Back to Module
3 of 14|Obligations of Data Fiduciary
video 10 min•Security Safeguards
Logging
Keeping records of who accessed what data.
🎯 Learning Objectives
- ▸ Understand the purpose of logging
- ▸ Learn what to log and how long to keep logs
The Audit Trail
Without logs, you have no way of knowing if an employee maliciously accessed a celebrity's or patient's data. The DPDPA expects reasonable security, and logging is a fundamental part of that.
Logs should be tamper-proof and retained for a reasonable period (usually 6-12 months or longer depending on sectoral regulations).
📖 Glossary
- Audit Log
- A record of system activities that provides evidence of the sequence of activities that have affected a specific operation.
🔑 Key Takeaways
- Log every access, modification, and deletion of personal data.
- Secure the logs (a hacker should not be able to delete them).
- Logs are essential for investigations and audits.
📚 Further Reading
- NIST Cybersecurity Framework — NIST (2020)
Course Author
Shilpi Kulshrestha
Shilpi is a corporate lawyer with over a decade of experience in data protection, company law, and regulatory compliance. She has advised 50+ startups and enterprises on DPDPA readiness, privacy gover...