What are “reasonable security safeguards” under DPDPA, and what must an Indian CTO build by May 2027?

November 12, 2026

What are reasonable security safeguards under DPDPA? Quick answer

Seven minimum controls, listed in Rule 6 of the DPDP Rules 2025: encryption or masking of personal data, access control, logging and monitoring that can detect unauthorised access, backups for continuity, one-year log retention, security clauses in every Data Processor contract, and organisational measures that keep them working. They bind every Data Fiduciary from 13 May 2027; the penalty for failure is up to ₹250 crore.

Six months to go: 13 November 2026 to 13 May 2027.
Overlap to resolve: CERT-In wants 180-day logs and a 6-hour incident report; DPDPA wants one-year logs and a 72-hour detailed report.
Benchmark: IBM put the average Indian breach at ₹22 crore in 2025, up 13%.

Tomorrow, 13 November 2026, is the date most DPDPA coverage has fixated on: Rule 4 of the DPDP Rules 2025 comes into force and Consent Managers can apply to the Data Protection Board for registration. For most Indian companies that is a non-event. Nothing new is owed by an ordinary business tomorrow. What tomorrow does mark is a cleaner milestone for CTOs: exactly six months until 13 May 2027, when Section 8(5) of the Act and Rule 6 of the Rules start to bind every Data Fiduciary, and the ₹250 crore penalty for failing to take "reasonable security safeguards" becomes enforceable.

We have written before about what DPDPA compliance costs a mid-size company and whether you need a Data Protection Officer. This post is for the person who owns the servers. It sets out what Rule 6 actually says, where it collides with the CERT-In Directions you already follow, and a six-month plan that fits the time left.

What does Rule 6 require, clause by clause?

Section 8(5) of the DPDP Act 2023 makes a Data Fiduciary responsible for protecting personal data in its possession or control, including data processed on its behalf by a Data Processor. Rule 6(1) then sets the floor. The word "minimum" is in the rule: these are not best practices, they are the least an auditor or the Board will expect to see.

Rule 6(1) clause	What it asks for	What to be able to show
(a) Data security measures	Encryption, obfuscation, masking or virtual tokens mapped to the data	An inventory of personal-data stores with the control applied to each, and the key-management arrangement
(b) Access control	Control of access to the computer resources used by you or your processors	Role-based access, MFA on admin paths, joiner-mover-leaver records, quarterly access reviews
(c) Logs, monitoring and review	Visibility that lets you detect, investigate and remediate unauthorised access	Centralised logs, alerting, and a record that someone actually reviews them
(d) Continuity	Reasonable measures, such as backups, to keep processing if confidentiality, integrity or availability is hit	Tested backups, a restore drill log, a documented recovery time
(e) One-year retention	Logs and the related personal data kept for one year from the processing, unless another law requires longer	A retention policy that reconciles this with your erasure obligations
(f) Processor contracts	Appropriate contract provisions requiring processors to take reasonable safeguards	A security annex in every vendor agreement that touches personal data
(g) Organisational measures	Technical and organisational measures that make the above effective	Policies, ownership, training records, a named owner for each control

Two things stand out for engineering leaders. First, clause (e) is a retention mandate inside a privacy law: you must keep logs and the data they relate to for a year, even while Rule 8 pushes you to erase data you no longer need. Your retention schedule has to hold both. Second, clause (f) makes your vendors' security your problem. Section 8(2) lets you use a processor only under a valid contract, and Rule 6 says what that contract must now contain.

How does Rule 6 sit alongside the CERT-In Directions?

Most Indian technology teams already run under the CERT-In Directions of 28 April 2022, issued under Section 70B(6) of the IT Act. Those Directions are not replaced by DPDPA; they stack on top of it. The practical differences are worth a table of their own, because the stricter of each pair is the one you design for.

Requirement	CERT-In Directions (2022)	DPDP Act and Rules (from 13 May 2027)
Who it covers	Service providers, intermediaries, data centres, body corporates, government bodies	Every Data Fiduciary processing digital personal data of Indian residents
Log retention	180 days, stored within Indian jurisdiction	One year for logs and related personal data (Rule 6(1)(e))
Incident reporting clock	Within 6 hours of noticing a cyber incident	Notify affected Data Principals and the Board without delay; detailed report to the Board within 72 hours (Rule 7)
Who must be told	CERT-In	The Data Protection Board and each affected individual (Section 8(6))
Trigger	Listed cyber incident types, whether or not personal data is involved	Any personal data breach, with no risk threshold
Penalty	Section 70B(7) of the IT Act: imprisonment up to one year and/or fine	Up to ₹250 crore per instance under the Schedule to the Act

The design consequence is simple. Set log retention to twelve months, not six. Build your incident runbook so that the same first six hours produce both the CERT-In notification and the first DPDPA notices, and the next sixty-six hours produce the detailed report. Our earlier post on the 72-hour breach window walks through what that report must contain.

What is the realistic cost of getting this wrong?

The statutory ceiling gets quoted everywhere: the Schedule to the Act sets a penalty of up to ₹250 crore for a breach of Section 8(5), the highest band in the law. The Board will weigh the nature, gravity and duration of the breach, so the cap is not the expected figure. The better planning number is the cost of the breach itself. IBM's Cost of a Data Breach Report for India, released on 7 August 2025, put the average cost of a breach at ₹22 crore (INR 220 million), a 13% rise on 2024 and the highest the report has recorded for India. Phishing (18%), third-party and supply-chain compromise (17%) and vulnerability exploitation (13%) were the leading entry points, and the average breach took 263 days to identify and contain.

