# DPDP Rules 2025, Rule 6: reasonable security safeguards

> Canonical page: https://mksd0398.github.io/dpdp-act-skill/rules/rule-6-reasonable-security-safeguards/
> Not legal advice. Educational compliance reference only; no lawyer-client relationship arises from its use and the author is not a lawyer. Verify statutory text against the Gazette of India and consult qualified Indian legal counsel before acting.

Digital Personal Data Protection Rules, 2025. Secondary-sourced from the PIB release and cross-checked sources; verify against the notified Gazette text before external use.

## Rule 6, reasonable security safeguards

This is the rule that turns Act s.8(5) from an abstraction into an audit checklist. A Data
Fiduciary must protect personal data in its possession or control, including processing done on
its behalf by a Data Processor, by taking reasonable security safeguards **which shall include, at
the minimum**:

(a) **appropriate data security measures**, such as securing personal data through **encryption,
obfuscation, masking, or the use of virtual tokens** mapped to that personal data;

(b) **appropriate measures to control access** to the computer resources used by the Data
Fiduciary or Data Processor, wherever applicable;

(c) **visibility on access**, through appropriate **logs, monitoring and review**, enabling
detection of unauthorised access, its investigation, and remediation to prevent recurrence;

(d) **reasonable measures for continued processing** where confidentiality, integrity or
availability is compromised by destruction or loss of access, **such as data backups**;

(e) **retain such logs and personal data for a period of one year**, to enable detection,
investigation, remediation and continued processing, unless another law in force requires
otherwise;

(f) **appropriate provision in the contract** between the Data Fiduciary and the Data Processor,
wherever applicable, for taking reasonable security safeguards;

(g) **appropriate technical and organisational measures** to ensure effective observance of
security safeguards.

Rule 6(2): "computer resource" takes its Information Technology Act, 2000 meaning.

**This is a floor, not a ceiling.** "At the minimum" means an incident where you did all seven can
still be a s.8(5) breach. But missing any one of the seven is close to a self-proving breach, with
a Rs 250 crore ceiling behind it.

**Note the tension in (e):** a mandatory **one-year log retention** sits against the s.8(7) erasure
duty. Reconcile them by scoping (e) to access logs and the associated personal data needed for
security forensics, and document that reasoning.