K7 CyberSecurity has released a white paper highlighting how ransomware attacks can trigger breach-reporting obligations under India’s Digital Personal Data Protection (DPDP) Act, even without data theft, if personal data becomes inaccessible.
The white paper, Turning DPDP Compliance into a Security-Led Capability: From Endpoint to SOC, examines the 72-hour reporting requirement, evidence preservation, third-party accountability and AI-powered Security Operations Centres (SOCs).
It also highlights the need for enterprises to demonstrate that security safeguards are operational and effective. Commenting on implications for Indian enterprises, Ashok Harris, Co-founder and CEO, K7 CyberSecurity, highlighted that DPDP readiness is not just about documenting safeguards; enterprises must demonstrate that they work.
From 13 May 2027, a ransomware incident that makes personal data inaccessible can trigger breach notification even without theft. Boards should ask: can we establish what happened, which controls worked and how we responded? Connecting protection, investigation and evidence from endpoint to SOC helps answer that.
As AI enters security operations, organisations must also understand where their security data is processed.