delphiinfotech.zohosites.com - Latest Cybersecurity Blogs #DPDP Act 2023delphiinfotech.zohosites.com - Latest Cybersecurity Blogs #DPDP Act 2023https://www.delphiinfo.com/blogs/tag/dpdp-act-2023Sat, 17 Oct 2026 15:36:09 -0700http://zoho.com/sites/<![CDATA[ Penetration Testing Services for Enterprise Risk ]]>https://www.delphiinfo.com/blogs/post/penetration-testing-services-for-enterprise-riskDiscover how penetration testing strengthens enterprise risk management, protects sensitive data, supports DPDP compliance, and helps Indian businesses identify vulnerabilities before attackers can exploit them.]]>

Pen testing services help Indian organisations undergoing DPDP Act compliance enhance enterprise risk management and data security.

Here's a question worth sitting with for a second: if an attacker got into your network right now and just... stayed quiet for six months, would you know? Most Indian enterprises can't honestly say yes. And that gap, the not knowing, is basically the reason for penetration testing services.


Digital transactions are exploding. Cloud adoption isn't slowing down. Vendor networks keep sprawling wider every year. Somewhere in all that growth, the line between “a cybersecurity incident” and “a full-blown business crisis” quietly disappeared. This article shows how effective penetration testing impacts enterprise risk management. It explains why data security is now a boardroom topic, not just an IT issue. It also highlights what Indian organisations must do as new regulations come into play.

  

 Why Cyber Risk Has Become a Boardroom Priority in India 

Not that long ago, cyber risk lived quietly at the bottom of the IT department's quarterly report. Nobody outside the tech team read it closely. That's changed, and changed fast. Cyber risk is now on the board's radar, alongside currency exposure and supply chain disruption. The numbers back this up. Cyberattacks on Indian companies are rising over 25% each year. This trend is a key reason why cybersecurity is no longer just "an IT thing." It has become a vital part of enterprise risk management.


The threat data tells the same story from a different angle. Seqrite's 2026 India Cyber Threat Report noted over 156 million malware detections in businesses from October 2025 to May 2026.Trojans and file infectors were the main offenders. Ransomware activity remained high in both cloud and on-premise systems.


So the question boards ask has shifted. It's not "could this happen to us?" anymore. It's "how fast will we catch it, how do we tell people, and what's it going to cost us?" That change in framing is exactly why cybersecurity governance and enterprise risk management have started to feel like the same conversation.

 What Penetration Testing Services Actually Test 

Let's be plain about what a penetration test actually is: a controlled, fully authorised simulation of a real attack, run by people who are paid to think like attackers. That's the whole job. A decent tester won't just run a scan and hand you a list of known flaws; that's what automated tools already do. Instead, they string small weaknesses together. A misconfigured server here. A password someone reused. An API endpoint that's a little too exposed. Individually, none of these seem urgent. Chained together, they're exactly how a real breach happens.


This could include testing both external and internal networks, assessing web and mobile apps, reviewing API security, checking cloud configurations, and even trying social engineering tactics on employees. But here's the part that actually matters: the output isn't just a pile of technical flaws. This is a list of things that could truly cause data loss, fraud, or operational chaos, and in what order they should be fixed. That ranking is what makes the whole exercise useful to leadership because it separates “this could actually hurt us” from “this is mostly theoretical.”

 The Business Case for Investing in Regular Penetration Testing 

There was a time when penetration testing was something only banks and big IT firms cared about. That time is over. The penetration testing market in India is set to grow from about USD 68.6 million in 2025 to nearly USD 185 million by 2030. This marks a CAGR of around 18%, which is much higher than the global growth rate.


Regulation is doing a lot of the pushing here. The RBI's 2023 circular says that regulated payment system operators and urban cooperative banks must do annual cyber risk assessments. This includes penetration testing. One circular, and suddenly, a huge chunk of the financial sector had a formal testing schedule to follow.


But even without the regulatory push, the maths works out. One serious breach can lead to fines, customer loss, and repair costs. These can make an annual testing budget seem small. This is especially true in BFSI. The high volume of transactions makes these organisations prime targets for fraud. Simply put: testing before an attacker finds the gap is a lot cheaper, than handling the fallout once they do.


