Endpoint DLP for the DPDP Act
Stop personal data leaving through USB, email, browser, print and clipboard
Complynz is the only DPDP compliance platform in India that ships an endpoint DLP agent. It runs on Windows, macOS and Linux devices and watches the channels where personal data actually leaks: USB and removable media, email, browser uploads, print, clipboard and screenshots. Content is classified against India-specific identifiers such as Aadhaar, PAN, passport, voter ID, GSTIN, bank and UPI details, and a policy decides the response: allow, alert, ask for a justification, quarantine or block. Every event becomes an incident with AI triage, an owner and an evidence trail, and legal hold keeps what an investigation needs.
Last updated: . Published by Complynz.
Built for: CISOs, IT heads and DPOs at Data Fiduciaries in India with laptops, shared drives and removable media in play: BFSI, NBFCs, insurers, healthcare, retail, manufacturing and technology teams.
Key facts
| Agent | Windows, macOS and Linux, managed from one console |
|---|---|
| Channels | USB, email, browser and upload, print, clipboard and screenshots |
| Responses | Allow, alert, justify, quarantine or block, per policy |
| Detection | India-specific identifiers plus secrets and credentials |
| Scope | By organisational unit, department, persona, group or endpoint |
| DPDP sections | Sections 8, 10, 12 and 16 |
An endpoint agent for Windows, Mac and Linux
The agent sits on the device, where files are opened, copied, printed and pasted. It scans in real time, applies the policies published to it, and reports to the console that manages the whole fleet.
- Agent for Windows, macOS and Linux devices, with one console for the fleet
- Endpoint inventory managed from the console
- Commands to the agent and a log of what was issued and when
- Agent control to switch capabilities on or off per scope
- Findings are reported with masked values, not copies of the data
- Works with data discovery, so classifications at rest drive protection in use
Every channel where data leaves the endpoint
Most leaks are not breaches by outsiders. They are a spreadsheet on a USB stick, a KYC file in a personal email, an API key pasted into a web tool. The agent covers the channels that matter.
- USB and removable media
- Email attachments and bodies
- Browser and web uploads
- Print jobs, including shared printers
- Clipboard text and screenshots
- A live scan feed showing each event, its channel, what was detected and the verdict
A policy studio with graded responses
A policy ties a label to channels and an action. Blocking everything stops work; the studio lets you block the dangerous, ask for a reason on the grey area and only alert where visibility is enough.
- Actions: allow, alert, justify, quarantine or block
- Versioned policies with an explicit publish step
- Policy scope by organisational unit, department, persona, group or endpoint
- A directory of users and devices to scope against
- AI-assisted suggestions to start from sensible policies
- Plain-language policy descriptions your auditors can read
India-aware classification and sensitivity labels
Labels turn detection into policy. Each label names the PII categories that trigger it, such as Aadhaar, PAN, passport and voter ID for customer KYC, and can be stamped onto the document itself so people see its classification wherever it goes.
- Labels built on India-specific identifiers, health, tax, financial and secret categories
- Severity per label, with colour and description
- Stamp the label onto Word, PowerPoint, PDF and image files, with an optional watermark
- Starter labels you can suggest and edit
- Labels shared with policies, so the same classification drives the action
- Original files are kept for a limited time so a stamp can be reversed
Incidents, AI triage, legal hold and evidence
A blocked or flagged event becomes an incident with severity, channel, user, resource and the action taken. AI triage proposes a severity and action you can accept or change, and legal hold keeps what an investigation needs.
- Incident queue with severity, status and the policy action
- AI triage that proposes severity and action for review
- Group incidents by department, persona or location
- Export to CSV for audit and review
- Legal hold on endpoints and records involved in an investigation
- Evidence you can reuse for breach assessment and DPDP audit
How it works
What happens when someone moves a file
The agent classifies the content, finds the matching policy and applies the action in the moment.
Flowchart as text:
- Person copies, sends, uploads or prints a file → Agent on the device sees the event
- Agent on the device sees the event → Classify the content for Aadhaar, PAN, bank, UPI and secrets
- Classify the content for Aadhaar, PAN, bank, UPI and secrets → Does a label match?
- Does a label match? → (No) Allow and log the scan
- Does a label match? → (Yes) Find the policy for this channel and scope
- Find the policy for this channel and scope → Policy action
- Policy action → (Alert) Allow and raise an alert
- Policy action → (Justify) Ask for a reason, then allow or stop
- Policy action → (Quarantine) Hold the file for review
- Policy action → (Block) Stop the transfer
- Allow and raise an alert → Incident and evidence trail
- Ask for a reason, then allow or stop → Incident and evidence trail
- Hold the file for review → Incident and evidence trail
- Stop the transfer → Incident and evidence trail
From incident to closure
Each event is triaged, owned and closed with the outcome kept as evidence.
