s.8 · Rule 6 · Sch.
Reasonable security safeguards
Section 8(5) requires every Data Fiduciary to protect personal data with reasonable security safeguards to prevent a breach, and Rule 6 turns that into a minimum checklist.
Rule 6 names the minimum: encryption, obfuscation or masking; access control; logs and monitoring to detect and investigate unauthorised access, retained for one year; backups for continuity; and contractual measures to hold Data Processors to the same standard. The obligation extends to processing done by a Processor on the Fiduciary’s behalf.
This is the provision with the largest penalty in the Schedule: up to Rs 250 crore. It is also the one where a public website shows the most. Security headers such as HSTS, a Content Security Policy, X-Frame-Options and X-Content-Type-Options are the visible edge of the safeguards; the Gevox Readiness Index found 16 of 20 advisor websites missing HSTS or a Content Security Policy.
Questions people ask
- What does "reasonable" mean?
- Rule 6 sets a floor: encryption or masking, access control, logging for a year, backups and processor contracts. Reasonable means at least that, and more where the data and the risk warrant it.
- Is HTTPS enough?
- HTTPS is necessary, not sufficient. HSTS, a Content Security Policy and the other headers, plus access control and logging behind the site, are what Rule 6 contemplates.
- Are we responsible for our hosting provider’s security?
- Yes. Section 8(5) covers processing by a Data Processor on your behalf, and Rule 6(1)(f) requires the contract to bind the Processor to the safeguards.
Related terms
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.