  How Enterprise Risk Management Is Evolving Beyond Compliance Checklists 

For years, enterprise risk management in India basically meant a spreadsheet. A static risk register, dusted off once a year, reviewed by internal audit, then filed away until next year. That model is fading, and fast. Organisations are shifting towards cloud- ERM platforms. These platforms give them real-time dashboards and predictive analytics. The use of these tools is increasing by more than 30% each year. Organisations are shifting towards cloud- ERM platforms. These platforms give them real-time dashboards and predictive analytics. The use of these tools is increasing by, than 30% each year.


Looking ahead to 2026 businesses are leaving behind a way of handling risk. In the past cyber risk, operating risk, vendor risk and audits were treated as jobs. Today more businesses are joining these parts together inside one system that covers governance, risk and compliance.

 At the time leadership teams must be ready to answer for risk. Risk management must have ways to check and share risk before a problem happens instead of putting things together after the event. For companies in India risk management is turning into a flow that uses live data and security tests, not just a yearly check, for compliance.

 Where Data Security Sits Inside a Modern Risk Framework 

Data security used to get filed under "IT risk" and left there to gather dust. That's not really how it works anymore. In a risk framework data securityacts like connective tissue. It ties into risk, reputational risk, legal risk and operational risk all at once. It doesn't stand alone. It connects everything. This kind of interdependence means that a problem, in data security can quickly ripple across areas. That’s why treating data security as an IT issue is a mistake. It’s not about protecting data. It’s about protecting the organization. The way data security fits into risk management shows how everything is connected. You can't ignore one part without affecting the others.


Think about what one exposed customer database actually sets off. Regulatory fines, sure. Contractual breach notices, to enterprise clients can cause damage that quietly lowers upcoming sales conversations. Operational downtime follows while everyone scrambles to contain and rebuild. All of that, from a single incident. Once you see data security this way, it changes how organisations spend on it.  

Of treating security tools as a separate line item in the budget risk committees are beginning to compare data protection spending with the particular business relationships and processes that it protects. This shift shows why risk committees value a view of data protection costs. It also explains why penetration testing reports become more useful when someone translates them into risk language. When a penetration testing report is written in terms of risk, likelihood, business impact and cost to fix it is no longer a technical document. That version of a penetration testing report can be read by anyone on the risk committees and, by the people who make business decisions.

 The DPDP Act, 2023 and What It Demands From Data Fiduciaries 

India's data protection rules have gone from talked-about to real, and quickly. The Digital Personal Data Protection Rules, 2025 were formally notified on 13 November 2025. That notification established the Data Protection Board of India. It also laid out a phased compliance timeline. The heavier obligations like consent, notice, security safeguards, and breach reporting will start in 18 months.


Under these rules, organisations classified as data fiduciaries must implement security safeguards. These include encryption, access controls, and ongoing monitoring. These are standard measures that any responsible organisation should follow. They also have to tell the Data Protection Board within 72 hours of discovering a personal data breach. In addition they must inform the individuals whose data was exposed.


Here’s where it gets complicated: this new requirement sits on top of India’s existing CERT-In guidelines. Those guidelines already require certain cybersecurity incidents to be reported within six hours. So after one incident happens a company might end up juggling two reporting timelines at the same time. One clock ticks every six hours the every 72

The penalties? They’re not small. They can go into hundreds of crores of rupees. That’s why security testing is no longer something you do because its good practice. It’s now directly tied to compliance. Risk documentation has moved from being a to-have to a must-have. This shift means companies can no longer treat cybersecurity as something, from their legal obligations. It's part of the core responsibility now.


 Connecting Penetration Testing Results to Enterprise Risk Registers 

A penetration test report is only worth so much sitting in someone's inbox. The true value comes when results are added to the enterprise risk register, not just left in a PDF for the security team. This means connecting each vulnerability found during testing to a business risk. For example, risks could include customer data exposure, payment fraud, service outages, or regulatory fines.Then, it’s important to assign that risk to someone outside the security team to manage. A business unit must take responsibility.head. A compliance officer. Sometimes a vendor manager, if that's where the risk actually sits.

 

Risk committees can track issues like other risks. They assess likelihood, potential damage, and time needed for resolution. Regulators and auditors now expect this kind of record. It demonstrates the "reasonable security safeguards" needed by frameworks like the DPDP Rules. Companies that see a testing report as a one-time task often face the same problems in future audits. This can happen year after year.

 Industry-Specific Risk Priorities: BFSI, Healthcare, and IT/ITES 

Not every sector faces the same risks, so a good testing programme shouldn't run the exact same checklist everywhere.

