DEV Community: EzSecure

Why File-Level Classification Is Important for Enterprise Compliance

EzSecure — Fri, 13 Nov 2026 07:40:40 +0000

Most organisations have policies that explain how sensitive information should be handled. They may have rules for customer records, employee information, financial documents and confidential business files. However, having these policies does not always mean organisations know where such information actually exists.

A customer spreadsheet may be stored in a shared folder, an employee record may appear in an old report, and financial information may be copied into multiple documents. When files move between departments and storage locations, keeping track of their contents becomes increasingly difficult.

This is where file-level classification becomes important. Instead of treating an entire folder or storage system as one category, organisations can identify the type of information contained within individual files. It gives compliance and IT teams a clearer understanding of what they hold and helps them make more informed decisions about how that information should be handled.

Understanding File-Level Classification in Enterprise Environments

File-level classification is the process of identifying and categorising information based on the actual content of individual files. It helps organisations distinguish between ordinary business documents and files containing personal, financial, healthcare or confidential information.

For example, a department folder may contain hundreds of documents. Some may include general reports, while others contain employee identification details, customer records or financial information. Treating every document in that folder equally does not provide enough context about the information being stored.

With file-level data classification, each document can be assessed according to the information it contains. This gives teams a more detailed understanding of their data instead of relying only on folder names, storage locations or assumptions about how files are used.
It also becomes easier to identify files that require additional attention during compliance reviews, internal assessments and data management activities.

Why Folder-Level Organisation Is Not Enough

Many businesses organise their information through departments, projects, teams and shared folders. Although this structure makes documents easier to access, it does not necessarily indicate whether the information inside them is sensitive.

Consider an HR folder containing recruitment documents, salary reports, employee details and general policy documents. All these files belong to the same department, but they do not contain the same type of information.

The same issue appears in finance, sales, customer support and legal departments. A shared folder may contain both routine business documents and records that include personal or financial information.

Relying only on folder-level organisation can therefore leave important details unnoticed. File-level classification provides a more precise view by identifying sensitive information within individual documents, even when those documents are stored alongside ordinary business files.

The Connection Between File Classification and Enterprise Compliance
Compliance requirements often involve understanding what information an organisation collects, stores and processes. Businesses cannot make informed decisions about their data practices if they have limited visibility into the information held across their environments.

For example, India's Digital Personal Data Protection (DPDP) Act, 2023 establishes obligations concerning the processing of digital personal data. Organisations need to understand the personal data they handle and consider how it is processed, retained and managed.

Similarly, privacy and industry-specific frameworks may require organisations to identify relevant information, review access arrangements and maintain appropriate security practices.

File-level classification can support these activities by helping teams identify documents containing information relevant to their compliance responsibilities.

It is important to understand that classification alone does not make an organisation compliant. It provides information that can support broader compliance processes, including data reviews, access assessments and internal governance.

Identifying Personal and Sensitive Information Across Files

One of the biggest challenges for enterprise teams is locating personal information across different departments and storage environments.
Personal information may appear in customer spreadsheets, employee documents, scanned records, contracts, financial reports and exported databases. Some files are actively used, while others may remain stored in older folders long after their original purpose has ended.

Without a consistent approach to sensitive data discovery and classification, teams may struggle to identify where this information exists.

A file-level approach helps organisations recognise different information categories, such as:

Personally identifiable information: Names, addresses, contact details and identification numbers.
Financial information: Bank account details, transaction records and financial statements.
Employee information: Salary records, personnel documents and employment details.
Healthcare information: Patient records and medical details.
Confidential business information: Internal reports, commercial documents and business plans.

Identifying these categories at the file level gives organisations a clearer picture of the information stored across their environments. It also helps them understand which files may need further review based on their internal policies and applicable requirements.

How Data Sprawl Makes Classification More Difficult

As organisations grow, their information rarely stays within one storage platform. Employees create copies of documents, share files between departments, download reports and move information between cloud repositories and local file servers.

Over time, the same sensitive information may appear in several locations. A customer record originally stored in one system could also exist in a spreadsheet, a shared folder or an archived report.

This creates data sprawl, where organisations have difficulty tracking how much information they hold and where it resides.

Manual reviews can help identify some of these files, but they become difficult to maintain as the volume of business information increases. Reviewing only selected folders may also leave other storage locations unchecked.

A structured enterprise data classification process helps address this challenge by identifying information within files across connected storage environments. It gives teams a more consistent view of sensitive information instead of depending entirely on manual checks.

Supporting Data Retention and Access Reviews

Classification becomes particularly useful when organisations review how information is stored and accessed.

Not every document needs to remain available indefinitely, and not every employee needs access to every type of business information. However, making these decisions becomes difficult when organisations do not know what individual files contain.

For example, an old project folder may contain routine project documents alongside customer records and confidential financial reports. A general review of the folder may not reveal these differences.

When files are classified according to their contents, teams can identify which documents may require further attention during retention reviews or access assessments.

This supports better-informed decisions about information handling. Classification does not automatically determine who should access a file or when it should be deleted, but it gives organisations useful context for applying their own policies.

The Role of File-Level Classification in DPDP Readiness

The DPDP Act has increased attention on how organisations identify and manage digital personal data. Businesses need to understand where personal information exists across their operations before they can properly assess their data processing practices.

This is not limited to information stored in dedicated customer databases. Personal data may also appear in everyday business files, including spreadsheets, employee records, shared documents and archived reports.

For organisations preparing for DPDP compliance, file-level classification can help identify documents containing personal information across different storage locations.

