Logging Without Leaking Personal Data

The DPO asked the SOC to stop logging prompts because they contained personal data. The SOC said then they could not investigate. For two weeks they logged everything, including Aadhaar numbers, into a SIEM whose operators included a vendor shift in another city. They had solved neither statute. They had built a second register.

Logging without leaking is a design, not a mood. CERT-In's 28 April 2022 directions want specified ICT logs retained 180 days in Indian jurisdiction. DPDP wants purpose, security and, when the duty applies, erasure. An agent trace is often both an ICT log and personal data. You do not get to pick the statute you prefer this week.

This guide is for DPOs and CISOs on 17 August 2026. Not legal advice. We will not tell you that redaction makes data non-personal in every case. We will tell you how to keep reconstruction without photocopying the citizen into the SIEM.

Prcept will export a packet the department owns, with redaction at source. If a bidder's full observability is an unredacted transcript lake, mark it fail.

What you must be able to reconstruct

Who acted — citizen identifier as a handle you can join under a ticket, officer post, or machine identity — not a paste of their documents.

When, on a clock synced as CERT-In expects.

What verb and what object id.

What was retrieved — document ids and hashes, not necessarily the chunk text of a scanned form.

What was proposed and what was signed, as identifiers and hashes.

That grain survives an audit and an incident. A novel-length prompt dump does not make it better. It makes operators into readers of case files they were not assigned.

Redact at source

If you ship raw prompts to a SIEM and redact in the dashboard, the lake still has the Aadhaar. Redact before the log leaves the application. Store a hold-back of raw traces only if you have a purpose, a tighter ACL, a shorter clock, and a room that is not the general SOC.

Detect obvious identifiers: Aadhaar-shaped, PAN-shaped, phone-shaped, email-shaped. This is hygiene. It will miss free text. Do not claim magic. Combine with ACL and purpose.

Do not send traces to a foreign observability vendor because the dashboard is nice. That is a transfer and a jurisdiction problem for the 180-day floor. Indian jurisdiction means what it says.

What belongs in the general 180-day ICT store versus a tighter hold-back.

Field	General ICT log	Hold-back (if any)
Timestamps, identity handles, verb, object id	Yes	Same
Retrieval document ids / hashes	Yes	Same
Raw prompt with form fields	No	Maybe, short clock, tight ACL
Chunk text of applications	No	Usually no — you still have the source system
Secrets, tokens	No	No
Output hash / speaking-order id	Yes	Same

Operators are readers

Every person who can open traces is an insider relative to the case. Role-based access. Ticket to open a raw hold-back. Dual control if the class is sensitive.

Vendor shifts in other cities, even if the disk is in Mumbai, are people. Name them. If you cannot, they should not see personal traces.

Training and eval copies of logs are new stores. They inherit the map. Deleting production and leaving the eval is how the next customer inherits your citizens.

• Redact before ship.
• Indian jurisdiction for the 180-day store.
• Handles and hashes, not documents, in the general lake.
• Ticketed open on any raw hold-back.
• No foreign observability of live personal traces.

Retention is two clocks

Clock one: CERT-In 180-day rolling floor for specified ICT logs. Do not go shorter on those fields and claim privacy. You will fail the directions.

Clock two: departmental record schedule and DPDP purpose for conversation content and hold-backs. Do not keep raw prompts forever because AI needs data. Purpose ends.

Day 181 is not a licence to destroy a speaking order. Administrative files live on their own schedule. Know which store is which.

Objections you will hear — and what to do with them

These are the lines that stall the file. Answer them in the room, then put the answer in the note. A spoken answer without paper will be forgotten by the next officer.

Redaction will break our ability to debug.

Debug with correlation ids and a short, tight hold-back. Unredacted lakes are how debug becomes a leak. We have seen the laptop.

If we log less, we cannot report to CERT-In.

CERT-In wants useful ICT logs, not a photocopy of every form. Handles, times, systems, and actions are useful. Practise an export.

Hashes are not human-readable for audit.

