Digital Personal Data Protection Act · Control IR-001 · Priority: critical · Component: Incident Response

What this control covers

Implement a Personal Data Breach Response procedure including: (i) breach detection and classification (personal data breach vs. non-personal breach); (ii) DPB notification in prescribed form under Rule 7 (immediately upon discovery); (iii) 72-hour detailed breach report to DPB; (iv) breach register with detection timestamp, notification timestamp, and root cause; (v) annual breach response simulation. Objective: Ensure timely and compliant notification to the Data Protection Board upon any personal data breach, minimising penalty exposure and demonstrating proactive compliance.

Why it matters

How quickly and methodically you contain an incident determines the regulatory consequence — most fines are not for the breach itself but for the slow or absent response.

How to implement

AWS

Wire GuardDuty, Security Hub and Macie findings into your ticketing/SIEM via EventBridge. Maintain documented playbooks for IAM-key compromise, EC2 instance compromise, S3 data exposure, and run quarterly tabletop exercises.

Azure

Use Defender for Cloud + Microsoft Sentinel with playbooks (Logic Apps) for automated containment — disable user, isolate VM (NSG), revoke session tokens. Keep an on-call rotation in Teams with PagerDuty.

GCP

Use Cloud KMS with customer-managed encryption keys (CMEK) for BigQuery, GCS, and Compute. Sensitive Data Protection (DLP API) inspects/de-identifies PII at scale.

Google Workspace

Enable client-side encryption for Drive/Docs and turn on Drive Labels + DLP rules to prevent external sharing of regulated data classes.

GitHub

Subscribe to secret-scanning alerts and Dependabot security advisories; require triage SLAs by severity. For exposed secrets, rotate at the cloud provider FIRST then revoke at GitHub — order matters.

Evidence to collect

  • ticketing_workflow — See the iCompaas Evidence library for the canonical source for this evidence type.
  • policy_document — A signed, version-controlled policy stating leadership intent and the named owner.

Signed policies, procedures, and registers document the safeguard. Service management or grievance ticketing records prove timely handling. Focus: Personal Data Breach - DPB Notification.

Quick checklist

  • Implement — Personal Data Breach / Dpb Notification
  • Ensure — Personal Data Breach / Dpb Notification

Related articles on this site