Digital Personal Data Protection Act · Control SE-001 · Priority: critical · Component: Security

What this control covers

Encrypt all personal data at rest and in transit using industry-standard algorithms (AES-256 for rest, TLS 1.2+ for transit). Apply data masking or tokenisation for personal data in non-production environments and display contexts. Objective: Prevent unauthorised access to personal data through encryption, reducing breach impact and demonstrating reasonable security safeguards under Rule 6(1).

Why it matters

Encryption and key management make data unreadable to attackers and unintelligible under data-breach safe-harbour clauses — a meaningful regulatory benefit.

How to implement

AWS

Default to SSE-KMS with customer-managed keys for S3/EBS/RDS/Secrets Manager. Use S3 Bucket Keys and S3 Block Public Access at the account level, and turn on S3 Object Lock on backup buckets for ransomware resilience.

Azure

Store secrets in Key Vault (HSM-backed where required) with soft-delete + purge protection; use customer-managed keys for Storage, SQL, and Azure Disk Encryption. Tag PII data via Microsoft Purview.

GCP

Use Cloud KMS with customer-managed encryption keys (CMEK) for BigQuery, GCS, and Compute. Sensitive Data Protection (DLP API) inspects/de-identifies PII at scale.

Google Workspace

Enable client-side encryption for Drive/Docs and turn on Drive Labels + DLP rules to prevent external sharing of regulated data classes.

Evidence to collect

  • infra_scan — See the iCompaas Evidence library for the canonical source for this evidence type.
  • policy_document — A signed, version-controlled policy stating leadership intent and the named owner.

Signed policies, procedures, and registers document the safeguard. Infrastructure posture tooling (AWS/Azure/GCP configuration, encryption, backup, logging) verifies technical enforcement. Focus: Encryption & Data Masking.

Quick checklist

  • Encrypt — Encryption / Data Masking

Related articles on this site