BFSI must balance RBI mandates on one side with a volume of digital transactions on the other side, which makes fraud prevention and payment system integrity the obvious priority.


Network and application testing here tends to cluster around core banking and payment infrastructure

Healthcare has changed a lot. Patient records and telemedicine platforms grow quickly, often outpacing security measures. Legacy systems were created long before we understood modern threats. This mix makes data security assessments and access control reviews crucial.


In IT and ITES, which are key to India's outsourcing economy, exposure often comes from subcontracting and high staff turnover. These factors lead to supply chain and insider-risk issues. Even large, secure firms may face problems because smaller vendors are so integrated into their operations.

The key lesson in every sector is clear: shape your testing scope around where attackers focus in that industry. Avoid using a one-size-fits-all template.


 Building an Internal Culture of Security and Risk Awareness 

None of this matters much if the people around the technology aren't ready. Human behaviour and workforce governance are now as important to enterprise risk as the technical side. This includes everything from phishing risks and password hygiene to how carefully employees use the AI tools they work with daily.


A few things reliably help. Running realistic phishing simulations alongside the technical testing. Training staff who handle customer or financial data to actually recognise social engineering when they see it. Every department should have an easy way to report suspicious activities. They shouldn’t have to worry about being blamed. In outsourcing-heavy settings, insider threats and credential misuse are major causes of data breaches. So, workforce awareness is just as important for data security as any firewall. A perfectly hardened network with an untrained team behind it is still a soft target, no matter how good the technology is.

 Choosing a Penetration Testing and Risk Management Partner 

Picking the right partner matters nearly as much as deciding to test at all. Check for methods linked to trusted frameworks. Find testers with verifiable credentials. Also, look for someone who can explain technical results in a way that a risk committee or board will truly grasp.


Providers who treat penetration testing as a one-off product are leaving value on the table. Testing that's part of a wider risk management and data security plan leads to actionable recommendations. People can follow and track these over time. Ask any potential partner how they prioritise findings. Find out what happens after the report is delivered. Also, check if their work would prove "reasonable security safeguards" if the Data Protection Board inquires. The right partner doesn't feel like a vendor dropping off a report once a year. It feels more like an extension of your own risk team.

 Key Takeaways 

  • Cyberattacks on Indian businesses have increased by over 25% each year. This shift has moved cybersecurity from being just an IT issue to a key risk priority for the whole enterprise.

  • Penetration testing mimics real attacker behaviour to find weaknesses. It’s most helpful when findings are turned into risk language and added to the enterprise risk register.

  • India's penetration testing market is growing quickly. This growth is mainly due to regulatory rules, such as the RBI's 2023 circular for banks and payment system operators.

  • The DPDP Rules, 2025, require the Data Protection Board to notify of breaches within 72 hours. This adds to CERT-In's 6-hour reporting rule. Now, there are two overlapping timelines for compliance after an incident.

  • Enterprise risk management is moving from yearly checklists to continuous, integrated governance platforms.

  • Risk priorities should focus on specific sectors. For instance, fraud in BFSI, patient data in healthcare, and supply chain exposure in IT/ITES need attention. These factors should guide the testing programme's scope.

  • Workforce awareness and insider-risk controls matter just as much as the technical safeguards.


 Frequently Asked Questions 

  1. How often should an Indian enterprise conduct penetration testing?

 

A : Most regulated entities, RBI-regulated payment operators and banks included, need to test at least once a year. If your organisation ships code often, uses the cloud regularly, or makes big infrastructure changes, it’s a good idea to test more often. New deployments often introduce hidden vulnerabilities between scheduled cycles.

 

  1. What's the difference between a vulnerability scan and a penetration test?

 

A : A vulnerability scan is automated. It checks your systems against a database of known weaknesses and flags matches. A penetration test goes deeper. Real people exploit and link vulnerabilities like actual attackers do. This approach uncovers risks that automated scans often miss.

 

  1. Does the DPDP Act require penetration testing specifically?

A :Not by name. The DPDP Rules require data fiduciaries to use "reasonable security safeguards." They don't specify penetration testing as a must. However, having a tested and monitored security approach is viewed as solid evidence that you’re fulfilling this duty. This is especially true if the Data Protection Board investigates a breach at your organisation.

 

 4 . Which industries in India face the highest cybersecurity risk?

