Risk Register
Every privacy risk raised across the platform, in one place, with inherent and residual levels. Risks arrive here automatically from assessments, detections and the modules that raised them.
Open risks
15
Critical residual
3
Accepted
3
Requires periodic re-endorsement
Associated ceiling
₹1600 Cr
Sum of statutory ceilings, not a prediction
Likelihood × impact
Open risks at residual level.
| Rare | Unlikely | Possible | Likely | Almost certain | |
|---|---|---|---|---|---|
| Severe | 1 | 2 | |||
| Major | 1 | 1 | 3 | 1 | |
| Moderate | 1 | 3 | |||
| Minor | 2 | ||||
| Negligible |
Rows are impact (severe at the top), columns are likelihood.
Highest residual risk
What to work on next, in order.
18 risks
| RSK-2026-0310 | Unlawful processing by the AI assistant Personal data including children's records is indexed and retrievable with no declared purpose or lawful ground. | ai | Critical | Critical | ₹200 Cr | open | Dr. Kavya Menon |
| RSK-2026-0311 | Processor contracts without prescribed safeguards Eight processors handle citizen data under contracts that do not carry the Rule 6 security provisions. | third party | Critical | High | ₹250 Cr | accepted | Farhan Ahmed |
| RSK-2026-0312 | Plaintext identifiers in legacy databases Identifier and financial columns are unencrypted at rest in three production systems. | security | High | High | ₹250 Cr | accepted | Naveen Kulkarni |
| RSK-2026-0313 | Children's data processed without verifiable parental consent Scholarship processing relies on a self-declared guardian name. | children | Critical | Critical | ₹200 Cr | mitigating | Arjun Malhotra |
| RSK-2026-0314 | Consent withdrawal not reaching downstream systems Two systems continue to hold and use data after withdrawal. | consent | Critical | High | ₹50 Cr | mitigating | Vikram Saxena |
| RSK-2026-0315 | Cross-border processing without a current assessment Grievance and skill development data sits outside India with expired or absent agreements. | cross border | Critical | High | ₹50 Cr | mitigating | Ananya Reddy |
| RSK-2026-0316 | Retention overrun in the analytics lake Identifiable extracts persist far past their stated retention. | retention | High | Medium | ₹50 Cr | open | Arjun Malhotra |
| RSK-2026-0317 | Unscanned legacy archive 8.6 TB of offline archive has never been inventoried. | governance | High | Medium | ₹50 Cr | open | Dr. Kavya Menon |
| RSK-2026-0318 | Shadow AI exfiltration Staff paste citizen data into consumer AI services outside the department boundary. | ai | Critical | High | ₹250 Cr | mitigating | Imran Sethi |
| RSK-2026-0319 | Grievance response period exceeded 11% of grievances closed beyond the published 90-day period. | rights | High | Medium | ₹50 Cr | open | Harpreet Kaur |
| RSK-2026-0320 | DPIA cadence lapsed As an SDF, the annual DPIA requirement has not been met. | governance | Critical | Critical | ₹150 Cr | open | Vikram Saxena |
| RSK-2026-0321 | Privileged standing access to health data Administrators hold standing access to diagnosis columns with no break-glass requirement. | security | High | High | ₹250 Cr | open | Rohit Verma |
| RSK-2026-0322 | Uncertified entitlements past due 46 access grants across nine repositories remain uncertified. | security | High | Medium | ₹50 Cr | accepted | Farhan Ahmed |
| RSK-2026-0323 | Untested backup for a tier-1 health system No restore test in 14 months. | security | Medium | Low | ₹250 Cr | mitigating | Sunita Khanna |
| RSK-2026-0324 | Purpose drift in the data lake Elements collected for scheme delivery are consumed by undeclared analytics purposes. | governance | High | Medium | ₹50 Cr | mitigating | Farhan Ahmed |
| RSK-2026-0325 | Notice readability above target Three service notices are written above the readability grade the Rules contemplate. | consent | Medium | Low | — | mitigating | Rohit Verma |
| RSK-2026-0326 | Nomination right not exercisable online Section 14 nominations require contacting the department. | rights | Medium | Low | — | mitigating | Naveen Kulkarni |
| RSK-2026-0327 | Connector outage on a cross-border source Discovery has had no visibility of the skill development platform for 11 days. | governance | Medium | Medium | — | mitigating | Naveen Kulkarni |