# Digital Personal Data Protection Act SE-003 — Personal Data Access Logging & SIEM Monitoring

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_dpdp_se003_08112b647b-digital-personal-data-protection-act-se-003-personal-data-access-logging-siem-monitoring
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [DPDP Act (India)](https://support.icompaas.com/support/solutions/c_gen_dpdpa) › [Security](https://support.icompaas.com/support/solutions/folders/f_gen_cgendpdpa_security)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Digital Personal Data Protection Act · Control SE-003 · Priority: high · Component: Security

### What this control covers

Log all access to personal data systems, including: user ID, timestamp, data accessed, action performed. Integrate logs into a SIEM for real-time monitoring and alerting. Set alerts for unauthorised access, unusual access patterns, and policy violations. Retain logs for minimum 1 year (Rule 6(1)(e)). Objective: Enable detection, investigation, and audit of all access to personal data, supporting breach detection and forensic investigation.

### Why it matters

You cannot investigate or attest what you did not log. This control underpins every incident-response capability and is what auditors will sample from for control operating effectiveness.

### How to implement

#### AWS

Turn on a **multi-region, organisation-wide CloudTrail** trail with log-file validation and ship to a dedicated, write-once **log archive account**. Enable **CloudTrail Lake** or stream to OpenSearch/Splunk for search. Pair with **GuardDuty**, **Security Hub**, and **VPC Flow Logs**.

#### Azure

Send **Activity logs** + diagnostic logs from every subscription to a central **Log Analytics workspace**. Stand up **Microsoft Sentinel** for SIEM/SOAR with the Azure, M365 and IdP connectors and pre-built analytics rules.

#### GCP

Centralize via **Cloud Logging** log sinks at the org level to a **locked log bucket** with 7-year retention. Use **SCC Premium** for posture findings and **Chronicle** for SIEM correlation.

#### Google Workspace

Forward the **Admin, Login, Drive, Token and Mobile** audit logs to Cloud Logging (Workspace BigQuery export). Alert on impossible-travel logins, OAuth-scope grants for high-risk scopes, and external Drive sharing of sensitive labels.

#### GitHub

Stream the **Enterprise audit log** to your SIEM and enable **Audit Log API** alerting on key events: owner changes, IP allowlist edits, secret deletions, repo visibility flips.

### Evidence to collect

-   `infra_scan` — See the iCompaas Evidence library for the canonical source for this evidence type.
-   `policy_document` — A signed, version-controlled policy stating leadership intent and the named owner.

Signed policies, procedures, and registers document the safeguard. Infrastructure posture tooling (AWS/Azure/GCP configuration, encryption, backup, logging) verifies technical enforcement. Focus: Personal Data Access Logging & SIEM Monitoring.

### Quick checklist

-   Log — Personal Data Access Logging / Siem Monitoring
-   Monitor — Personal Data Access Logging / Siem Monitoring

### Related articles on this site

-   [Ensure that 'Restrict user ability to access groups features in the Access Pane' is set to 'No'](https://support.icompaas.com/support/solutions/articles/62000219694-ensure-that-restrict-user-ability-to-access-groups-features-in-the-access-pane-is-set-to-no-)
-   [NIST 800-171 3.1.1 Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).](https://support.icompaas.com/support/solutions/articles/62000229223-nist-800-171-3-1-1-limit-information-system-access-to-authorized-users-processes-acting-on-behalf-of)
-   [NIST 800-171 3.14.5 Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed.](https://support.icompaas.com/support/solutions/articles/62000229236-nist-800-171-3-14-5-perform-periodic-scans-of-organizational-systems-and-real-time-scans-of-files-fro)
-   [CMMC 2.0 AC.1.001 Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems)](https://support.icompaas.com/support/solutions/articles/62000229379-cmmc-2-0-ac-1-001-limit-information-system-access-to-authorized-users-processes-acting-on-behalf-of-)

## Related compliance guidance

- [India's DPDP Act 2023: a practical compliance guide for cloud teams](https://support.icompaas.com/compliance/india-dpdp-act-2023): The DPDP Act and 2025 Rules explained as an implementation plan, including what is in force today.
- [GDPR compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/gdpr): A GDPR programme covers most DPDP obligations; the guide shows the overlap and the India-specific gaps.