SCENARIO E06 · SECURITY & BREACH
A teacher exports student records to a personal device. Which answer separates law from implementation?
IN PLAIN ENGLISH
Why you are seeing this step
This field note uses one realistic decision to separate the official source, an editorial interpretation, a practical option, evidence to keep, and any uncertainty that still depends on your facts.
Educational only, not legal advice. Source status is dated 13 May 2027; inspect the official links below before relying on it.
BEST NEXT STEP
Apply future Rule 6 access/log safeguards and consider an approved-device control as the implementation.
State the legal safeguard outcome accurately, then document the device, access and monitoring controls chosen to meet it.
WHY THE OTHER INSTINCTS MISS
Apply future Rule 6 access/log safeguards and consider an approved-device control as the implementation.
Correct. Access control and logs are future minimum safeguards; an approved-device policy is one way to implement the objective.
Claim the Act expressly bans every personal device.
The cited provisions do not use that universal device-specific wording.
Allow the export if the file name is hidden.
Renaming a file is not access control, logging, masking or an assessed safeguard.
BUILD THIS EVIDENCE
Access policy, device rule, export log, exception approval and periodic review.
This artefact supports review. It does not certify compliance or replace advice on your facts.
- Guidance type
- legal requirement
- Pinpoint
- Act s. 8(5); Rule 6(1)(a)–(c); G.S.R. 843(E) and 846(E)
- Reviewed
- 2026-08-30
- Change note
- Status and pinpoint reviewed against the official Act, final Rules, commencement notification and corrigendum for this educational website.
OFFICIAL SOURCE TRAIL
Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) ↗
Definitions and specified machinery provisions are operative; most substantive duties and rights are notified for later commencement. Check each scenario's status record.
Act s. 1(2); provision-specific section pinpointsDigital Personal Data Protection Rules, 2025 (G.S.R. 846(E)) ↗
Final Rules with phased commencement. Scenario pinpoints identify the particular Rule being taught.
Rule 1(2)–(4), read with the corrigendumDPDP Act commencement notification G.S.R. 843(E) ↗
Appoints immediate, one-year and eighteen-month commencement cohorts for the Act.
G.S.R. 843(E), clauses (a)–(c)