Reasonable security safeguards under the DPDP Act and Rules

What the Act asks

The duty covers all personal data in your possession or under your control, including processing carried out by a Data Processor on your behalf. The Act does not prescribe a particular standard or certification. What counts as reasonable depends on the data, the risk and the measures the Rules set out.

The minimum measures in the Rules

The DPDP Rules list measures that reasonable security safeguards should include, at a minimum.

• Securing personal data through encryption, obfuscation, masking or the use of virtual tokens
• Controlling access to the computer resources used for processing
• Visibility of access through logs, monitoring and review, so unauthorised access can be detected and investigated
• Measures for continued processing if confidentiality, integrity or availability is compromised, such as backups
• Keeping logs and personal data for one year to support detection, investigation and remediation, unless a law requires otherwise
• Appropriate provisions in contracts with processors for taking reasonable security safeguards
• Technical and organisational measures to make sure the safeguards are actually observed

What this means for a typical organisation

For a hospital chain, it may mean encrypting the patient database, masking Aadhaar and phone numbers in the reports front desk staff see, removing access for staff who move to other branches, and keeping access logs for the lab system for a year. For a D2C brand, it may mean tokenising payment details, limiting who can export the customer list from the CRM and reviewing that export log each month.

Processors are part of your perimeter

Many breaches start at a vendor: a call centre, a courier partner, a marketing agency with CRM access. The Rules expect your contracts with processors to cover security safeguards. You remain responsible under section 8(1) for what they do with your data.

Timing and penalties

The security safeguards duty applies in Phase 3, around 13 May 2027 as notified, unless amended. Failing to take reasonable security safeguards to prevent a personal data breach can attract a penalty of up to 250 crore rupees. Failing to notify a breach is a separate head with a maximum of up to 200 crore rupees.

How TrustOS helps

TrustOS maps each Rules measure to the systems and processors in your inventory, assigns an owner to each control, and stores the evidence as you go: encryption settings, access reviews, log retention, backup tests and processor contract clauses. When the Board or an auditor asks what was in place on a given date, the record is ready.

TrustOS does not run your security tools and does not decide whether a safeguard is reasonable. That judgement belongs to your security lead and counsel, and TrustOS does not replace legal advice.