Quarterly Portfolio Report
Q2 FY 2026–27 · 24 entities · issued 07 August 2026
1. Executive summary
- 16 entities improved this quarter and 6 declined. The portfolio mean stands at 59%.
- 8 entities remain at critical risk, carrying 71 critical gaps between them.
- 7 SLA breaches, ₹9,91,020 in penalties, pending departmental confirmation before set-off.
The portfolio continues to improve, but the improvement is concentrated in entities that were already ahead. The bottom quartile has moved least, and three of the four entities in it have never completed a formal assessment. That is the single most consequential fact in this report: an entity that has not been assessed does not have a low score, it has an unknown one.
2. Readiness by entity
| Entity | Readiness | Δ | Critical gaps | Last assessed |
|---|---|---|---|---|
| Food & SuppliesSDF | 91% | -6 | 2 | 24 Jan 2026 |
| Electricity Distribution…SDF | 86% | +5 | 0 | 15 Jan 2026 |
| Social Justice & Empowerment | 86% | +1 | 0 | Never |
| Cooperative BankSDF | 85% | +6 | 1 | 10 Jun 2026 |
| Women & Child Development…SDF | 83% | -4 | 2 | 20 Mar 2026 |
| Higher EducationSDF | 76% | +4 | 1 | 24 Jan 2026 |
| Citizen Services & Public…SDF | 74% | +6 | 2 | Never |
| Labour & Employment | 74% | +7 | 2 | 17 Jun 2026 |
| Transport Authority | 74% | +1 | 0 | 28 Nov 2025 |
| Agriculture Marketing Board | 74% | 0 | 1 | Never |
| School EducationSDF | 71% | +2 | 1 | 11 Jan 2026 |
| Industrial Development…SDF | 68% | -1 | 1 | 28 Jun 2026 |
| District Administration —… | 56% | +1 | 5 | Never |
| Health & Family WelfareSDF | 54% | -5 | 3 | 01 Dec 2025 |
| Housing Board | 47% | +7 | 4 | 07 Jun 2026 |
| Pollution Control Board | 43% | +8 | 9 | Never |
| Public Works Department | 41% | +1 | 9 | 19 Feb 2026 |
| Industrial City | 39% | +1 | 7 | 12 May 2026 |
| Skill Development Mission | 34% | +8 | 10 | 28 Jun 2026 |
| Real Estate Regulatory… | 33% | -1 | 11 | 02 Apr 2026 |
| Capital CitySDF | 31% | 0 | 8 | Never |
| District Administration —… | 31% | +1 | 4 | 06 Mar 2026 |
| Revenue & Disaster… | 30% | -5 | 8 | 13 Apr 2026 |
| Warehousing Corporation | 30% | +8 | 9 | 16 Jan 2026 |
3. Risk concentration
Three obligations account for most of the open critical gaps across the portfolio: reasonable security safeguards under Section 8(4) read with Rule 6, retention and erasure under Section 8(7) read with Rule 8, and processor contracting under Section 8(2). None of the three is difficult in isolation. All three fail at scale for the same reason — they require a complete inventory of where personal data actually is, and entities that have not deployed Discovery are working from an inventory compiled by asking people.
4. Incidents and Board correspondence
22 incidents remain open across the portfolio. Every Board notification due in the quarter was filed within the seventy-two hour window, though two were filed in the final six hours of it. The pattern in both cases was the same: impact assessment took longer than the plan assumed because the affected systems were not classified.
5. Data Principal rights performance
807 requests are open, of which 163 are past the statutory period. The overdue tail is concentrated in 10 entities, and in each of them the bottleneck is identity verification rather than data assembly.
6. Engagement delivery
34 work orders have been placed against the rate contract, worth ₹10,05,00,000. 16 have been delivered or accepted; 2 are on hold.
7. SLA performance and penalties
53 of 60 measured service levels were met. The 7 breaches attract ₹9,91,020 under the contract schedule. Penalties are computed automatically and require confirmation by the concerned department before set-off against the next invoice.
8. Recommended actions
- 1Direct the four never-assessed entities to complete a gap assessment within eight weeks, funded from the central allocation rather than departmental budgets — the funding question is what has stalled them.
- 2Approve a portfolio-wide model DPA template for processor contracting. Twenty-four entities negotiating the same clauses separately is the reason Section 8(2) coverage is where it is.
- 3Prioritise Discovery deployment at the six entities with the lowest readiness. Every downstream obligation depends on it, and the correlation in this portfolio between Discovery deployment and readiness is the strongest single relationship in the data.
- 4Confirm or contest the computed penalties within the quarter so the set-off can be applied to the next invoice cycle.