It can support practical activities such as:

Identifying files that contain personal information.
Understanding which departments and storage locations hold such information.
Reviewing copies of personal data across shared environments.
Supporting internal data mapping and compliance assessments.
Providing visibility that can inform retention and access reviews.

The DPDP Act and its Rules establish broader responsibilities that go beyond discovering and classifying information. However, knowing what personal data exists and where it resides is an important starting point for building a clearer compliance picture.

Improving Data Visibility Across Enterprise Storage

For many organisations, the difficulty is not simply identifying sensitive information. It is finding that information across the different platforms employees use every day.

Google Drive, Microsoft OneDrive, SharePoint and Windows File Server may all contain business documents with different types of information. Reviewing each platform separately can make it harder to maintain a consistent understanding of where sensitive files exist.
This is where sensitive data discovery becomes relevant. EzSecure helps organisations identify sensitive information within files and classify findings across connected storage environments.

By bringing findings from supported file sources into one view, teams can understand which files contain personal, financial, healthcare and other sensitive information. This provides useful context for compliance reviews and broader data management activities.

Organisations working on DPDP compliance and personal data visibility can use this understanding as part of their efforts to identify where personal information resides across their file environments.

Making Classification Part of Ongoing Data Management

File-level classification should not be treated as a one-time exercise. Business information changes continuously as employees create new documents, update existing records, share files and move information between storage locations.

A classification process that only covers an initial set of documents may gradually become less useful as new information enters the environment.
Organisations need a consistent approach to reviewing their data as storage environments grow. This includes understanding which files contain sensitive information, identifying where they reside and using those findings to support internal data management decisions.

The real value of file-level classification lies in the clarity it provides. It helps organisations move beyond assumptions about where sensitive information should exist and develop a better understanding of what their files actually contain.

As enterprise environments become more distributed, this level of visibility will remain an important part of practical compliance and responsible data management.

The Privacy Challenges of Using AI Browser Agents

EzSecure — Thu, 05 Nov 2026 08:28:59 +0000

AI‍‍‍ browser agents have become game changers by allowing a new way of internet navigation. Besides mere question answering or page summarization, such powerful devices can literally walk through websites, sign in on behalf of users, edit and complete form submissions, look through documents and basically automate tasks. It definitely speeds up work in this digital world, however, at the cost of raising some privacy issues for organizations.

The worry isn't just about the employee data that gets willingly uploaded onto an AI tool. In fact, AI browser agents have a capability of going through the data accessible to a user due to being logged in through accounts and using different apps connected to those online accounts. Therefore, when a business or a group is starting to experiment with such devices, it is crucial to know about what data and content an AI browser agent is able to reach and how it will treat that information as part of their plan on how to responsibly use ‍‍‍AI.

How AI Browser Agents Access Business Information

Traditional‍‍‍ browsers enable users to navigate websites, get information and do things via manual effort. AI browser agents go beyond the user experience by understanding instructions and performing several steps to finish a job.

As an illustration, an employee can request an AI agent to find information from different sources, compare files, draft a report or keep updating a company website with latest news. For performing the above actions, an agent will require access to websites, browser tabs, connected apps and logged-in accounts.

This leads to a much broader environment of information access. Through its tool and permitted functionalities, the agent could stumble upon customer information, confidential documents, personal info of employees or other sensitive company data types.

It is more crucial to know the limits of information that the agent can see as opposed to simply concentrating on the kind of job that the agent has ‍‍‍got.

Logged-In Accounts Can Expand Data Exposure

One‍‍‍ of the major privacy issues with AI browser agents is being able to work during authenticated sessions. In this case, for instance, if a staff is already logged in on a platform, an AI agent might, depending on the product's design and permissions, be able to access information via the session.

A situation could be that a staff member wants the agent to summarise information from a workplace app. While completing it, the agent could possibly run into mails, documents, customer information or internal records the user didn't mention when giving the initial instruction.

That said, it's important to note that not all browser agents have uncontrolled access across all accounts. The degree to which they can see such information will depend on their own capabilities, limitations set via configuration and what level of access users themselves grant. Nevertheless, it is up to businesses to understand these limitations well enough before permitting agents to handle company accounts.

Getting a closer look at the list of the apps that are integrated and narrowing access down to only what is really needed, is one way a business can cut down on exposing more than what is ‍‍‍necessary.

Hidden Instructions on Websites Can Create Privacy Risks

AI‍‍‍ browser assistants do not only engage with data inputted by a user, they can also extract, process and understand text that is outside of the user input context.

The agent might be exposed to the content from a webpage, a comment thread, an ad or other such materials while doing a task.
Owing to that, some of the mentioned materials could actually contain harmful directions that aim to control the agent.

The process above is referred to as prompt injection through third parties. Imagine, for instance, a scenario where a staff member asks an assistant to browse through a website and to summarise it. A malicious prompt embedded in that webpage could mislead the assistant's behaviour, making it for example to gather data from linked external sources or leak confidential materials externally.

Since the assistant can perform actions and not just text, the impacts go beyond an incorrect reply. There are cases where prompt injection has been used to gain access to sensitive data and conduct unwanted browser actions by the assistant.

Therefore, companies must be aware of the website content that their employees visit and ensure that those contents are not trusted even when a genuine AI tool is ‍‍‍used.

Sensitive Information Can Travel Beyond Its Original Context

Business‍‍‍ information is usually collected with a specific purpose in mind. Customer information could be kept for service purposes, employee records for administration and financial documents for internal reporting.

