DPDP reference
Rule 6: Reasonable security safeguards
Last checked 6 Nov 2026
The minimum safeguards are: securing personal data through encryption, obfuscation, masking or virtual tokens (Rule 6(1)(a)); controlling access to computer resources (Rule 6(1)(b)); logs, monitoring and review to detect, investigate and fix unauthorised access (Rule 6(1)(c)); and measures for continued processing such as backups (Rule 6(1)(d)).
Logs and personal data are retained for one year for these purposes unless another law requires otherwise (Rule 6(1)(e)). Contracts with Data Processors carry security provisions (Rule 6(1)(f)), and technical and organisational measures keep the safeguards effective (Rule 6(1)(g)).
- Applies to
- Every Data Fiduciary, including for processing by its Data Processors.
- Starts
- 13 May 2027 (Rule 1(4)).
- Penalty
- Up to ₹250 crore (s.33, Schedule item 1).
- Source
- G.S.R. 846(E), Digital Personal Data Protection Rules, 2025, rule 6; G.S.R. 892(E), corrigenda
Questions
Does the DPDP Rules require encryption?
Rule 6(1)(a) requires appropriate measures such as encryption, obfuscation, masking or virtual tokens mapped to the data.
How long must logs be kept under Rule 6?
One year, unless another law requires otherwise (Rule 6(1)(e)). Rule 8(3) has a related one year minimum.
Related
- Section 8: General obligations of Data Fiduciary
- Rule 7: Intimation of personal data breach
- Rule 8: Time period for specified purpose to be deemed as no longer being served
Next
Not legal advice.