- Detect and containMonitoring and reports both feed the same queue. Containment comes before investigation.
- AssessWhat data, whose, and whether it left our systems.
- NotifyIf your data is affected you are told, with what we know at the time, rather than after the investigation concludes. Regulatory notification follows the timelines the DPDP Act sets.
- Remediate and reportA written account of what happened, what we changed, and what would have prevented it.
We will not wait to have a complete story
A late notification with a tidy narrative is worse for you than an early one with gaps.
NADI · DOCUMENT
● Status current
● Plain language yes
● Contact stated
✓ published, dated, binding
Read the rest of it.
Every one of these pages says what we do, what we do not, and who to write to when it matters.