An AI browser agent when working with these data sources might include the information into its working context, send it to other connected services or upload it to websites as an activity of the action. The way these data handling operations are carried out depends on the agent itself and the services it is using.

Suppose, there is an agent working on the preparation of a business report; it comes across the document which contains customer contact information. If such a case involves handing over the summary to an external service, the organisation should know if the data that will get to the service may contain personal or confidential content.

Hence, the right thing is that businesses monitor which type of data is being made available to AI tools, whether that data could be transferred elsewhere and if such transference is in line with the purpose that prompted the collection of that information in the first ‍‍‍place.

Excessive Permissions Give AI Agents More Access Than Necessary

AI browser agents often need permissions to perform tasks. However, granting access to more applications, accounts or information than required can increase the impact of an unintended action.

An agent that only needs to review public webpages should not automatically receive access to internal company documents or email accounts. Similarly, an agent working on a limited task should not have unnecessary permission to modify records or share files.

Businesses should follow the principle of least privilege by providing only the access required for a particular activity. Permissions should also be reviewed when an employee's responsibilities change or an AI tool is no longer needed.

The objective is to make sure that the agent's access matches its intended purpose, rather than allowing convenience to determine how much information it can reach.

Business Data Policies Need to Account for Browser Agents

Many organisations already have policies covering employee access, file sharing, external applications and the use of AI tools. However, browser agents introduce another layer because they can interact with several information sources within a single task.

A general rule against uploading confidential documents to AI tools may not address every situation. Employees might use an agent to navigate a logged-in account, extract information from a webpage or transfer content between applications without manually uploading a file.

Businesses should therefore review their existing AI usage policies and consider browser-based agents separately. Employees should understand which tools are approved, what information can be accessed and which activities require additional review.

Clear guidance can help prevent employees from unknowingly exposing information while using tools intended to make their work easier.

Identifying Sensitive Data Before It Reaches AI Applications

Managing AI-related privacy risks also requires an understanding of the information an organisation already holds. Sensitive information may exist across shared folders, business documents and connected storage environments, making it difficult to assess exposure through manual reviews alone.

This is where sensitive data discovery and classification become relevant. Organisations need visibility into the types of information stored across their environments so they can make informed decisions about its use and sharing.

EzSecure helps organisations discover and classify sensitive information across connected repositories such as Google Drive, SharePoint, OneDrive and Windows File Servers. This provides visibility into where sensitive information exists and helps teams understand what may require closer attention.

Its AI Data Security capability can identify sensitive information before it reaches supported AI applications and apply configured actions such as Allow, Mask or Block. Organisations can explore these capabilities as part of a broader approach to managing sensitive information during AI usage.

Learn more about sensitive data discovery and how the EzSecure platform supports information visibility and classification across connected environments.

Building Responsible AI Browser Agent Practices

AI browser agents can make digital work more convenient, but their ability to interact with websites and connected accounts requires thoughtful oversight. Businesses should understand the permissions granted to these tools, review how they handle information and establish clear boundaries around their use.

A practical approach includes limiting unnecessary account access, reviewing connected applications, requiring human approval for sensitive actions and monitoring how information moves between systems. Organisations should also educate employees about indirect prompt injection and the possibility of encountering malicious instructions on websites.

As AI adoption expands, companies will need to consider not only which AI tools employees use but also what information those tools can access during everyday activities.

Better visibility into sensitive information is an important part of that process. By combining clear usage policies with data discovery and classification, organisations can make more informed decisions about where their information exists and how it is used in an increasingly agent-driven digital environment.

India's Data Leak Problem Highlights Gaps in Information Security

EzSecure — Mon, 02 Nov 2026 07:13:34 +0000

It‍‍‍ may not be a sophisticated cyberattack that sets off a data breach. Often the case that a company or other organisation's information is leaked is a combination of weak access policies and systems being incorrectly set up, or credentials being leaked and used by outsiders, or security gaps through external service providers.

A company or organisation may not detect a leak of information until another party comes forward to report the matter. They may even be unaware of it.

The Indian digital environment is changing rapidly with more individuals preferring to get their services delivered online. This growing reliance on digitised platforms opens up concerns regarding how the privacy of individuals and the secrecy of businesses are being handled. Government offices, banks, hospitals and private sector companies keep huge volumes of data running on interconnected digital systems. As such systems develop further, the risk of a security hole increases.

Public data breach statistics and suspected cases of information leaks reported from India point out the real challenges organisations have with their security systems. They must not be content with just the basics, but also be more thorough at examining where information is being allowed, with whom information is being shared, and who exactly is managing the information in which ‍‍‍ways.

India's Growing Cybersecurity Incidents Raise Data Security Concerns

The‍‍‍ amount of cyber security activities reported in India has surged in recent years. The Ministry of Electronics and Information Technology, through a report shared, stated that CERT-In reported cyber attacks of 15,92,917 incidents in 2023, 20,41,360 in 2024 and 29,44,248 in 2025.

These numbers indicate the general nature of the incident without going into specifics on data breaches hence no conclusions can be drawn as to the real cases of breaches, however, they do depict the increasing number of cases that agencies and governments would have to keep up monitoring as well as responding.

Apart from this, the Government has come up with various plans to better prepare the country for cyber security issues, CERT-In also issues alerts and advisories, manages incident response and gives guidance to organizations that have been affected by cyber incidents.

More than having security systems that protect you, businesses should know how to recognize a crisis quickly, how to get a handle on its impact, and how to respond appropriately. Organizations must also have processes in place to find their vulnerabilities so that such weakness does not result in a broader ‍‍‍incident.

