Section 8(5) · Rule 6
DSPM endpoint agent for laptops and desktops
Personal data does not only live in databases. The DSPM endpoint agent scans local files on enrolled devices and reports masked findings, not the files.
Sample workspace
Enrolled devices
- FIN-MBP-014 · macOS3 findings
- HR-WIN-022 · Windows7 findings
- DEV-LNX-005 · LinuxNo findings
HR-WIN-022
- Scan finished
- PAN in salary_sheet.xlsx · ••••••234F
- Follow up with device owner
Short answer
Section 8(5) of the DPDP Act requires reasonable security safeguards, and Rule 6 lists measures such as access control and masking. Copies of personal data on staff laptops are easy to miss. TruePrivacy's DSPM endpoint agent runs on macOS (Intel and Apple silicon), Windows and Linux, scans local files on enrolled employee devices, and reports findings with masked samples, not the raw files.
What the DSPM endpoint agent does
Exports, attachments and downloaded files can leave copies of personal data on laptops and desktops. Scans of servers and SaaS tools do not see those copies; the DSPM endpoint agent looks at local files on the devices you enrol. Because findings are masked, reviewers can act on them without seeing the raw values.
macOS on Intel and Apple silicon, Windows and Linux, so a mixed fleet can be enrolled.
Scans local files on enrolled employee devices.
Reports findings with masked samples, not the raw files, so reviewers see what kind of data sits where.
Endpoint scanning is an optional add-on to your plan. See pricing.
How endpoint scanning works
- 01Enrol devices
Install the agent on the employee devices you choose to enrol. Start with teams that handle personal data most, such as finance, HR and customer support.
- 02Scan local files
The agent scans local files on each enrolled device and reports what it finds.
- 03Review masked findings
Findings arrive with masked samples, so reviewers see what kind of data was found without the raw file being sent.
- 04Follow up
Work with the device owner under your own policy to delete or move files that should not be there, and check whether the same data also sits in a connected system.
Mapped to the Act and Rules
| Duty | Section or rule | What TruePrivacy does |
|---|---|---|
| Reasonable security safeguards | s.8(5) | Finds personal data in local files on enrolled devices |
| Encryption, obfuscation, masking or virtual tokens | Rule 6 | Findings carry masked samples, not raw files |
| Erase when the purpose is no longer served | s.8(7) | Shows stray copies on devices so your team can remove them |
| Correction and erasure on request | s.12 | Shows copies on devices that an erasure request may need to reach |
| Access control and visibility of access | Rule 6 | Findings from devices sit alongside cloud stores and databases in data security posture |
Before you enrol employee devices
Tell employees what the agent scans and why, and enrol devices under your IT and HR policies. Decide in advance who may see findings from an employee's device. Check with counsel how DPDP applies to your employee data, including the legitimate use for employment purposes in s.7(i).
The employee data guide covers notices and legitimate uses for staff data. Agree the scope with HR before the first scan.
Works with
One view across devices, cloud stores and databases, with issues and identities.
Data classificationData classes and India-specific detection rules for the personal data you find.
Data discoveryScans of databases, cloud storage and SaaS tools.
Retention and erasureRetention rules and manual purge flags for data that must go.
Which operating systems does the DSPM endpoint agent support?
macOS on Intel and Apple silicon, Windows and Linux.
Does the agent send employee files to TruePrivacy?
No. It reports findings with masked samples, not the raw files.
Is endpoint scanning included in every plan?
No. Endpoint scanning is an optional add-on. Priced on scope, never per seat. Unlimited users. Quotes in INR, GST extra.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin