DPDP Act Compliance Checklist: The Security Safeguards IT Teams Own
The Digital Personal Data Protection Rules, 2025 were notified in November 2025. Most of the Rules, including the security safeguards and breach reporting, come into force eighteen months later. If you have been told to get the company DPDP-ready, this is the technical part: what Rule 6 and Rule 7 actually say, and what an IT team can start doing now.
What applies, and when
The Rules were published in the Gazette of India as G.S.R. 846(E) in November 2025. Rule 1 phases them in. The PIB explainer describes this as an eighteen-month period for phased compliance.
| Rule 1 clause | Rules covered | In force |
|---|---|---|
| 1(2) | Rules 1, 2 and 17 to 21 (including the Data Protection Board) | On publication |
| 1(3) | Rule 4 (Consent Managers) | One year after publication |
| 1(4) | Rules 3, 5 to 16, 22 and 23 (including notice, security safeguards, breach intimation and retention) | Eighteen months after publication |
Eighteen months from November 2025 is May 2027. That is the date the security and breach rules start to bite, and it is not long for an IT team that has to find data, change access, and set up logging first.
The stakes are high. The PIB explainer says the Act’s highest penalty, up to ₹250 crore, applies to a Data Fiduciary’s failure to maintain reasonable security safeguards. Failing to notify the Board or affected individuals of a breach can attract up to ₹200 crore.
Rule 6: reasonable security safeguards
Rule 6(1) says a Data Fiduciary must protect personal data in its possession or under its control, including data a Data Processor handles for it, by taking reasonable security safeguards to prevent a personal data breach. It lists a minimum. Here is each clause and what it means for IT.
| Clause | What the Rule asks for | What IT can do |
|---|---|---|
| 6(1)(a) | Data security measures, such as encryption, obfuscation, masking or virtual tokens mapped to the personal data | Encrypt disks and databases that hold personal data. Mask or tokenise it in test copies and reports. |
| 6(1)(b) | Measures to control access to the computer resources used by the Data Fiduciary or its Data Processor | Named accounts, least privilege, MFA on admin and remote access, prompt removal of leavers. |
| 6(1)(c) | Visibility on access to personal data through logs, monitoring and review, to detect, investigate and remediate unauthorised access | Turn on access and audit logging on systems that hold personal data, send it somewhere central, and review it. |
| 6(1)(d) | Measures for continued processing if the data is compromised, such as data backups | Back up the systems that hold personal data and test restores. |
| 6(1)(e) | Retain those logs and personal data for one year, unless another law requires otherwise | Set log storage to keep at least a year, and check that nothing rotates it away sooner. |
| 6(1)(f) | A provision in the contract with each Data Processor for taking reasonable security safeguards | List your processors (cloud, payroll, CRM, IT support) and pass the list to whoever owns contracts. |
| 6(1)(g) | Appropriate technical and organisational measures to make sure the safeguards are actually observed | Written policies, named owners and periodic checks that the controls above are still in place. |
Rule 6(2) takes the meaning of computer resource from the Information Technology Act, 2000. In practice that means the laptops, servers and cloud services where personal data is stored or processed.
Rule 7: breach intimation
Rule 7 sets two separate duties once you become aware of a personal data breach.
- To each affected person, without delay. Rule 7(1) asks for a plain description of the breach, its likely consequences for them, what you are doing to reduce the risk, what they can do to protect themselves, and a business contact who can answer questions.
- To the Data Protection Board, in two steps. Rule 7(2)(a) asks for a description of the breach without delay: its nature, extent, timing, location and likely impact. Rule 7(2)(b) asks for a detailed report within 72 hours of becoming aware of it, or a longer period if the Board allows one on a written request.
The 72-hour report must cover:
- Updated and detailed information on the description you sent first
- The broad facts about the events, circumstances and reasons that led to the breach
- Measures taken or proposed to reduce the risk
- Any findings about the person who caused the breach
- Remedial measures taken to prevent it happening again
- A report on the intimations sent to affected people
Most of that list depends on logs. If you cannot say which accounts touched which systems and when, you cannot write the 72-hour report. That is why Rule 6(1)(c) and 6(1)(e) matter before a breach, not after.
Rule 8(3): one-year minimum retention
Separately from Rule 6, Rule 8(3) says a Data Fiduciary must keep personal data, the associated traffic data and other logs of processing for a minimum of one year from the date of processing, for the purposes in the Seventh Schedule, and then erase them unless another law requires longer. The Rule’s own example covers a cloud provider acting as a Data Processor: the Data Fiduciary must make sure the provider also keeps the data and logs for at least a year.
The checklist
Work through these in order. Each one feeds the next.
- Find where personal data lives. Build an inventory of every endpoint, server and cloud service, and the software on each. Mark which ones store or process personal data: HR, payroll, CRM, email, file shares, and the spreadsheets people export to their laptops.
- Encrypt or mask it. Full-disk encryption on laptops and servers that hold personal data. Encryption at rest on databases and cloud storage. Masked or tokenised data in test environments. (Rule 6(1)(a))
- Tighten access. Review who has access to each system on your list. Remove shared and stale accounts, enforce MFA for admins and remote access, and document how access is granted and removed. (Rule 6(1)(b))
- Log access and keep the logs. Turn on audit logging for the systems that hold personal data, collect it centrally, and keep it for at least a year. Decide who reviews it and how often. (Rule 6(1)(c) and (e), Rule 8(3))
- Back up and test restores. A backup you have never restored is a guess. (Rule 6(1)(d))
- List your Data Processors. Every vendor that handles personal data for you. Hand the list to legal so the contracts can carry security safeguard clauses. (Rule 6(1)(f))
- Write the breach runbook. Who decides a breach has happened, who tells the Board without delay, who writes the 72-hour report, and who contacts affected people. Rehearse it once. (Rule 7)
- Keep evidence. Policies, access reviews, restore tests and log settings, with dates. Rule 6(1)(g) asks for measures that make sure the safeguards are observed, and evidence is how you show it.
Where Sentrivox fits
Sentrivox will not make you DPDP-compliant on its own, and no tool can. It can help with the first step. The asset inventory helps you find the devices and software that may hold personal data, so your safeguards cover the whole estate and not just the machines you remember.
Access to the Sentrivox portal is role-based. Sentrivox encrypts agent uploads with AES-256-GCM. That protects Sentrivox’s own data path from the agent to the platform. It does not encrypt your databases, file shares or other places where personal data is stored; those still need the controls in Rule 6(1)(a).
Frequently asked questions
When do the DPDP security safeguards apply?
Rule 1(4) of the DPDP Rules, 2025 brings Rules 3, 5 to 16, 22 and 23 into force eighteen months after the Rules were published in November 2025. That group includes Rule 6 on security safeguards and Rule 7 on breach intimation.
What is the highest penalty under the DPDP Act?
According to the PIB explainer on the Rules, up to ₹250 crore for a Data Fiduciary that fails to maintain reasonable security safeguards. Failing to notify the Board or affected individuals of a breach can attract up to ₹200 crore.
Is there a 72-hour breach reporting deadline?
Yes. Under Rule 7(2), the Data Fiduciary must tell the Data Protection Board about a breach without delay, then send a detailed report within 72 hours of becoming aware of it, or a longer period if the Board allows one on a written request.
How long must logs be kept under the DPDP Rules?
Rule 6(1)(e) asks for logs and personal data to be kept for one year, unless another law requires otherwise, so that unauthorised access can be detected and investigated. Rule 8(3) separately sets a minimum of one year for personal data, traffic data and processing logs.