A: BFSI, healthcare, and IT/ITES currently face the highest exposure. BFSI is targeted for payment fraud given the volume of digital transactions it processes, healthcare holds highly sensitive patient data often on legacy systems, and IT/ITES firms inherit supply chain risk from the subcontracting arrangements common in India's outsourcing sector.


Identify vulnerabilities before attackers do. Partner with Delphi Infotech for penetration testing and data security solutions that strengthen your cyber resilience.

Get Started Now
]]>Wed, 16 Sep 2026 15:41:15 +0530<![CDATA[Is Your Team Leaking Data to ChatGPT? What Indian CISOs Need to Know in 2025]]>https://www.delphiinfo.com/blogs/post/is-your-team-leaking-data-to-chatgpt-what-indian-cisos-need-to-know-in-2025Discover how GenAI tools expose sensitive enterprise data, create compliance risks, and why modern AI security controls matter.]]>

Generative AI tools are silently draining sensitive data from Indian enterprises. Learn the risks, the DPDP Act penalties, and how to build a GenAI-ready security posture.

The Breach No One Saw Coming

In early 2023, a group of engineers at Samsung pasted proprietary source code into ChatGPT. They were trying to work faster, debug more efficiently, and move a project forward. Within 20 days of the company allowing its staff to use the tool, three separate incidents had resulted in confidential source code, equipment diagnostics data, and internal meeting transcripts being fed into OpenAI’s model.

There was no hacker. No phishing email. No compromised password. Just employees doing what their instincts told them: use the best tool available to get the job done.

That data is now absorbed into a third-party AI model. There is no undo button.4


"The issue isn't malicious intent. It's contextual blindness.", Technology & Work Survey, 2025


If that can happen at Samsung, one of the world’s most sophisticated technology companies, the question we need to ask is straightforward: what is happening inside Indian enterprises right now?

We believe the answer is: more than most security leaders realise.



The Scale of the GenAI Data Leak Problem

Generative AI adoption is accelerating faster than security governance can keep pace. According to a 2025 Menlo Security report, 73% of organisations in India have already implemented GenAI tools, one of the highest adoption rates in the Asia-Pacific region. Web traffic to GenAI platforms jumped 50% in a single year, reaching 10.53 billion visits globally in January 2025 alone.

But the security infrastructure to govern that adoption is largely absent. Consider what the data tells us:

  • 86% of CISOs globally worry their employees are leaking sensitive data through GenAI platforms (Mimecast 2024 Data Exposure Report).
  • 48% of employees have admitted to uploading sensitive corporate data into public AI tools (Technology & Work Survey, 2025).
  • 1 in every 35 GenAI prompts carries a high risk of sensitive data leakage, affecting 87% of organisations that use GenAI regularly (Check Point, November 2025).
  • 68% of organisations have already experienced data leakage incidents related to employees sharing sensitive information with AI tools (Metomic, 2025 State of Data Security Report).
  • Shadow AI, the use of unauthorised AI tools outside IT oversight, now accounts for 20% of all enterprise breaches and adds an average of ₹4.74 million per breach compared to ₹4.07 million for standard incidents (IBM Cost of a Data Breach Report, 2025).

     

    Also, the trajectory is worsening. Gartner predicts that by 2027, 17% of all cyberattacks and data leaks will involve generative AI. By 2030, more than 40% of enterprises are expected to experience a security or compliance incident linked to unauthorised shadow AI usage.


    Rising enterprise adoption of generative AI tools increasing data security concerns.


    ​Why Indian Enterprises Face a Unique Exposure

    The Indian enterprise landscape carries specific characteristics that amplify GenAI data leak risk beyond what global benchmarks suggest.


    High AI adoption, low governance maturity

    India ranks among the fastest GenAI adopters in Asia, but governance is lagging dramatically. According to BW Businessworld’s 2025 cybersecurity analysis, shadow AI, prompt-based data leakage, and the misuse of public LLMs were identified as the most urgent governance blind spots of 2025 across Indian enterprises, particularly in BFSI, IT services, healthcare, and manufacturing sectors.


    A workforce optimised for productivity over process

    India’s digital workforce is young, fast-moving, and motivated to find efficiency gains. These are strengths, but they also mean that when a better tool exists, employees will find and use it. Gartner’s November 2025 survey of cybersecurity leaders found that 69% of organisations already suspect or have evidence that employees are using prohibited public GenAI tools.


