For CISOs
For CISOs implementing DPDP
Under DPDP, security safeguards are a legal duty of the Data Fiduciary, and breach intimation runs on a clock. The CISO owns most of the controls behind both.
Short answer
Rule 6 sets minimum security safeguards: encryption, obfuscation, masking or virtual tokens; access control; logs, monitoring and review; backups and continuity; one-year retention of logs; and security terms in processor contracts. Rule 7 requires intimating affected Data Principals and the Board without delay, and a detailed report to the Board within 72 hours. CERT-In's 6-hour reporting of specified cyber incidents is a separate duty that continues alongside.
Rule 6 safeguards you own
Rule 6 sets a floor. The duty in s.8(5) is to take reasonable security safeguards to prevent a personal data breach, and Rule 6 lists what those include at the least.
| Safeguard | What to be able to show |
|---|---|
| Encryption, obfuscation, masking or virtual tokens | Which stores hold personal data, and how each is protected. |
| Access control | Who can reach each store, including outside domains and open links. |
| Visibility of access | Logs, monitoring and review that can detect unauthorised access. |
| Backups and continuity | Restorable copies if data is lost or encrypted. |
| Retention of logs | Logs and personal data kept one year to investigate access, unless another law requires otherwise. |
| Processor contracts | Security terms in every contract with a Data Processor. |
| Enforcement | Technical and organisational measures that make the above stick. |
Rule 7 timelines and your part
The clock starts when you become aware of a personal data breach. Intimate each affected Data Principal and the Board without delay, then file a detailed report with the Board within 72 hours: facts, cause, mitigation, findings on who caused it, remedial steps, and the intimations sent.
Security supplies the facts; legal and the DPO own the wording. Keep a running timeline from the first alert, because the detailed report needs it. Agree that split now, and use the 72-hour playbook to rehearse it.
CERT-In's directions of 28 April 2022 under s.70B of the IT Act require reporting specified cyber incidents to CERT-In within 6 hours. That is separate from Rule 7, and one incident may trigger both.
What to do this quarter
- 01Find shadow SaaS
List every tool your organisation uses, connect the ones holding personal data, and scan them.
- 02Scan devices
Enrol employee laptops to find exports and ID copies stored locally.
- 03Fix access
Close open links, remove outside domains that do not need access, and review privileged accounts.
- 04Check log retention and vendor terms
Confirm logs are kept for a year, and that processor contracts carry security and breach reporting terms.
- 05Rehearse Rule 7
Run a tabletop with legal and the DPO, timing each step against the 72-hour detailed report.
What to ask other teams
- Legal: who signs off the Rule 7 intimation and report, and the processor contract template.
- DPO: the intimation template for affected people, and the contact it gives them.
- Procurement: a vendor list with what each vendor processes, before renewals.
- Product and engineering: which new systems will hold personal data.
- HR: device enrolment for joiners and data return for leavers.
How TruePrivacy helps
- System discovery lists the systems your organisation uses, marked detected, reviewed or connected, so shadow SaaS becomes visible.
- Data security posture shows issues per policy per store and the identities that can reach each one, with a remediation flow from request and approval to verified change.
- The DSPM endpoint agent scans local files on macOS, Windows and Linux, and reports findings with masked samples, not the raw files.
- Breach management runs the Rule 7 clocks; it does not run a CERT-In track. Vendors and processors sends security assessments.
Does Rule 6 specify encryption standards?
Rule 6 lists encryption, obfuscation, masking or virtual tokens as safeguards; it does not name a specific algorithm.
Is the 72-hour report the same as CERT-In's 6 hours?
No. CERT-In reporting is under s.70B of the IT Act. The Rule 7 detailed report goes to the Data Protection Board within 72 hours, after intimation without delay.
How long must logs be kept?
At least one year under Rule 6, unless another law requires otherwise. Rule 8(3) also requires keeping personal data, traffic data and processing logs for at least one year for the Seventh Schedule purposes.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin