Rule 6 of the DPDP Rules, 2025 says a Data Fiduciary must take reasonable security safeguards to prevent personal data breach, and lists seven items as the minimum. For engineers that means encryption or masking, access control, logging and monitoring, backups, one year log retention, processor contracts and organisational measures.
The seven items in plain terms
Rule 6(1) covers data in the Fiduciary's possession or control, including processing by a Data Processor on its behalf. The minimum list:
- Data security measures such as encryption, obfuscation, masking or virtual tokens mapped to the data.
- Measures to control access to the computer resources the Fiduciary or Processor uses.
- Visibility on access to personal data through logs, monitoring and review, to detect unauthorised access, investigate it and prevent recurrence.
- Reasonable measures for continued processing if confidentiality, integrity or availability is compromised, for example data backups.
- Retention of those logs and personal data for one year, unless another law needs longer.
- Contract terms with each Processor on reasonable security safeguards.
- Appropriate technical and organisational measures to make sure the safeguards are observed.
Questions that produce evidence
For each item, ask a question a reviewer could check:
- Encryption: which datastores hold personal data, and is each encrypted at rest and in transit? Where is masking used in non production copies?
- Access: who can reach production data, how is that reviewed, and how is access removed when someone leaves?
- Logging: can you show who accessed a given record last month? Is the log review a scheduled task with an owner?
- Backups: when did you last restore one, and how long did it take?
- Retention: do the logs and the data they relate to survive one year?
- Processors: does each contract include security safeguards, and do you have a list of processors?
- Organisational: is there a named owner and a written policy?
The supply chain angle
Rule 6 covers processing done by a Processor. Your software dependencies and hosted services are part of that picture. A vulnerable library in a service that handles personal data is a safeguard question even though the rule does not use the word library. Dependency inventories and vulnerability tracking give you something concrete to show.
Try it yourself
In the demo, step through how a dependency inventory is built and note how many components you would not otherwise have listed.
Click through it at your own pace, or open it full screen.
Safeguard's compliance and evidence automation, SBOM and dependency scanning and policy gates can produce records for several of these questions. Meeting rule 6 still depends on your own controls and legal review.
Quick check
Does rule 6 name specific encryption algorithms?
No. It says appropriate measures such as encryption, obfuscation, masking or virtual tokens. Choose current standards and document why.
Why do logs appear in a security rule?
Rule 6(1)(c) and (e) tie logs to detecting and investigating unauthorised access, with one year retention.
Sources
- Digital Personal Data Protection Rules, 2025 (MeitY)
- Digital Personal Data Protection Act, 2023 (MeitY)
Last reviewed: 19 October 2026.