    The DPDP Act 2023, and penalties that are now live

    India’s Digital Personal Data Protection Act (2023) received Presidential assent on 11 August 2023. The implementing DPDP Rules were notified on 13 November 2025, operationalising the full enforcement framework. Full Schedule 1 penalties are effective from May 2027, giving organisations a narrow window to achieve compliance.


    The penalties are substantial:

    • ₹250 crore for failure to implement reasonable security safeguards (Section 8(5))
    • ₹200 crore for failure to notify the Data Protection Board or affected Data Principals of a breach (Section 8(6))
    • ₹200 crore for non-compliance with provisions protecting children’s data

       

      An employee sharing customer PII, names, phone numbers, email addresses, financial records, through a public GenAI platform could constitute a reportable breach under the Act. The clock is ticking.



      Indian businesses facing increasing AI governance and compliance challenges.


      ​What Data Is Actually Being Leaked?

      It would be comforting to think that employees are only sharing harmless queries with GenAI tools. The data suggests otherwise.


      An analysis of over one million GenAI prompts and 20,000 uploaded files across more than 300 GenAI applications (Help Net Security, Q2 2025) found that:

      • 22% of uploaded files contained sensitive information, including source code, proprietary algorithms, M&A documents, customer records, and internal financial data.
      • 4.37% of prompts contained sensitive data, a figure that sounds small until it is applied to a workforce of thousands generating hundreds of prompts daily.
      • Customer data, including billing and authentication information, made up the largest share of leaked data at 46% (Harmonic Security, Q4 2024 analysis).
      • Employee PII and payroll data accounted for 27% of sensitive prompts.
      • Legal and financial data made up 15%.

         

        Among Mimecast’s tracked data, the most frequently shared data types by enterprise employees in ChatGPT per 10,000 users monthly include source code (158 instances), regulated data (18 instances), intellectual property (4 instances), and passwords and credentials (4 instances).A structured approach to information protection is the most direct way to close these leakage gaps.


        Four Business Risks Indian Security Leaders Cannot Ignore

        1. Loss of competitive advantage

        Your product roadmap, client pipeline, pricing strategy, and R&D plans are worth more than most organisations realise, until a competitor has access to them. GenAI platforms trained on even fragments of your confidential presentations or strategy documents can surface that intelligence in unexpected ways. In early 2025, a London-based pharmaceutical company suffered a significant IP breach when researchers used a public GenAI tool to analyse proprietary drug discovery data. Similar molecular structures and insights subsequently appeared in a competitor’s patent filings.


        2. DPDP, GDPR, and regulatory exposure

        India’s DPDP Act is now enforceable. For organisations with clients in the EU, HIPAA (US healthcare), or CCPA (California consumer data), the regulatory exposure compounds across jurisdictions. A single employee sharing customer PII through an unsanctioned GenAI tool can trigger a reportable breach across multiple frameworks simultaneously. Under GDPR alone, cumulative fines had reached approximately $6.17 billion by January 2025, with LinkedIn fined $326 million and Uber $305 million in 2024 for data handling violations.


        3. Reputational damage that outlasts the breach

        Trust, once broken, is extraordinarily expensive to rebuild in the enterprise context. India has seen high-profile breaches at Hathway (41.5 million customers, March 2024), boAt (7.5 million customers, February 2024), and BSNL. In each case, the reputational fallout extended far beyond the immediate incident. A data breach involving customer financial records or confidential business data can undo years of relationship-building in days, with social media amplifying the story faster than any PR team can respond.


        4. Fuelling the next generation of phishing attacks

        Leaked login credentials and internal communication patterns are extraordinarily valuable training data for adversarial AI. ChatGPT-themed phishing click rates rose from 1.2% to 6.8% in two years (Awareways Trend Report, 2025), a 467% increase. GenAI platforms trained on leaked credentials can generate hyper-personalised, contextually accurate phishing emails that traditional filters are not equipped to detect. In India alone, the first half of 2025 saw 23 lakh web-based attacks and 1.11 lakh password-stealing malware incidents (Kaspersky telemetry), with GenAI-powered attack methodologies playing an increasing role.


        DPDP Act compliance requirements and data protection penalties for Indian organizations.


        ​Why Traditional DLP Is Failing

        Most organisations in India currently rely on legacy Data Loss Prevention tools that were designed before generative AI existed. These tools were architected around a different threat model: email attachments, USB drives, and structured data egress. They were not built to monitor what an employee types into a browser tab.


