Verdict: Your secure SQL database is not the risk; the
.csvon your HR Manager’s desktop is the liability.Motive: “Dark Data” (Unstructured/Shadow IT) violates Purpose Limitation under the DPDP Act 2023.
Fix: Shift from “Manual Audits” to “Automated Discovery & Defensible Deletion.”
The “Iceberg” of Non-Compliance
You might be wondering why your CISOs are losing sleep despite spending millions on firewalls. In my 29 years of IT Forensics, I have found that the “Smoking Gun” is almost never in the encrypted Core Banking System. It is inevitably in that forgotten Excel dump in the “Downloads” folder.
This is the “Dark Data” Reality. Organizations focus 90% of their security budget on 10% of their data (Structured Databases). However, 80-90% of enterprise data is “Unstructured”—emails, PDFs, and spreadsheets that have no owner, no classification, and no expiration date.
Under the DPDP Act 2023, a privacy policy that only covers your SQL Database is a “legal fiction.” If you cannot map the Excel sheet on a shared drive, you are already paying the “Chaos Tax.”
Forensic Insight: The “Radioactive” Asset
Why the DPDP Act weaponizes this negligence:
Purpose Limitation: The Act mandates data must only be used for the purpose it was collected. “Dark Data,” by definition, has no current purpose. It is a liability sitting in storage.
Storage Limitation: You must delete data once the purpose is served. “Dark Data” violates this indefinitely.
The Penalty: If a breach occurs in a “Shadow File,” the Data Fiduciary is liable for up to ₹250 Crores. The regulator will not accept “We didn’t know it was there” as a defense.
The “UAT” Trap: The Silent Killer
The most dangerous form of Dark Data is the UAT Environment. Developers often copy “Production Data” into “Testing Environments” to debug code.
The Risk: These UAT environments usually lack the encryption and access controls of Production.
The Breach: In my forensic audits, I consistently find PII (Personally Identifiable Information) accessible to third-party vendors in testing environments. This is a direct violation of Data Sovereignty.
The Solution: Automated Discovery as Legal Defense
You cannot find Dark Data with a questionnaire. You need Automated Crawlers.
The Hakim Protocol for Discovery:
Scan: Run discovery tools across all endpoints, shared drives, and cloud buckets.
Classify: Auto-tag files containing PAN, Aadhaar, or Medical info.
Purge: Implement a “Defensible Deletion” policy. If it has no owner, it gets deleted.
Demonstrating that you use automated discovery proves “Reasonable Security Safeguards” to the Adjudicating Officer, preserving your Institutional Integrity.
METADATA OUTPUT:
File Name:
dark-data-liability-dpdp-act-adv-shoeb-hakim.webpAlt Text: “Adv Shoeb Hakim analyzing dark data risks in Excel sheets and UAT environments under DPDP Act 2023.”
Title Text: Dark Data Liability | Adv Shoeb Hakim
Caption: The Excel Sheet Liability: Why Shadow IT is a ₹250 Cr Risk | Source: shoebhakim.com
Description: An analysis of how unstructured ‘Dark Data’ like spreadsheets and UAT dumps creates liability under the Digital Personal Data Protection Act 2023.
Q1: What is the primary characteristic of “Dark Data”?
A) It is encrypted and secure.
B) It is collected/stored but unused and unclassified.
C) It is data stored on the Dark Web.
D) It is data belonging to government agencies.
Q2: Under the DPDP Act 2023, what is the maximum penalty for failing to take reasonable security safeguards?
A) ₹50 Crore
B) ₹250 Crore
C) ₹500 Crore
D) 4% of Global Turnover
Q3: Why is using Production Data in a UAT (User Acceptance Testing) environment risky?
A) It slows down the testing process.
B) It violates Purpose Limitation and increases breach surface.
C) It requires expensive software licenses.
D) It is not compatible with new code.
Q4: (Transition) Under the old IT Act (SPDI Rules), “Consent” was often bundled. How does the DPDP Act 2023 change this for “Dark Data”?
A) It allows continued storage without consent.
B) It mandates “Purpose Limitation,” making undefined storage illegal.
C) It has no specific provision for stored data.
D) It only applies to new data collection.
Answer Key: 1-B, 2-B, 3-B, 4-B.