Flowchart as text:
- Policy event on an endpoint → Incident created with channel, user and resource
- Incident created with channel, user and resource → AI triage proposes severity and action
- AI triage proposes severity and action → Reviewer accepts?
- Reviewer accepts? → (Yes) Apply the proposed severity and action
- Reviewer accepts? → (No) Reviewer sets severity and action
- Apply the proposed severity and action → Needs an investigation?
- Reviewer sets severity and action → Needs an investigation?
- Needs an investigation? → (Yes) Legal hold on the endpoint and records
- Needs an investigation? → (No) Close with the outcome logged
- Legal hold on the endpoint and records → Personal data breach?
- Personal data breach? → (Yes) Open breach notification and start the 72-hour clock
- Personal data breach? → (No) Close with the outcome logged
From a label to a protected document
One label defines what counts as sensitive, which policy fires, and how the document is marked.
Flowchart as text:
- Define a label: PII categories and severity → Agent detects those categories in files
- Agent detects those categories in files → Stamp the label on the document
- Agent detects those categories in files → Policies reference the label
- Policies reference the label → Scope to units, departments, personas or endpoints
- Scope to units, departments, personas or endpoints → Publish a new policy version
- Publish a new policy version → Agents pull the policy
- Agents pull the policy → Events are allowed, justified, held or blocked
- Events are allowed, justified, held or blocked → Review incidents and refine the label
- Review incidents and refine the label → Define a label: PII categories and severity
How this maps to the DPDP Act
| Section | Subject | What you must be able to show |
|---|---|---|
| Section 8 | Reasonable security safeguards | A Data Fiduciary must protect personal data in its possession. Controls on the channels where data leaves a device are a direct safeguard. |
| Section 8 | Breach intimation | A personal data breach must reach the Board and the people affected. Incidents and evidence from the endpoint are the starting facts for that assessment. |
| Section 10 | Significant Data Fiduciaries | Audits and impact assessments are stronger when there is evidence that controls work, not just policies on paper. |
| Section 12 | Erasure | Erasure obligations reach copies on endpoints and removable media, which is where unmanaged personal data collects. |
| Section 16 | Cross-border transfer | Controlling uploads and email from endpoints reduces unplanned transfers of personal data outside India. |
How it fits with the other Complynz products
- Data Discovery & DSPM: Discovery finds personal data at rest on endpoints and in connected systems; DLP protects it when it moves.
- Consent Management: Consent records say what each purpose allows; DLP helps stop data from leaving those purposes by accident.
- Gap Assessment: A gap assessment checks safeguards against the Act and uses endpoint evidence for control monitoring.
- Breach Notification: A serious incident can open a breach notification directly, with the endpoint evidence attached.
- Third-Party Risk (TPRM): Policies can restrict what is shared with vendors and where, and vendor reviews use the same register.
Frequently asked questions
What is endpoint DLP and why does DPDP need it?
Endpoint data loss prevention watches the device where people open, copy, send, upload and print files, and stops or flags personal data leaving by an unapproved route. The DPDP Act requires reasonable security safeguards, and most everyday leaks happen from endpoints rather than from attacks on servers.
Which DPDP platform has an endpoint DLP agent?
Complynz is the only DPDP compliance platform in India that ships an endpoint DLP agent. Other DLP products exist as stand-alone tools; check each vendor's own pages for what they cover.
Which channels does the agent cover?
USB and removable media, email, browser and web uploads, print, clipboard and screenshots. A live scan feed shows each event with its channel, what was detected and the verdict.
What can a policy do when it detects personal data?
Allow, alert, ask the person to justify, quarantine or block. Each policy names the labels and channels it covers and the scope it applies to, so you can block KYC identifiers over USB while only alerting on tax data in the clipboard.
Which identifiers does it recognise?
India-specific identifiers including Aadhaar, PAN, passport, voter ID, driving licence, GSTIN, bank account, IFSC and UPI, health identifiers, plus credit cards and secrets such as API keys and passwords. Labels group them into categories you can edit.
Can I apply different policies to different teams?
Yes. A policy can be scoped by organisational unit, department, persona, group or specific endpoints, using a directory of users and devices.
Does the platform store the personal data it detects?
Detections are reported with masked values and counts by category. The aim is to prove that a control worked and where the risk is, not to copy the data into another system.
How does an incident connect to breach notification?
An incident carries its channel, user, resource, severity and evidence. If the review decides personal data was exposed, you can open a breach record with those facts and start the 72-hour clock for the Board report.
Does it replace a CASB or network DLP?
No. This product protects personal data on endpoints. It does not claim to inspect cloud applications or network traffic; those controls complement it.