SCENARIO C06 · SECURITY & BREACH
A teammate says encryption means any personal-data breach is irrelevant. What should incident planning include?
IN PLAIN ENGLISH
Why you are seeing this step
This field note uses one realistic decision to separate the official source, an editorial interpretation, a practical option, evidence to keep, and any uncertainty that still depends on your facts.
Educational only, not legal advice. Source status is dated 13 May 2027; inspect the official links below before relying on it.
BEST NEXT STEP
Assess the breach facts, safeguards and required communications; do not treat one control as an exemption.
Record the control state and incident facts, then follow the correct communication path. Avoid the unrelated Act section 9 children’s-data citation.
WHY THE OTHER INSTINCTS MISS
Assess the breach facts, safeguards and required communications; do not treat one control as an exemption.
Correct. Act section 8(5)–(6) separates reasonable safeguards from breach intimation duties; future Rules 6–7 add detail.
Close every incident if encrypted data was involved.
Encryption context can affect risk, but it does not erase the need to assess what happened and which duties apply.
Notify only after the investigation has every answer.
Future Rule 7 separates without-delay information from later detailed Board information.
BUILD THIS EVIDENCE
Incident timeline, affected-data analysis, safeguard evidence, notices and decision log.
This artefact supports review. It does not certify compliance or replace advice on your facts.
- Guidance type
- legal requirement
- Pinpoint
- Act s. 8(5)–(6); Rules 6–7; G.S.R. 843(E) and 846(E)
- Reviewed
- 2026-08-30
- Change note
- Status and pinpoint reviewed against the official Act, final Rules, commencement notification and corrigendum for this educational website.
OFFICIAL SOURCE TRAIL
Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) ↗
Definitions and specified machinery provisions are operative; most substantive duties and rights are notified for later commencement. Check each scenario's status record.
Act s. 1(2); provision-specific section pinpointsDigital Personal Data Protection Rules, 2025 (G.S.R. 846(E)) ↗
Final Rules with phased commencement. Scenario pinpoints identify the particular Rule being taught.
Rule 1(2)–(4), read with the corrigendumDPDP Act commencement notification G.S.R. 843(E) ↗
Appoints immediate, one-year and eighteen-month commencement cohorts for the Act.
G.S.R. 843(E), clauses (a)–(c)