Third-Party Security Alerts Are Bringing Data Exposure Into Focus

It‍‍‍ is quite challenging when organisations sometimes overlook data leakage and it takes external researchers, providers of threat intelligence, cybersecurity agencies or other third parties who notice suspicious activities or information appearing in unauthorised locations.

Recently, an instance has been made visible where the leaked data of the customers of the State Bank of India got exposed and the bank received external alerts about a suspected data exposure and they started to probe the situation. It was said the customer information was part of the exposure, but the bank's probe and the precise nature & scale of the incident, shall be distinct from the allegations made by external agencies.

Here is a valuable point which is worth considering while making policies regarding alert handling by the organisation: external alerts help the organisation identify a problem at an early stage but they can never fully be relied upon without a thorough investigation and it is important to differentiate the source of external and internal confirmation.

The companies should have well-defined systems of alerts validation, identification of affected systems& data, evaluation of possible consequences, and finalizing required actions. The risk of having only an outside party identify the situation is that the company may get only minimal opportunity for figuring out what they have to do after the identification of a ‍‍‍problem.

Common Causes Behind Data Leaks in Indian Organisations

Data‍‍‍ breaches can occur multiple ways and not necessarily by an attacker breaking through the security system.

It is also possible that vulnerabilities within common business procedures may expose information to the wrong people.

The most common reasons are:

Insecure configuration: A cloud storage, database or application might get set in such a way which gives a third party access to the information.

Hacked credentials: The use of hijacked usernames, passwords or access tokens by unauthorized users to gain access via legitimate accounts could be an incident.

Over privileged users: Employees or outside users have the rights to access data that has already been determined as not required for their tasks.

Outsourced risks: There is a possibility that a company relies on an external company or provider whose systems or security practices might bring in additional hazards.

Accidental sharing of information: A document can be sent by an organisation to a wrong contact person, published through publicly accessible links or being stored in locations where there are no limitations on access.

These examples have to do with the fact that data leaks can happen no matter the company or the technology used. It can happen at any place where data is being stored, retrieved or shared without sufficient ‍‍‍monitoring.

Why Third-Party Relationships Matter in Information Security

Modern‍‍‍ organizations seldom work with only their own systems. They use cloud computing platforms, software providers, payment systems, consultants and other external companies to do the job of carrying out their daily business activities.

The fact that operations have got the capability of being enhanced through the usage of such relations is a blessing but also an inconvenience which has the potential of making information management a rather complicated issue.

There are so many cases where businesses have efficient internal procedures but a major part of their work is done by third-party suppliers who may be entrusted with handling key information in one way or another for example storage, processing, granting access or even monitoring.

These dependencies are one of the reasons that vendor management plays a big role in information security. Businesses must find out what data vendors can get through, how information is controlled by them, what is the nature of security responsibilities and also how incidents will be reported.

It is crucial to keep these terms up to date. Once a vendor relationship has been evaluated when it was launched, the services, integration and access requirements may change as time goes on and you have to make a new appraisal of what is ‍‍‍happening.

The Challenge of Identifying What Information Has Been Exposed

On‍‍‍ receiving a notification of a possible breach of data, one of the first questions an organisation will be likely to ask is what kind of information would be impacted.

These systems may comprise various types of company records as well as customer data, personnel files, financial data and highly confidential information. Without any knowledge of the system contents, it would be hard to judge a breach scenario.

This is how sensitive data discovery and data classification complement the wider information management practices. Organisations should know what categories of sensitive data they have and what repositories they use to store them.

EzSecure helps companies locate and identify their confidential information among multiple platforms such as Google Drive, SharePoint, OneDrive and Windows File Servers. It gives organisations an overview of the data across these platforms, and thus enables the teams to find out those records to which extra care is required.

You can find out the details of the sensitive data discovery features of EzSecure along with how the feature assists companies in gaining an understanding of the locations of sensitive information within the organisation.

These measures do not replace incident response, access controls or other safety protocols but they address a very significant question of information management as well as incident investigation: what is the actual sensitive information that the organisation holds?

Practical Steps Organisations Can Take to Reduce Data Exposure

Preventing every possible security incident is not realistic. However, organisations can take practical steps to reduce avoidable exposure and improve their ability to respond when something goes wrong.

Review access permissions: Make sure employees, vendors and other users have access only to the information they need.

Assess third-party providers: Understand how external services handle organisational and customer information.

Monitor security alerts: Establish a process for reviewing alerts from CERT-In, threat intelligence providers and other credible sources.

Review cloud configurations: Check sharing settings, storage permissions and integrations regularly.

Understand the information being stored: Identify sensitive records and review whether they are being handled appropriately.

Prepare an incident response process: Define who investigates an alert, who makes decisions and how affected individuals or authorities are notified when required.

These measures work best when they are part of regular business practices rather than activities carried out only after an incident.

Building Stronger Information Security Practices in India

India's digital growth brings new opportunities for businesses and public services, but it also increases the importance of responsible information management. As more organisations rely on connected platforms and external service providers, the number of places where information is stored and accessed continues to grow.

Government-reported cybersecurity figures, along with reports of suspected data exposures, show why organisations need to take a more active approach to understanding their information environments. External alerts can help bring problems to light, but businesses also need internal processes to verify concerns, identify affected information and respond appropriately.

Strong information security is not achieved through one tool or policy. It requires regular reviews, clear responsibilities, appropriate access controls and a practical understanding of the information an organisation manages.

