Rule 6, reasonable security safeguards

This is the rule that turns Act s.8(5) from an abstraction into an audit checklist. A Data Fiduciary must protect personal data in its possession or control, including processing done on its behalf by a Data Processor, by taking reasonable security safeguards which shall include, at the minimum:

(a) appropriate data security measures, such as securing personal data through encryption, obfuscation, masking, or the use of virtual tokens mapped to that personal data;

(b) appropriate measures to control access to the computer resources used by the Data Fiduciary or Data Processor, wherever applicable;

(c) visibility on access, through appropriate logs, monitoring and review, enabling detection of unauthorised access, its investigation, and remediation to prevent recurrence;

(d) reasonable measures for continued processing where confidentiality, integrity or availability is compromised by destruction or loss of access, such as data backups;

(e) retain such logs and personal data for a period of one year, to enable detection, investigation, remediation and continued processing, unless another law in force requires otherwise;

(f) appropriate provision in the contract between the Data Fiduciary and the Data Processor, wherever applicable, for taking reasonable security safeguards;

(g) appropriate technical and organisational measures to ensure effective observance of security safeguards.

Rule 6(2): "computer resource" takes its Information Technology Act, 2000 meaning.

This is a floor, not a ceiling. "At the minimum" means an incident where you did all seven can still be a s.8(5) breach. But missing any one of the seven is close to a self-proving breach, with a Rs 250 crore ceiling behind it.

Note the tension in (e): a mandatory one-year log retention sits against the s.8(7) erasure duty. Reconcile them by scoping (e) to access logs and the associated personal data needed for security forensics, and document that reasoning.