DATA PROTECTION & IT SECURITY CHECKLIST
Information security and privacy safeguards for the organisation
Access & Identity
- ☐ Enforce strong password and MFA policy
- ☐ Grant access on least-privilege basis
- ☐ Revoke access promptly on employee exit
- ☐ Review user access rights periodically
Device & Network
- ☐ Install antivirus and keep systems patched
- ☐ Configure firewall and secure Wi-Fi
- ☐ Encrypt laptops and portable storage
- ☐ Restrict use of unauthorised USB / software
Data & Backup
- ☐ Classify data by sensitivity
- ☐ Take regular backups and test restoration
- ☐ Store backups securely off-site / cloud
- ☐ Mask / encrypt personal and financial data
Compliance & Privacy
- ☐ Publish a privacy policy on collection and use
- ☐ Obtain consent for personal data processing
- ☐ Align practices with the DPDP Act, 2023
- ☐ Sign data-processing agreements with vendors
Response & Awareness
- ☐ Maintain an incident response plan
- ☐ Log and monitor for suspicious activity
- ☐ Train staff on phishing and safe practices
- ☐ Report notifiable breaches to CERT-In
Note: Under the DPDP Act, mishandling personal data can attract significant penalties, so review controls regularly.