Law / regulation
DPDP Act (India)
India's data protection law for digital personal data, made operational by the DPDP Rules, 2025, which come into force in phases until May 2027.
Focus area · SOC
Security Operations (SOC)
How security operations centres detect, triage and respond — and the reporting duties that follow an incident.
A security operations centre (SOC) brings together people, processes and technology to monitor for, detect, investigate and respond to cybersecurity events. NIST CSF 2.0 describes these outcomes in its Detect, Respond and Recover functions.
Modern SOC work is inseparable from compliance. Once personal data is involved, legal clocks start: 72 hours under GDPR, a 72-hour detailed report to India’s Data Protection Board under the DPDP Rules, and HIPAA’s 60-day outer limit. SOC playbooks need those clocks built in.
Listen to this page
Read aloud in UK English by your own device. Nothing is sent anywhere, and the voice is whichever one your browser provides.
What does this area cover?
- Detection coverage
- Mapping log sources and detections to the threats and assets that matter most.
- Incident triage and escalation
- Severity models, escalation paths and handing off to legal and privacy teams.
- Breach notification timelines
- Regulatory clocks across GDPR, the DPDP Rules, HIPAA and sector regulators.
- SOC metrics and governance
- Time to detect and respond, coverage, and reporting to leadership.
Related frameworks
Where does SOC show up in the rules?
Law / regulation
GDPR
The EU's comprehensive data protection law, setting principles, lawful bases, individual rights and accountability duties for anyone processing personal data in its scope.
Certifiable standard
ISO/IEC 27001
The international, certifiable standard for building, running and continually improving an information security management system (ISMS).
Voluntary framework
NIST CSF 2.0
NIST's voluntary, outcome-based framework for understanding, assessing, prioritising and communicating cybersecurity risk, organised into six functions including the new Govern function.
Law / regulation
HIPAA
US federal law and HHS rules protecting the privacy and security of protected health information held by covered entities and their business associates.
Reading
Guides and explainers
Practical guide
Breach Notification Clocks Compared: GDPR, India's DPDP Rules and HIPAA
72 hours, 'without delay', 60 days: how breach notification deadlines, thresholds and recipients differ under GDPR, the DPDP Rules 2025 and HIPAA — and how SOC teams should prepare.