Ultimately, reducing data exposure begins with knowing what information exists, where it is stored and who can access it. That understanding gives organisations a stronger foundation for managing information responsibly and responding when security concerns arise.

Sources

Press Information Bureau – Government Strengthens Cyber Security Preparedness of Central Government Digital Platforms and Citizen Services

Press Information Bureau – Assistance to States to Tackle Cyber Incidents

Reuters – India's RBI tightens cyber checks on lenders after spate of hacks

The Times of India – Congress pulls up SBI over data breach, seeks accountability

India’s DPDP Act: Why Media Groups Are Raising Concerns

EzSecure — Wed, 28 Oct 2026 11:29:13 +0000

India's‍‍‍ Digital Personal Data Protection (DPDP) Act will go a long way towards empowering and protecting personal privacy, and making data collection more transparent and accountable. However, data privacy provisions in the Act have generated quite a debate about how the changes in laws would impact on investigative reporting, transparency and access, and the ability of media houses to cover matters of public interest.

The Digital News Publishers Association (DNPA), on October 27, 2026, raised the issue before the Court by challenging the DPDP Act and Rules made thereunder for the year 2023 as a group consisting of 21 media outlets.

The publishers said that in the absence of a clear exception for journalists, it would be difficult for them to carry out their regular functions of reporting and investigative articles.

After that, the Court asked the government to clarify its stand. Currently, the challenge is pending and no decision has been made yet.

Source: Reuters

What Is India’s DPDP Act?

The‍‍‍ DPDP Act sets a precedent for lawful handling of digital personal information within India. It also specifies the conditions governing consent, the use of personal information and individuals' rights to their data. The DPDP Rules which followed in November 2025, elaborated the provisions of many of these requirements.

Among the objectives of the Act is empowering citizens to regulate their personal information as much as possible. In order for example, data collectors or users must in most cases have a justifiable reason for this such as having been given consent or a permitted legitimate use under the Act.

These conditions pose several duties when handling sensitive personal data for businesses and other bodies. Nonetheless, the publishers' association contends that subjecting the same set of laws to journalism without an explicit exemption could hinder the investigative activities of reporters involving individuals, businesses or public ‍‍‍bodies.

Why Media Groups Are Challenging the Law

The‍‍‍ main issue highlighted by the publishers is that the existing statute lacks a particular exemption related to journalism. Legally, their challenge implies that if reporters are to collect and publish data relating to private life without knowing how this would be permissible within the scope of the law, they may find themselves at a loss when confronted with an article that has to do more with private life rather than public interest.

Investigative journalism frequently requires journalists to go through financial documents, company relationships, the personal lives of political figures or allegations against anyone. In the course of this kind of work reporters have to rely on personal information of individuals without getting permission first from those concerned. If they were required to ask for consent it might notify the subject of investigation leading them to destroy evidence and to manipulate witnesses.

Accordingly, they state that the legislators' proposals might hamper the way in which journalists carry out their research prior to a publication of a story. Another thing they note is that some drafts of the bills contained journalistic exemption clauses but in the final version it was ‍‍‍dropped.

Source: Bar and Bench

Could Consent Requirements Affect Investigative Reporting?

Getting‍‍‍ consent has become one of the fiercest points of contention in the entire debate around personal data processing.
In most cases, organisations are required to get consent from data subjects along with other legally recognized bases under the DPDP Act to legitimise the processing of the personal data.

A news organisation, however, might not always have the ability to get that person's approval. Suppose in a case a journal is looking for proof of a possible financial violation in an organization. In such a situation, the investigation will probably involve personal information, private corporate records, and information coming from insiders.

If the law imposes the obligation upon the journalist to first alert, then seek permission, from the subject before processing the personal information, it would likely lead the journalist to take an extremely defensive stance.

The subject of the journalistic report could refuse to give consent, could file legal complaints against the publication of the content, or could initiate measures that ultimately affect the journalism process.

All of these are possible issues that have been pointed out by the news publishers, but none of these can be considered as a definite ruling of the courts that every use of personal data by journalists would require the subject giving their consent first. The way the law will finally be decided will ultimately be based on how it is interpreted through case law and legal ‍‍‍opinions.

Concerns About Confidential Sources and Whistleblowers

‍‍‍Investigative reporting is a craft that depends heavily on confidential sources who disclose information about corruption, misconduct or other issues that would probably remain hidden. These informants often come in the form of employees, officials, or people who have a legitimate fear of losing their job, getting into legal trouble, or losing their friends and family if their identities become known.

In addition to that, the DNPA has also raised issues with clauses that let the state compel organizations handling personal data to hand over information. Their main worry is that these powers could be used, without sufficient safeguards, to uncover confidential communications or to disclose the identity of journalistic sources.

Whistleblowers may be reluctant to contact journalists with their revelations if they are convinced that exposing the facts will result in them being identifiable in some way. This could have a double effect: limiting the information flow available to journalists, and turning some investigations practically unattainable.

It is understandable that the main reason for privacy is protecting the privacy of the individuals who are mentioned in a report, but another equally important aspect is that it is essential to keep the secrecy of the sources who will help the journalists to investigate the powerful individuals and their organizations. ‍‍‍

Source: Reuters

The Debate Over Removing Published Information

Another issue concerns the right to withdraw consent and request the erasure of personal data. Media publishers worry that these provisions could be used to challenge previously published reports containing personal information.