Read those three entry points against the Rule 6 table. Phishing is an access-control and monitoring problem (clauses (b) and (c)). Supply-chain compromise is a processor-contract problem (clause (f)). Exploited vulnerabilities are a patching and review problem (clause (g)). The rule is, in effect, a list of the ways Indian companies are already losing money.

A six-month plan from 13 November 2026 to 13 May 2027

Weeks 1–3 (to early December): inventory. List every system, SaaS tool and vendor that stores or processes personal data of Indian residents, including HR, payroll and the CRM. Record the owner, the data categories and the control currently applied. This inventory is the artefact every later step depends on.
Weeks 4–8 (December to mid-January): gap-score each clause. For each system, mark clauses (a) to (g) as met, partial or missing. Prioritise systems holding children's data, financial data or health data, where a breach also triggers other regulators.
Weeks 9–14 (to end of February): close the technical gaps. Turn on encryption at rest where it is off, enforce MFA on every administrative path, centralise logs, set retention to twelve months, and run a restore test with a timed result.
Weeks 15–20 (March to mid-April): fix the paper. Issue a security annex to every processor and sub-processor, map it to clause (f), and get it signed. Write the retention policy that reconciles the one-year log rule with erasure. Appoint a named owner for each control.
Weeks 21–26 (to 13 May 2027): rehearse. Run a tabletop breach exercise against the dual CERT-In and DPDPA clocks, record what the 72-hour report would have said, and fix the gaps the exercise finds. Keep the evidence; it is what you will show the Board.

Does an ISO 27001 certificate already prove Rule 6 compliance?

It helps more than almost anything else, but it is not the same thing. ISO 27001:2022 controls cover encryption, access, logging, backup and supplier relationships, so a certified organisation will usually have most of clauses (a) to (g) in place. What the certificate does not prove is the Rule 6 specifics: the one-year retention period, the DPDPA-worded processor clause, and the link between each control and the personal data it protects. Treat the certificate as strong evidence and build a short Rule 6 mapping document on top of it. Qodequay is itself ISO 27001:2022 certified and that is exactly how we handled our own gap review.

Where a compliance platform fits

Rule 6 is mostly engineering work that nobody can do for you. The part a platform can carry is the evidence: proving, months later, which control applied to which data, which vendor signed which clause, and what the breach timeline looked like. DAPro (Data Adhikaar), Qodequay's DPDPA compliance platform, keeps that record in a tamper-evident Evidence Vault, connects to the systems in your inventory through 25+ connectors, and generates notices in 22 languages. If you would like a Rule 6 gap review against your current stack before the six months run out, book a 30-minute call with our team.

Frequently asked questions

Does Rule 6 of the DPDP Rules apply to small companies and startups?

Yes. Rule 6 applies to every Data Fiduciary, with no turnover or headcount threshold and no small-business exemption. Only the extra duties of Significant Data Fiduciaries, such as annual audits and impact assessments, depend on a government notification. A ten-person startup processing customer data owes the same seven minimum safeguards as a bank.

How long must logs be kept under DPDPA?

Rule 6(1)(e) requires logs, and the personal data they relate to, to be retained for one year from the date of processing, unless another law requires a longer period. That is twice the 180 days the CERT-In Directions of 2022 require, so Indian companies should set retention to at least twelve months to satisfy both.

What is the penalty for failing to take reasonable security safeguards?

The Schedule to the DPDP Act sets a penalty of up to ₹250 crore for each breach of the Section 8(5) duty to take reasonable security safeguards, the highest band in the Act. The Data Protection Board decides the actual amount after considering the nature, gravity, duration and repetition of the breach and any mitigation.

Is encryption mandatory under the DPDP Rules?

Rule 6(1)(a) requires data security measures such as encryption, obfuscation, masking or virtual tokens mapped to the data. It does not name a single mandatory algorithm, so a Data Fiduciary can choose the measure that fits each data store, but it must be able to show that one of these protections applies to every store of personal data.

When do the DPDPA security safeguard rules come into force?

Rule 6, together with the other substantive duties on Data Fiduciaries, comes into force on 13 May 2027 under Rule 1(4) of the DPDP Rules 2025 and the commencement notification G.S.R. 843(E). Only the Consent Manager registration rule, Rule 4, starts on 13 November 2026. Nothing new is owed by an ordinary business on that date.

This article is for general information and is not legal advice. Confirm obligations against the official texts of the DPDP Act 2023, the DPDP Rules 2025 and the CERT-In Directions of 28 April 2022, and consult qualified counsel for your situation.

Hemlata Kalsha

I am a founder director at Qodequay Technologies Pvt. Ltd., a leading digital transformation consulting firm that helps clients across industries to innovate, optimize, and grow their businesses. I have over two decades of experience in the digital domain, spanning product development, e-commerce, user experience, design thinking, web and app development, and business leadership. My core competencies include developing and executing digital transformation strategies, building teams globally, roadmaps, and solutions that leverage data, insights, and emerging technologies such as artificial intelligence, augmented reality, blockchain, and immersive experience. I also have expertise in digital commerce, supply chain integration, and product management, having worked with both B2B and B2C brands in various sectors. My mission is to create value for customers and stakeholders by delivering impactful and engaging digital experiences that drive growth and innovation.