Law / regulation
DPDP Act (India)
India's data protection law for digital personal data, made operational by the DPDP Rules, 2025, which come into force in phases until May 2027.
Focus area · Phishing
Phishing Simulation Campaigns
Running ethical, consent-based phishing simulations that measure risk without punishing people.
Phishing remains one of the most common ways attackers gain a foothold. Simulated phishing campaigns, sent with organisational authorisation to staff, help measure exposure and give people safe practice at spotting and reporting suspicious messages.
Simulations can also backfire. Campaigns that trick and shame people damage trust and discourage reporting. Ethical programmes are approved by leadership, HR and legal, respect privacy, avoid manipulative lures, and celebrate reporting at least as much as they track clicks.
Listen to this page
Read aloud in UK English by your own device. Nothing is sent anywhere, and the voice is whichever one your browser provides.
What does this area cover?
- Campaign design and ethics
- Authorisation, lure selection, avoiding harmful pretexts and handling data about individuals.
- Reporting culture metrics
- Why report rate and time-to-report matter more than click rate.
- Simulation vs real-world risk
- What simulations can and cannot tell you about resilience to real attacks.
- Linking results to training
- Just-in-time learning and targeted support rather than punishment.
Related frameworks
Where does Phishing show up in the rules?
Law / regulation
GDPR
The EU's comprehensive data protection law, setting principles, lawful bases, individual rights and accountability duties for anyone processing personal data in its scope.
Certifiable standard
ISO/IEC 27001
The international, certifiable standard for building, running and continually improving an information security management system (ISMS).
Voluntary framework
NIST CSF 2.0
NIST's voluntary, outcome-based framework for understanding, assessing, prioritising and communicating cybersecurity risk, organised into six functions including the new Govern function.