Become a Member

Regulation TrackerLaws, orders and treaties read for their security duties and clocks Standards & FrameworksAttack taxonomies, control catalogues and frontier frameworks AI Incident DatabaseThe security incident record, with mechanism and lesson Research Paper LibraryThe papers that define the field, summarised OSS DirectoryRed teaming, guardrail, supply chain and evaluation tools Case StudiesProgrammes built, with measured outcomes AI Vulnerability TrackerCVEs and advisories for the components AI systems are built from

Latest in the tracker

New York Stop Addictive Feeds Exploitation (SAFE) for Kids Act and implementing rulesNew York's law restricting algorithmic feeds for minors takes effect on 25 January 2027 under final rules published in July 2026, with certified age assurance and $5,000-per-violation penalties.

Knowledge Base Regulation Tracker Standards & Frameworks OSS Directory AI Incident Database Research Paper Library Case Studies Society Articles News Jobs About Charter Become a Member

Home/News/November 2025

India notifies the DPDP Rules with security safeguards, breach notification and an 18-month timeline

Rule 6 requires encryption, access control, monitoring and one-year log retention; breaches must be reported to the Data Protection Board and to affected individuals, with details within 72 hours; most obligations apply from May 2027.

RegulationIndia14 Nov 2025

The Rules make training data extraction, cross-tenant RAG leakage and agent exfiltration of customer data reportable personal data breaches, with the Act's highest penalty tier reserved for security safeguard failures.

What to do: align AI logging and retention with the Rules, add AI incident scenarios to the breach playbook, and rehearse the 72-hour notification.