Track Every DPDPA Risk. Prove You Acted.

DPDPA S.8(1) requires Data Fiduciaries to implement 'reasonable security safeguards' to prevent personal data breaches. A risk register is the primary evidence that your organisation has systematically identified, assessed, and treated risks to personal data. Without a documented risk register, you cannot demonstrate reasonable security to the Data Protection Board during an inquiry.

DPDPA Shield's risk register supports mapping to all major DPDPA obligation sections: S.5 (Consent), S.6 (Notice), S.8 (Security safeguards), S.9 (Children's data), S.10 (SDF obligations), S.11 (Rights requests), S.12 (Erasure), S.13 (Grievance), and S.14 (Nomination). The obligation field is used in the Regulatory Obligation Breakdown chart.

Inherent risk is the risk level before any controls are applied — your baseline exposure. Residual risk is the remaining risk after your mitigating controls are in place. The gap between inherent and residual score shows the effectiveness of your control environment. DPDPA Shield tracks both and displays the effective rating (falling back to inherent when residual is not yet assessed).

Risk Register is available on Growth, Business, and Enterprise plans. Starter plan users can view existing risks but cannot create or modify risk entries. Upgrading to Growth unlocks full read/write access.