DPDP for Engineering Teams
- Connect day-to-day workflows to what you collect, disclose, and retain—on real user journeys.
- Review forms, integrations, and vendor access on a real journey.
- Document decisions so sales and product do not contradict support.
- When stakes are high, verify wording against official resources.
- Use the compliance portal to pick the next operational drill.
See also: Compliance portal · Official resources · Guides index
Engineering teams affect collection, storage, deletion, event logging, vendor integrations, and how quickly privacy drift appears after product changes.
What to review
- What systems store personal data
- What logs/events expose identifiable data — Rule 6(1)(e) and Rule 8(3) (Seventh Schedule purposes) set a general 1-year minimum retention for security logs and traffic data tied to breach detection, so "we delete logs fast" can itself be a compliance gap, not a win
- What deletion paths exist and where they break — erasure under Section 8(7)-(8) must actually propagate to processors too (Section 8(7)(b)), and Rule 8(2) requires a 48-hour advance notice before any scheduled automatic erasure runs
- What vendor integrations quietly expand data exposure