Reasonable Security Safeguards Under DPDP: The Seven Things Rule 6 Actually Requires
Rule 6 of the DPDP Rules 2025 is a closed list of seven minimum security safeguards, including one year of log retention. Here is each one and what it means.
Rule 6 is a closed list, not a principle
Most privacy law hands you a standard and leaves you to argue about it. Rule 6 of the DPDP Rules 2025 does something more useful and more demanding: it names seven specific measures and says your safeguards must include them at the minimum.
“A Data Fiduciary shall protect personal data in its possession or under its control, including in respect of any processing undertaken by it or on its behalf by a Data Processor, by taking reasonable security safeguards to prevent personal data breach, which shall include, at the minimum...”
Two phrases carry the weight. At the minimum means these seven are the floor and not the ceiling. On its behalf by a Data Processor means your vendors are inside your obligation, not outside it.
The seven minimums
| Rule 6(1) | What it requires | What it looks like in practice |
|---|---|---|
| (a) | Appropriate data security measures, such as encryption, obfuscation, masking, or virtual tokens mapped to the personal data | Encryption at rest and in transit. Masking sensitive fields in dashboards and exports. |
| (b) | Appropriate measures to control access to the computer resources used | Role-based access, least privilege, multi-factor authentication on privileged accounts. |
| (c) | Visibility on the accessing of personal data through logs, monitoring and review, to detect unauthorised access, investigate it and prevent recurrence | Access logging that a human actually reviews. A log nobody reads does not give you visibility. |
| (d) | Reasonable measures for continued processing if confidentiality, integrity or availability is compromised, such as data backups | Tested backups. An untested backup is a belief, not a measure. |
| (e) | Retain such logs and personal data for one year, unless another law requires otherwise | One year minimum retention of your access logs. This one surprises people. |
| (f) | Appropriate provision in the contract with a Data Processor for taking reasonable security safeguards | Security obligations written into every processor contract, not assumed. |
| (g) | Appropriate technical and organisational measures to ensure effective observance of safeguards | Policies, training and review. The organisational half is not optional. |
Clause (e) is the one that catches people
Read it carefully. Rule 6(1)(e) requires you to retain logs and personal data for a period of one year, for the purpose of detecting unauthorised access, investigating it, remediating it, and continuing to process in the event of a compromise.
This sits alongside, and can pull against, your erasure duties. Where a sectoral regulator sets a longer period, that governs instead, which is why retention has to be worked out per sector rather than in the abstract. We have done that for fintech and healthtech.
A log that can be silently edited also fails the purpose of the clause. If the point is detecting unauthorised access and investigating it, a log an attacker can rewrite proves nothing. Tamper-evident logging, for example hash chaining each entry to the one before it, is how you make the record worth keeping.
Clause (f) puts your vendors inside your perimeter
Rule 6(1) covers processing undertaken on your behalf by a Data Processor, and clause (f) requires the contract with that processor to provide for reasonable security safeguards. You cannot outsource the obligation along with the work.
In practice this means every analytics tool, payment gateway, email provider, cloud host and agency touching personal data needs security terms in writing. If you have not mapped who those are, start with the vendor management and Data Processing Agreement guide.
So what does reasonable actually mean?
The seven are mandatory for everyone. Reasonable governs how far past them you go, and it scales with what you hold. A payroll bureau holding bank details and PAN numbers for forty thousand people is held to a different standard than a two-person studio with a mailing list, even though both must do all seven.
Which is why proportionality arguments depend on knowing your own scale. If you cannot say how many people you hold data about, you cannot claim your safeguards are proportionate to it. That is the subject of how many Data Principals you actually have.
How to evidence it
Doing the seven is half the obligation. Being able to show you did them is the other half, and it is the half that matters on the day somebody asks.
- 1.Write down, per clause, what you do and where it is configured
- 2.Keep the access logs for a year and make sure somebody reviews them on a schedule you can name
- 3.Keep your processor contracts and their security clauses somewhere you can produce within the hour
- 4.Test a restore from backup and record the date you did it
- 5.Re-check the list whenever you add a system, because a new tool usually arrives without any of this
If you are working through DPDP end to end, the DPDP compliance checklist puts Rule 6 in sequence with the rest of your obligations.
Frequently asked questions
What are reasonable security safeguards under the DPDP Act?
Rule 6(1) of the DPDP Rules 2025 sets seven minimum measures: data security such as encryption or masking, access control, logging and monitoring, backups for continued processing, one year of log and data retention, security provisions in processor contracts, and appropriate technical and organisational measures. They are a floor, not a complete programme.
How long must I keep logs under DPDP?
Rule 6(1)(e) requires logs and personal data to be retained for one year, unless another law in force requires otherwise. It is a minimum retention obligation, so purging logs after thirty days puts you offside.
Is encryption mandatory under the DPDP Act?
Rule 6(1)(a) requires appropriate data security measures and names encryption, obfuscation, masking and virtual tokens as examples. Encryption is not the only permitted route, but if you use none of these you will struggle to argue the clause is satisfied.
Am I responsible for the security of my vendors?
Rule 6(1) extends to processing carried out on your behalf by a Data Processor, and clause (f) requires your contract with them to provide for reasonable security safeguards. Engaging a vendor does not move the obligation off you.
Do small businesses have to do all seven?
Yes. The seven are the minimum for every Data Fiduciary. What scales with your size and sensitivity is how far beyond the minimum is reasonable for you.