        The limitations are structural, not incidental:

        • No browser visibility: Legacy DLP cannot intercept or monitor prompts entered into web-based AI tools like ChatGPT or Gemini.
        • Alert fatigue: Traditional tools require constant tuning, generate enormous alert volumes, and drain analyst bandwidth, in an industry already experiencing critical talent shortages.
        • Months-long deployments: Legacy platforms can take six months or more to configure before they provide meaningful protection, by which time the threat landscape has shifted.
        • Policy-first architecture: They require organisations to know exactly what they are looking for before they can find it, a fundamental mismatch with the emerging, unclassified nature of GenAI data leakage.

           

          Organisations have responded with blunt instruments. According to Cisco’s 2024 Data Privacy Benchmark Study: 63% have set restrictions on data input into AI platforms, 61% limit which AI tools employees can use, and 27% temporarily banned GenAI applications entirely. The problem with the ban approach is well-documented: it does not stop usage; it pushes it underground. Shadow AI use grows when restrictions are imposed without an approved alternative.


          Shadow AI is not traditional shadow IT. It requires only a browser and a deadline, not coding skills, enabling any employee to leak data without realising it. Existing DLP, logging, and access tools were never designed to monitor prompts.


          Sensitive enterprise information being exposed through AI tools.


          ​A Modern Framework for GenAI Data Security

          The answer to GenAI data risk is not to ban AI, it is to build a security posture that moves with how your teams actually work. We recommend a five-pillar approach for Indian enterprises:

          1. Detect without disrupting. Deploy solutions that provide visibility into data movement across cloud, endpoint, browser, and GenAI channels without requiring months of policy configuration. The goal is to surface both known and unknown risks from day one. Solutions like Mimecast Incydr provide this visibility across Git activity, Salesforce downloads, cloud syncs, Airdrops, and browser-based AI tool usage in a single view.

          2. Educate at the moment of risk. Quarterly awareness training is insufficient. When an employee attempts to paste source code into ChatGPT, the most effective intervention is a real-time micro-training triggered at that exact moment, not a session they completed six months ago. Integrated micro-training tools, including Mimecast Instructor, automate responses to low-severity risk events and reduce event volume over time.

          3. Contain and investigate fast. User error is inevitable. When an incident occurs, speed of containment determines the scale of damage. Security teams need tools with swift containment controls that enable rapid investigation and closure. Mimecast Incydr enables 50% faster incident closing, per a commissioned Forrester Research report.

          4. Block selectively for high-risk users. Real-time blocking is not appropriate for the entire organisation, that path leads to shadow IT. But for employees working directly with intellectual property, source code, or regulated customer data, real-time blocking tied to behavioural risk scoring is a proportionate and necessary control.

          5. Upgrade your DLP infrastructure. Modern Data Loss Prevention solutions purpose-built for the GenAI era provide complete visibility into cloud exfiltration, validate actual file contents to determine sensitivity, and deploy in days rather than months. The ROI is measurable: organisations deploying Mimecast Incydr see an average 172% return on investment, including data loss savings exceeding $680,000 and a 50% reduction in incident closure time.


          Business consequences of AI-driven data leakage and compliance failures.


          ​The Shadow AI Problem Is Already Inside Your Organisation

          Shadow AI is not a future risk. It is operating inside Indian enterprises today.


          Over 80% of employees globally use unapproved AI tools. 665 distinct generative AI applications have been tracked across enterprise environments (Vectra AI, 2025). In India specifically, 68% of employees use free-tier AI tools that bypass enterprise controls (Menlo Security, 2025). The WEF Global Cybersecurity Outlook 2026 found that CEOs now rank GenAI data leaks as their number one security concern, ahead of ransomware, ahead of nation-state actors.

          We are not raising this to cause alarm. We raise it because the window to act is open and closing. The DPDP Rules are now in force. The Data Protection Board of India is operational. The enforcement calendar is set.

          Legacy data loss prevention tools struggling against modern AI threats.


          ​How Delphi Infotech Can Help

          As an authorised Value-Added Distributor (VAD) for Mimecast in India, we work with security teams across Indian enterprises to evaluate, pilot, and deploy Mimecast’s data security solutions, including Mimecast Incydr, the cloud-native insider risk and data loss protection platform.

          Our engagements typically begin with a GenAI Data Risk Assessment, a structured 30-minute conversation to help your team understand your current exposure, identify the highest-risk data flows in your environment, and map a practical path to remediation. There is no obligation and no lengthy sales process.

