Rule 6

Reasonable security safeguards

Turns the Section 8(5) safeguards obligation into a minimum checklist: encryption, access control, logging, backups, one-year log retention and processor contract terms.

Read this before you cite anything here

These pages are a plain-English restatement, written to help you find the right provision and understand what it asks of you. They are not the text of the statute, and nothing here should be quoted as though it were. Section and rule numbers are exact, and every page names its source.

What it says

(1)(a): Appropriate data security measures such as encryption, obfuscation, masking, or the use of virtual tokens mapped to the personal data.
(1)(b): Appropriate measures to control access to computer resources.
(1)(c): Visibility on the accessing of personal data through appropriate logs, monitoring and review, enabling unauthorised access to be detected, investigated and remedied.
(1)(d): Reasonable measures for continued processing in the event of a compromise, such as data backups.
(1)(e): Retention of logs and personal data for one year, unless another law requires otherwise, so that unauthorised access can be detected, investigated and remedied.
(1)(f): Appropriate provision in the contract with a Data Processor for it to take reasonable security safeguards.
(1)(g): Appropriate technical and organisational measures to ensure effective observance.
(2): “Computer resource” has the meaning given to it in the Information Technology Act, 2000.

In practice

This is a floor, not a menu: the clauses say at minimum, so meeting five of seven is not compliance. Clause (e) is the one that surprises teams, because it makes log retention a statutory duty rather than an ops preference, and it runs for a year. Clause (f) also means every processor contract has to carry security terms, which is a paperwork exercise across an entire vendor list rather than a change to one system.

s.8General obligations of Data FiduciaryThe operational core of the Act: accountability for processors, accuracy, security safeguards, breach intimation, erasure, published contact details and grievance redressal.Rule 7Intimation of personal data breachSets two clocks after a breach: immediate notice to affected principals and to the Board, then a detailed report to the Board within seventy-two hours.Rule 8Retention, erasure, and the pre-erasure warningFixes when the specified purpose is deemed no longer served for listed classes, requires a warning at least 48 hours before erasure, and sets a one-year minimum log retention.Sch.PenaltiesThe seven penalty items the Board may impose under s.33(1), from Rs 250 crore for security failures down to Rs 10,000 for a Data Principal’s breach of duties.

The DPDP brief

One email a month. What moved in the Act, and what our scans found.

Rule 6 is not in force yet. If that date moves, or the Board says anything about how it will be read, you will get one email about it and nothing else.

I have read the notice below and I consent to Gevox using my email address to send me the DPDP brief.

Notice, given under Section 5 and Rule 3

What we collect: your email address, the date you subscribed, the page you subscribed from, and your IP address. Why: to send you the Gevox DPDP brief, roughly monthly. Nothing else. We do not sell or share this list. Withdrawing: every issue carries a one-click unsubscribe that needs no login and asks no questions. Your rights: you can ask for a copy of this data, have it corrected, or have it erased, and you can complain to our Grievance Officer at grievance@gevox.in or to the Data Protection Board of India.

Notice version 2026-09-07.1. We store this text as it appears here, against your consent, so both are provable later.Privacy policy

What it says

In practice

Read next