Compliance, DLP, and monitoring - written straight
Practical posts on DPDP compliance, data loss prevention, and what transparent monitoring actually looks like for Indian professional services firms. No "10x your productivity" filler.
Screenshots can't be turned on without an approved DPIA - here's the actual mechanism
Not a policy suggestion. How recording, approval, and the org-level toggle actually connect - and what it replaced.
Being logged in isn't enough to approve a DPIA or enable screenshots
What a stolen session token still can't do, and why the friction only lands on a short, specific list of actions.
Any employee can flag a misclassified app. Only a manager can override one.
The actual split between flagging a problem and fixing it - and why every override is scoped, never global.
DPDP Rules 2025 don't take effect on one date - they take effect on three
Three enforcement dates, not one: Nov 2025, Nov 2026, May 2027. What's already live, what changes in three months, and what firms should be doing right now.
The exact four-part check Custelis runs before a file transfer gets logged, warned, or blocked
No content scanning, no black box. The who/what/where/when model behind every DLP rule, and why prevention beats passive logging.
"We log file activity" isn't the same as "we have a client-data audit trail"
What actually needs tracking: who's assigned to what, access flagged against assignment, and a real gate on bulk exports.
A device on your network doesn't get to act just because a user logged in
Certificate, rotating token, replay protection - what every agent call has to prove, and how revocation kills access on the very next request.
Retention is set to delete your data automatically. Here's what stops it during an investigation
A legal hold is a per-employee exemption applied at the moment deletion runs - not a separate copy, not a manual workaround.
An "AI-assist" button drafts your DPDP response letter. It's structurally incapable of sending one
Record counts go to the model, not raw content - and only a human, calling a separate action, can save or send anything.