For example, a news article about a public investigation may include information about an individual’s professional conduct or alleged involvement in wrongdoing. If the person later requests that the information be erased, publishers fear they could face pressure to remove or heavily edit the report.

This raises questions about how individual privacy rights should interact with public-interest reporting and the preservation of news archives. A published report may remain relevant long after its original publication, particularly when it documents a public inquiry, legal proceeding or historical event.

The publishers argue that the law needs safeguards to prevent privacy-related requests from undermining accurate reporting or erasing information that remains important to the public. The legal challenge seeks clarity on how these competing interests should be balanced.
How the DPDP Act Relates to the Right to Information
The‍‍‍ matter is about the alterations to the Right to Information (RTI) Act. The DPDP Act revised the rule regarding the disclosure of personal information under RTI.

In the past, the applicable provision had conditions that permitted disclosure of personal information if there was a bigger public interest. However, now under the revised clause, personal information is not subject to disclosure which has led critics to fear that government agencies will be handling records with such data very discreetly.

For journalists, getting hold of state and authority documents often reveals how government decisions are made by the public authorities, how taxpayers' money is spent and whether public institutions are functioning properly and lawfully. Publishers claim that the modifications will make it tougher to access some kinds of information and they will lose that public interest argument.

Hence, the discussion is not only about the newsroom's duties. It also deals with the interplay of privacy laws with transparency and public accountability; it is a question of the public's right to know about decisions made by their ‍‍‍institutions.

Balancing Individual Privacy With Press Freedom

The debate does not mean that privacy and journalism must be treated as opposing goals. Individuals have legitimate reasons to expect their personal information to be handled responsibly, and news organisations should not have unlimited freedom to publish private details that are irrelevant to a story.

At the same time, reporting on matters of public interest may require journalists to use personal information without obtaining advance permission from the people being investigated. A workable framework needs to recognise the difference between unnecessary exposure of private details and reporting that helps the public understand important issues.

Media groups are asking for clearer legal safeguards for journalism, including protections for confidential sources and reporting conducted in the public interest. The Supreme Court has emphasised the need to balance individual privacy rights with press freedom and has sought the government’s response to the challenge.

The outcome of the case may help clarify how India’s data protection framework applies to news publishers and whether additional safeguards are needed for journalistic work.

What Happens Next?

The DPDP Act’s framework is scheduled to come into effect in stages, with key provisions due to take effect in May 2027. The Supreme Court’s consideration of the publishers’ challenge will be important in determining how the disputed provisions are interpreted and whether any changes or safeguards are required.

Until the Court reaches a decision, the publishers’ arguments should be understood as concerns raised in an ongoing legal challenge, not as a final ruling on the law’s effect on journalism.

The broader question is how India can strengthen personal data privacy while ensuring that journalists can continue to investigate matters of public importance. The answer will depend on how the law is implemented, how the courts interpret its provisions and whether meaningful safeguards are established for both individual privacy and public-interest reporting.

HIPAA Compliance Monitoring in Healthcare: Key Considerations

EzSecure — Fri, 23 Oct 2026 11:08:19 +0000

Health-related‍‍‍ institutions manage a significant portion of extremely private personal data including patients' names, medical histories, insurance data, diagnostic reports, and billing information. Besides being crucial medical data for patient care delivery, this type of data also requires careful treatment and responsibility of management.

Compliance with the US Health Insurance Portability and Accountability Act (HIPAA) does not merely imply having documented policies. Hospitals and clinics need to figure out exactly which departments or personnel should have what kind of access, how the data is transferred, etc. HIPAA compliance is a powerful means for healthcare companies by means of which they are able to keep track of their activities, spot weak points, and improve regulation of the data they are in charge of. ‍‍‍

What Is HIPAA Compliance Monitoring?

HIPAA compliance monitoring refers to the ongoing process of reviewing an organisation’s practices, systems, and procedures to assess whether they align with applicable HIPAA requirements.

Healthcare information does not remain in one place. Patient records may be stored in electronic health record systems, shared through collaboration platforms, maintained in billing applications, or exchanged with insurance providers and other authorised parties. Each environment can introduce different considerations for how information is accessed and handled.

Regular monitoring helps organisations assess whether their procedures are being followed and whether existing safeguards remain appropriate as systems and workflows change. This can include reviewing access permissions, examining audit logs, assessing risks, maintaining documentation, and investigating unusual activity.

Compliance monitoring is not simply a one-time exercise. New applications, changing responsibilities, and evolving information needs can create gaps that were not present during an earlier review.

Understanding Where Patient Information Resides

One‍‍‍ challenge with healthcare data control is pinpointing exactly what the sensitive data has been hidden into and where it is.

Health records can be found more often than an institution is aware of. For example, a clinical report can end up in a shared folder and even be a part of an email or copied to a spreadsheet. More copies, in time, may be collected in different systems and repositories.

It is difficult for institutions to determine whether or not sensitive information is processed correctly when they have an unclear picture of these places.

A compliance check, for instance, focuses on the systems that are already in place without being aware of the files stored elsewhere.

So, discovering sensitive data is the process that gives information about where the sensitive data is in different connected places that are available. When data is categorized, organizations get another kind of comprehension about the data which is, for example, whether it contains personal identifiers, financial details or healthcare data.

Together, data discovery and classification will help healthcare providers get an overall understanding of their data environment and take informed actions for deciding on the areas where the review will be ‍‍‍conducted.

Monitoring Access to Protected Health Information

Not‍‍‍ all who are working in a medical facility have to be given access to every single patient file. A doctor, a billing specialist, an administrative employee, and a service provider external to the hospital may each need different pieces of patient information to do their jobs effectively.

