy to controls so an audit pull cites the exact policy clause.

Evidence to collect

  • ticketing_workflow — See the iCompaas Evidence library for the canonical source for this evidence type.
  • policy_document — A signed, version-controlled policy stating leadership intent and the named owner.

Signed policies, procedures, and registers document the safeguard. Service management or grievance ticketing records prove timely handling. Focus: Data Subject Access Request (DSAR) - Information Rights.

Quick checklist

  • Maintain — Data Subject Access Request (Dsar) / Information Rights
  • Implement — Data Subject Access Request (Dsar) / Information Rights
  • Document — Data Subject Access Request (Dsar) / Information Rights

Related articles on this site