Request sample reportGet a quote
Get a quote Request sample report

Compliance

GDPR & DPDP Security Testing

GDPR expects you to regularly test your security measures, and India's DPDP Act expects reasonable safeguards. Testing shows yours actually work.

Get a quote Request a sample report

In plain English

What GDPR & DPDP expects from security testing

Data protection law cares about outcomes: personal data must be kept secure. Both the EU’s GDPR and India’s Digital Personal Data Protection (DPDP) Act leave you to choose the measures, but they expect those measures to be appropriate and effective.

GDPR goes a step further. Article 32 says that, where appropriate, you should have a process for regularly testing, assessing and evaluating whether your technical and organisational measures actually work. A security test is direct evidence of that process.

India’s DPDP Act requires Data Fiduciaries to take reasonable security safeguards to prevent personal data breaches, including for processing done by their Data Processors. The DPDP Rules, 2025, notified in November 2025 with an eighteen-month phased rollout, describe minimum safeguards such as encryption, access control and access logging. Testing those safeguards shows they hold up. Take legal advice on your specific obligations.

Evidence

How our report supports it

  • Documented evidence that security measures are tested, not just written down
  • Findings rated by impact on personal data, to support your risk assessments and DPIAs
  • Proof of remediation through retesting, for your accountability records
  • Evidence you can share with customers, data controllers and partners who ask
  • A clear scope showing which systems handling personal data were tested

Scope

Recommended scope

Every environment is different. This is where we usually start, and we'll confirm it on a scoping call.

Phishing Simulation

Organisational measures, such as staff awareness, also form part of Article 32.

Timing

When to test

  1. Test regularly, not once. Article 32 refers to a process for regular testing.

  2. Test before launching a new product or feature that processes personal data, alongside your DPIA.

  3. For DPDP, use the phased-in period to test and fix safeguards before obligations take full effect.

  4. Retest after fixes, so your records show the full cycle from finding to resolution.

FAQ

GDPR & DPDP testing questions

Does GDPR require penetration testing?

Not by name. Article 32 requires, where appropriate, a process for regularly testing, assessing and evaluating the effectiveness of your security measures. Penetration testing is one of the most direct ways to do that for technical measures.

Does India's DPDP Act require penetration testing?

The Act requires reasonable security safeguards to prevent personal data breaches, and the DPDP Rules, 2025 list minimum safeguards. Neither names penetration testing as mandatory, but testing is a practical way to check that your safeguards work.

Can one test cover both GDPR and DPDP?

Often, yes. If the same systems process personal data of people in the EU and India, one well-scoped test can support both. We'll note in the report which systems and data types were in scope.

Will you access personal data during testing?

Only as much as needed to demonstrate an issue, and ideally in an environment with test data. We can sign a data processing agreement where required, and our Trust page explains how we handle data.

Is this legal advice?

No. This page is practical guidance on security testing, not legal advice. Speak to your legal adviser or data protection officer about your specific obligations.

Sources

Guides

Guide8 min read

How to Prepare for Your First Penetration Test

A practical checklist for your first penetration test: how to set scope, prepare accounts and environments, pick contacts and keep communication clear.

Guide7 min read

How to Read a Penetration Test Report

How to read a penetration test report: what severity ratings mean, how to judge the evidence, which findings to fix first, and how the retest closes the loop.

Services for this framework

API Penetration Testing

Hands-on testing of REST, GraphQL and gRPC APIs for broken authorization, data exposure and abuse of business logic.

Cloud Security Testing (AWS, Azure, GCP)

Configuration review and authenticated attack-path testing of your AWS, Azure or GCP environment, focused on how small permissions become full control.

Need a pentest for an audit, a customer, or peace of mind?

Tell us what you need tested. You’ll get a fixed-fee proposal with tester-days and timeline stated, usually within a few days of the scoping call.

Get a quote Request a sample report