Auditors reconstruct with the source system plus the hash. They do not need the SIEM to be a second MIS. Give them the packet, not a novel.

We anonymised prompts by hashing names.

If you can join the hash, it is still personal data. Call it a handle. Do not call it anonymous.

A three-week log rewrite

DPO and CISO in the same room. One sheet, two clocks.

1. Week 1: inventory every trace path — app, SIEM, vendor, eval, laptop.
2. Week 1: stop any foreign replay of personal prompts.
3. Week 2: implement redact-at-source. Keep handles, verbs, ids, hashes in the 180-day Indian store.
4. Week 2: decide whether a raw hold-back exists; if yes, seven-to-fourteen days, two-person.
5. Week 3: export drill for CERT-In and for one CAG-style case packet.
6. Week 3: joint note signed. Operators recertified on who may open what.

How this shows up in the file

Subject: Logging design — agent [name] — CERT-In grain and DPDP restraint.

General ICT store (180 days, India): [fields]. Raw hold-back: [none / location, clock, ACL]. Redaction: at source. Foreign replay: none. Eval copies: [map]. Two clocks written. CERT-In reporting will use this grain; no invented AI log type. Conversation content treated as personal data where it identifies. Not legal advice.

Silence is not listed as the privacy control.

Two clocks, one sheet

Write both clocks on one page the DPO and CISO initial. Clock one: CERT-In 180 days, India, handles and hashes. Clock two: purpose for raw hold-backs, then delete. Day 181 is not a licence to destroy a speaking order. Know which store is the administrative file.

Ask who can replay, not only where the disk sits. A Mumbai region with a foreign support replay is a transfer. Turn that replay off for personal desks. Ugly dashboards are cheaper than a second Aadhaar folder.

Practise an export. CERT-In wants useful ICT grain, not a novel. CAG wants a reconstructable packet. Neither wants operators reading unassigned case files because the SIEM was chatty.

This article is informational field guidance for Indian public institutions, not legal, procurement, security-accreditation or engineering advice. Confirm against the current Gazette, GFR, GeM term, CVC instruction, CERT-In direction, DPDP text, departmental manual and your counsel before you file it.

How to fail this before citizens do

“Logging Without Leaking Personal Data” is a path problem. A P6 Compliance/DPO should be able to name the tool, the identity, the secret and the egress that would make “PII redaction logging” real. If the only control is a network diagram from last year, you have a story, not a threat model.

Silence is not privacy. A full transcript is not security. Keep the 180-day grain that reconstructs an act, and strip the fields that turn the SIEM into a second Aadhaar folder. Air-gap is not automatically secure. Prompt injection is not a conference joke when the agent can write a ticket. CERT-In still wants specified logs in India and incidents on a six-hour clock. Write those clocks into the runbook.

1. Red-team the write tools, not only the chat UI.
2. Kill undeclared outbound paths on staging.
3. Redact personal data from logs you will actually keep.
4. Scope a pentest that includes RAG and connectors.
5. Cap metered spend so a loop cannot empty a budget.

Close this loop before the next CAB

Put “Logging Without Leaking Personal Data” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P6 Compliance/DPO, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “PII redaction logging” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.

What the next file must contain

“Logging Without Leaking Personal Data” earns a line in the noting only if a P6 Compliance/DPO can attach proof of “PII redaction logging.” A heading is not proof. A vendor slide is not proof. A workshop photograph is not proof.

Write three dated sentences: what was decided, who owns it after the next posting order, and when it will be re-checked. If you cannot write the three sentences, you are not ready to buy, to sell, or to go live.

Leave unsourced percentages out of the note. DPDP is not a blanket localisation statute. The November 2025 AI governance text is guidance, not an Act. CERT-In’s 28 April 2022 directions still set specified incident and log clocks. A PAC, when lawful, lives in GFR Rule 166.

• Name the designation that owns “PII redaction logging.”
• Attach one artefact a stranger can open next year.
• Record the instrument you are actually using.
• Revisit when the model, the SI, the notice or the posting changes.