Topic starter
06/11/2026 6:40 pm
TL;DR: Unosecur’s analysis of DPDPA compliance finds identity governance is the practical proof of reasonable security for personal data. For practitioners, that pushes access visibility, reviewability and processor oversight to the centre of breach prevention and regulatory defence.
Editorial analysis by NHI Mgmt Group, based on content published by Unosecur: “DPDPA Doesn't Say "Identity." But Every Section of It Depends on It.”.
Key questions
Q: Why do logs matter for proving reasonable security safeguards?
A: Logs matter because they create durable evidence of authentication, privilege use, approvals, changes and access attempts.
Q: What is the difference between purpose limitation and access control?
A: Purpose limitation governs why personal data may be collected and used, while access control governs who may reach it.
Q: How should organisations govern access to personal data under DPDPA?
A: They should treat identity as the enforcement layer for personal-data access.
Practitioner guidance
- Map every identity that can touch personal data Build a current inventory of human, service and third-party identities that can reach personal data across cloud, SaaS and on-prem systems.
- Tie access to declared processing purpose Review entitlements against the purpose for which personal data is processed and remove access that is no longer justified by that purpose.
- Unify access evidence across systems Correlate logs and entitlement changes so you can answer who accessed personal data, when they did it and under what authority.
Bottom line: DPDPA compliance now depends on whether an organisation can control and justify access to personal data, not just describe its privacy rules.
What's in the full article
Unosecur's full blog post covers the operational detail this post intentionally leaves for the source:
- How the Unified Identity Fabric maps human and non-human identities across cloud, SaaS and on-prem systems
- Examples of the access evidence needed to answer regulator and auditor questions in hours, not weeks
- Operational ways to detect excessive privileges, dormant accounts and orphaned identities before they become exposure
- How the platform correlates identity events to support breach assessment and remediation
👉 Read Unosecur's analysis of how DPDPA makes identity control central to reasonable security →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
DPDPA makes identity the evidentiary layer of privacy compliance: the law’s practical test is not whether a privacy policy exists, but whether the organisation can prove who accessed personal data and why. That turns entitlement ownership, reviewability and access evidence into compliance artefacts, not just security controls. Boards should read this as a proof problem, not a paperwork problem.
A question worth separating out:
Q: How do processor accounts change privacy risk?
A: Processor accounts increase privacy risk because they give a third party authenticated access to personal data under your controller’s instructions. If those accounts are shared, over-privileged, unreviewed or not offboarded, they can expose more data than intended and obscure accountability. Separate named accounts, least privilege, session logging and periodic access reviews reduce that risk.
👉 Read our full editorial: DPDPA makes identity control the proof of reasonable security