Security Information and Event Management (SIEM)
A platform that aggregates security-relevant logs from across an environment, correlates them to detect threats and provides the evidence trail for incident response.
Full Definition
A Security Information and Event Management (SIEM) platform collects logs from firewalls, endpoints, cloud services, identity providers, SaaS applications and custom applications; normalises them into a common schema; applies correlation rules and ML-based anomaly detection; and generates alerts for security operations teams. Modern SIEMs double as the evidence store for incident response: when a breach happens, the SIEM has the logs needed to scope impact and produce the regulator report.
For privacy specifically, SIEM data is often itself personal data (log entries record who accessed what and when). GDPR, DPDP and PDPA retention and purpose-limitation principles apply to the SIEM's own data — logs cannot be kept forever just because they are useful for security. DPDP Rule 8(3) specifically mandates a minimum one-year retention for processing logs, which lines up with most organisations' security retention baseline. Longer retention requires its own lawful basis and is justified case-by-case.
Related terms
Audit Trail
An append-only, time-stamped record of events that lets an auditor reconstruct what happened to personal data and who did it.
Incident Response
The structured process by which an organisation detects, triages, contains, remediates and learns from a security or privacy incident.
Retention
The period for which an organisation keeps a specific category of personal data, defined by purpose, legal obligation or user agreement.
Relevant regulations
Automate your privacy program
TruePrivacy handles DSRs, consent management, data mapping, and breach response — all in one platform.
Free 14-day trial · No credit card required · Setup in minutes