          Incydr is FEDRAMP-authorised and can be configured for DPDP, GDPR, HIPAA, PCI, and other compliance frameworks, making it well-suited for Indian enterprises operating across regulatory jurisdictions. For enterprises that need to maintain operations during security incidents, email continuity ensures business communication is never interrupted, making it well-suited for Indian enterprises operating across regulatory jurisdictions.

          Delphi Infotech helping organizations secure generative AI adoption and prevent data leaks.


          ​Key Takeaways

            • 73% of Indian enterprises have implemented GenAI tools, but governance and security controls have not kept pace with adoption.
            • Sensitive data is already flowing into public AI platforms daily: source code, customer PII, financial records, credentials, and intellectual property.
            • India’s DPDP Rules (November 2025) impose penalties of up to ₹250 crore for failure to maintain reasonable data security safeguards.
            • Legacy DLP tools have no visibility into browser-based AI tool usage, the most common vector for GenAI data leakage.
            • Banning AI drives usage underground, creating shadow AI and worsening the risk picture. The solution is governed, secure AI adoption.
            • Modern solutions like Mimecast Incydr deploy in days, provide cross-channel visibility, and deliver measurable ROI, including 50% faster incident closure and 172% average ROI.
            • Delphi Infotech offers a complimentary GenAI Data Risk Assessment for Indian enterprises. Reach out at info@delphiinfo.com or visit delphiinfo.com.


          Frequently Asked Questions

          Q: What types of data are most commonly leaked through GenAI tools in enterprise environments?

          A: Based on analysis of enterprise GenAI usage, the most frequently leaked data types include source code (the single largest category), customer data including PII and billing information (46% of sensitive prompts), employee data and payroll information (27%), and legal and financial data (15%). In ChatGPT specifically, Mimecast data shows 158 source code sharing instances per 10,000 enterprise users monthly.


          Q: Does India’s DPDP Act apply to employee data shared through ChatGPT?

          A: Yes. The DPDP Act 2023, now fully operationalised with the DPDP Rules notified in November 2025, applies to the processing of personal data of individuals in India. If an employee shares customer names, phone numbers, addresses, email addresses, or any other personal data through a public GenAI platform, this likely constitutes processing of personal data outside an approved, governed environment, creating compliance exposure under the Act. Penalties can reach ₹250 crore for failure to maintain reasonable security safeguards.


          Q: Is banning GenAI tools an effective security measure?

          A: Banning AI tools rarely works in practice. Research consistently shows that employees continue using prohibited tools, simply through personal accounts and unapproved channels, creating shadow AI that is invisible to security teams. Cisco’s 2024 Benchmark Study found 27% of companies have temporarily banned GenAI, but Menlo Security data shows 68% of employees still use free-tier AI tools despite restrictions. The more effective approach is building a governed, secure framework for AI usage that enables productivity within appropriate guardrails.


          Q: What is shadow AI, and why is it more dangerous than traditional shadow IT?

          A: Shadow AI refers to the use of generative AI tools by employees outside of IT-approved and security-monitored channels. It is more dangerous than traditional shadow IT because it requires no technical skill to implement, just a browser and an internet connection, and because the nature of GenAI interaction (pasting documents, entering queries, uploading files) directly exposes sensitive data. Shadow AI now accounts for 20% of enterprise breaches and adds ₹52 lakh on average to breach costs, according to IBM’s 2025 Cost of a Data Breach Report.


          Q: How quickly can a modern data security platform like Mimecast Incydr be deployed?

          A: Mimecast Incydr deploys in approximately two weeks, compared to the six-month-plus timelines typical of legacy DLP platforms. It requires no complex policy management or lengthy configuration. Per a commissioned Forrester Research report, the solution pays for itself within six months of deployment, with an average 172% return on investment and data loss savings exceeding $680,000. Incident closure time improves by 50% compared to pre-deployment baselines.

          Q: What is a GenAI Data Risk Assessment, and how do we get one?

          A: A GenAI Data Risk Assessment is a structured 30-minute consultation with our team at Delphi Infotech to help you understand your current exposure, specifically, what data may be flowing through unsanctioned AI channels in your organisation, where your highest-risk data flows are, and what a practical remediation roadmap looks like. There is no cost and no obligation. To schedule an assessment, contact us at info@delphiinfo.com or visit delphiinfo.com/contact.




          ]]>          Tue, 16 Jun 2026 16:02:49 +0530