HIPAA's Privacy Rule contains the minimum necessary standard for many uses and disclosures of PHI, but only to an extent as other specific exceptions will apply. The Security Rule meanwhile mandates the implementation of sufficient safeguards against unauthorized access to and modification of ePHI.

This implies that businesses have to evaluate the level of access their existing work arrangement would be appropriate. Such steps might be looking into user privilege, analysing the access data records, and adjusting the work access if there are changes in role or when the collaboration is terminated.

Nevertheless, examining access rights merely can't reveal every aspect of the information landscape. The organization might figure out who can open a certain folder without knowing about the confidential information actually inside that folder.

The combination of user access assessments with sensitive data identification and tagging will yield an extra understanding and will point out what needs to be looked at again during compliance checks, as well as will highlight where sensitive information is ‍‍‍kept.

Keeping Track of Sensitive Information Across Systems

Healthcare‍‍‍ organisations usually manage daily operations through various applications and platforms.

Patient files may circulate within clinical teams, between departments, to administrative units, medical billing services, and even external agencies.

Keeping track of data consistency becomes a challenge as files and data get shuffled across systems. Files can be duplicated, renamed, and stored in hidden corners of file servers that are not regularly checked or reviewed. Some repositories can have obsolete records that, although not needed anymore, remain available.

Data visibility gives an organisation a clearer picture of sensitive information across their networked systems.
Instead of just guessing, for instance, that all records should be in a particular location, an organisation can discover sensitive data to get an indication of where the information might be residing in the target environments.

For healthcare organisations, compliance reviews become more meaningful when they have a clear understanding of the information stored across their environments. This includes knowing which files contain sensitive information and where those files reside. EzSecure supports this process through sensitive data discovery and classification across connected repositories, helping organisations identify and understand the sensitive information within their files. This visibility can provide useful context for compliance reviews and help teams determine where further assessment may be needed.

Demonstration of such functionalities would aid organisations to know the types of sensitive records they've got and which sections might need more ‍‍‍scrutiny.

Identifying Changes That May Affect Compliance

Healthcare‍‍‍ settings are always changing. Employees leave and new ones come. Teams work with new systems. Responsibilities change. New documents come as medical care and administrative operations progress.

Patient data and employee access issues are examples of these changes that should be monitored for compliance because one or the other is likely to cause a change to how data is stored and accessed. Shared storage might slowly acquire more patients' records, or it could happen that the staff keep open certain information which is no longer their role to handle.

Ongoing compliance assessments are ways for companies to be aware of any development that needs to be looked at or handled. Access checking, accurate records, and risk evaluation allow members of a team to spot problems ahead of time.

Through document discovery, the organization is able to detect all locations of sensitive data across repositories they evaluate. Next step, the classification will separate healthcare-related information from other content, and thus allow easier prioritization of the reviewing tasks based on the information level involved.

We, however, are not saying that all the changes automatically equate to a compliance violation. Instead, we want to make sure that an organisation will always know enough from a bird's eye view to be able to judge these changes and decide what actions are ‍‍‍needed.

Common Challenges in HIPAA Compliance Monitoring

Even organisations with established compliance processes can face practical challenges when managing large amounts of patient information.
Incomplete information about stored records. Organisations may know which systems are intended to contain patient information but have less visibility into the contents of shared folders, working files, and other repositories.

Different practices across departments. Clinical, administrative, and billing teams may handle information differently. Maintaining consistent procedures across these teams requires clear responsibilities and regular review.

Limited visibility into additional copies. Patient information may be duplicated for legitimate reasons, but additional copies can make it harder to maintain a complete picture of where sensitive information resides.

Changes in access and responsibilities. Employee role changes, departures, and new working arrangements can create a need to reassess permissions and information-handling practices.

Difficulty prioritising reviews. When an organisation manages a large number of files, it can be challenging to decide which repositories and records need the most attention. Data classification can help provide context for these decisions.

Addressing these challenges requires a combination of appropriate policies, technical safeguards, staff awareness, documentation, and ongoing assessment. No single tool or review process can cover every aspect of HIPAA compliance.

Building a More Consistent Compliance Monitoring Process

A practical approach to HIPAA compliance monitoring begins with understanding the organisation’s current environment and identifying where additional oversight may be needed.

Healthcare organisations can start by reviewing the systems and repositories that hold patient information. They can then assess access permissions, examine relevant logs, document identified risks, and establish a schedule for reviewing changes.

Sensitive data discovery and classification can support this process by providing information about the location and nature of sensitive records in connected repositories. That information can help teams decide where further assessment may be useful.

It is also important to document findings and assign responsibility for addressing identified issues. Regular reviews are more useful when organisations can track what was identified, what action was taken, and whether further assessment is required.

HIPAA compliance depends on the organisation’s overall practices and applicable requirements. Better data visibility can support those practices, but it should be treated as one part of a wider compliance programme rather than a substitute for it.

Final Thoughts

HIPAA compliance monitoring requires healthcare organisations to look beyond written policies and regularly assess how patient information is handled in practice. Understanding where protected health information resides, reviewing access arrangements, maintaining documentation, and evaluating risks all contribute to a more consistent approach.

As healthcare environments become more complex, maintaining an accurate view of sensitive information can become increasingly challenging. Sensitive data discovery and classification can help organisations understand the information held across connected repositories and identify areas that may need closer examination.

For healthcare organisations, the practical starting point is to understand the information they manage and use that understanding to support appropriate reviews, safeguards, and compliance decisions.

72 Hours to Report a Breach Why Most Organizations Still Get It Wrong

EzSecure — Mon, 18 May 2026 10:24:09 +0000

Most organizations have a breach response plan somewhere. It is probably a PDF, it is probably from 2022, and it is probably never been tested. That is not a plan. That is a liability waiting to surface at the worst possible time.

This blog is about what a real breach response looks like under India's DPDP Act and Europe's GDPR. Not the theory. The actual steps, the actual roles, and the part nobody talks about: why your response is only as good as how well you know your own data.

The Stat That Should Keep You Up

Organizations without a tested incident response plan take an average of 277 days to identify and contain a breach. That is 277 days of exposure, regulatory liability, and silent damage to customer trust.

Why Most Breach Plans Fall Apart on Day One
Walk into most organizations and you will find three things: a written policy, no assigned roles, and zero practice. The policy checks the compliance box. But when an actual incident hits, the team freezes because nobody has ever walked through it together.

The second failure is more technical. A breach response requires you to answer very specific questions very quickly. What data was exposed? Whose data was it? How many records? What categories? Organizations that cannot answer those questions in hours spend days guessing. And every hour of guessing adds to their regulatory exposure.

You cannot notify regulators about data you cannot describe. If your sensitive data is scattered and unclassified across your systems, your breach response will be built on incomplete information at exactly the moment accuracy matters most.

What DPDP and GDPR Require When a Breach Occurs
Both laws impose real deadlines. Under GDPR, organizations must notify the relevant supervisory authority within 72 hours of becoming aware of a breach. Under India's DPDP Act, draft rules indicate a similar window for notifying the Data Protection Board. These clocks start the moment your organization becomes aware, not when your legal team is ready.

The notification cannot be vague. Regulators require the nature of the breach, the categories of personal data involved, the estimated number of individuals affected, the likely consequences, and the steps being taken. That level of specificity comes from preparation, not from scrambling under pressure.

One thing Indian companies with European customers often overlook: if your organization processes data of EU residents, GDPR applies to you alongside DPDP. That means two parallel notification processes within the same 72-hour window.

Five Phase Breach Response Framework That Holds Up Under Pressure

The First Hour Is About Clarity, Not Speed
The instinct in Phase 1 is to move fast. But moving fast without direction makes things worse. The first 60 minutes should be about getting the right people into a room, issuing an initial containment directive, and starting a timestamped incident log. Every action, every decision, every call made during a breach becomes part of your regulatory record.

Phase 2 Is Where Data Visibility Becomes Everything
Containment requires knowing what was on the compromised system. Notification requires knowing whose data was involved. You cannot produce either without having already done the work of mapping and classifying your sensitive data. Organizations that have done this work answer Phase 2 questions in hours. Organizations that have not spend days guessing and filing incomplete notifications.

The questions your team must answer in Phase 2 are straightforward on paper. What categories of personal data were stored in the affected system? Approximately how many individuals are affected? Was data encrypted? Is there evidence of actual exfiltration? If your data environment is uncharted, none of those questions have quick answers.

Notification Must Be Accurate, Not Just Fast
Both DPDP and GDPR require accurate notifications. An incomplete or misleading notification triggers additional scrutiny. In Phase 3 and 4, your legal and privacy teams should be drafting regulator notifications in parallel, not waiting for one to complete before starting the other. Individual notification under GDPR is required where the breach creates high risk to individuals. Under DPDP, similar obligations are expected in the final rules.

The Roles Every Response Plan Must Name in Advance
The most common structural gap in breach plans is the absence of named individuals. Plans assign roles to job titles, not people. Then a breach happens and the CISO is travelling, the DPO is in a different time zone, and nobody has clear authority to make a decision.

Your Readiness Checklist Before a Breach Ever Happens
Use this to audit where your organization actually stands. The gaps you find today are the risks you can close before a real incident forces the issue.

PLAN AND PRACTICE

Incident response plan reviewed and updated within the last 12 months
Named individuals assigned to every role, with backups listed
Tabletop exercise run with leadership at least once this year
Regulator contact details for DPDP Board and relevant GDPR authority confirmed

DATA FOUNDATION

Sensitive data discovery completed across databases, file servers, cloud storage and email archives
Data classification current and reflecting the actual state of your systems today
Data flows mapped so you know where personal data enters, moves and leaves your environment

NOTIFICATION READINESS

Notification templates pre-drafted for regulators and for affected individuals
72-hour clock protocol understood by your incident commander and DPO
Customer contact database accessible to your response team at any hour

Run a quick internal test this week. Ask your IT and privacy teams: if we discovered a breach right now, how long would it take to tell regulators what data was exposed and how many people were affected? The honest answer tells you exactly where to start.

You can read the complete detailed version of this article on the official EzSecure blog here:👉 72 Hours to Report a Breach Why Most Organizations Still Get It Wrong

A Breach Handled Well Can Actually Build Trust
Organizations that respond to breaches transparently, quickly, and with evidence of real data governance often come out of incidents with stronger stakeholder relationships than before. That is not wishful thinking. It is the observed pattern from how GDPR enforcement has played out in Europe over six years.

The foundation of that good response is knowing your data. Not assuming you know it. Knowing it with the tooling and processes in place to answer hard questions accurately under real pressure.

Most organizations are somewhere in the middle. They have partial visibility. They have a plan that is slightly out of date. They have good intentions and incomplete infrastructure. The question is whether you close those gaps before a breach, or during one.