Section 8(5) · Rule 6
Data security posture for DPDP safeguards
Knowing where personal data sits is half the job. Posture shows who can reach it and tracks each fix back to the source.
Sample workspace
Issues
- Open link · KYC folder (Google Drive)Open
- Outside domain · s3://loan-docsIn review
- Group all-staff · crm-dbFixed
Remediation · open link
- Request raised
- Approved
- Change at source, then verify
Short answer
Section 8(5) of the DPDP Act requires reasonable security safeguards to prevent a personal data breach, and Rule 6 lists minimums including access control and visibility of access through logs, monitoring and review. TruePrivacy's data security posture view covers devices, cloud stores and databases, with issues, the identities that can reach each store, scan policies and a remediation flow. Remediation moves from request and approval to the change at the source and its verification.
What data security posture shows
Rule 6 sets minimum safeguards: encryption, obfuscation, masking or virtual tokens; access control; visibility of access; backups and continuity; a year of logs; and security terms in processor contracts. Posture helps most with the access and visibility parts of that list.
Devices, cloud stores and databases in one place, each with its issues and identities.
One issue per policy per data store.
People, groups, outside domains and open links that a bucket policy, access list or file sharing lets in, shown next to the data they reach.
The policies that scans check each data store against. Each policy raises one issue per data store.
From request and approval to the change at the source, then verification, so each fix has a record.
How an issue gets fixed
- 01Connect and scan
Bring in cloud stores and databases through integrations, and devices through the DSPM endpoint agent.
- 02Review issues
Each issue ties one policy to one data store, so you can see which stores fail which policy.
- 03Check identities
See which people, groups, outside domains and open links can reach a store, and through which bucket policy, access list or sharing setting.
- 04Request and approve a fix
Raise a remediation request and get it approved before anything changes at the source.
- 05Change and verify
Make the change at the source, then verify it. Each step is logged on the audit trail.
Mapped to the Act and Rules
| Duty | Section or rule | What TruePrivacy does |
|---|---|---|
| Reasonable security safeguards to prevent a breach | s.8(5) | Issues per policy per data store across devices, cloud stores and databases |
| Access control | Rule 6 | Identities that can reach each store, with a remediation flow to change access |
| Visibility of access through logs, monitoring and review | Rule 6 | Identity views, and an audit trail of each remediation step |
| Technical and organisational measures | s.8(4), Rule 6 | Scan policies and an approval step before changes |
| Masking | Rule 6 | Masked samples in findings |
Posture is a view, not proof of safety
Posture shows what your scans and policies can see. Rule 6 sets minimum measures, and what is reasonable for you depends on your systems, so involve your security team. A clean view is not a certification.
If a breach does happen, the breach notification clocks under Rule 7 take over. For a security lead's view of DPDP, see DPDP for CISOs.
Works with
Data classes and high-risk stores that tell you where to look first.
DSPM endpoint agentMasked findings from laptops and desktops.
Breach notificationRule 7 clocks and a post-incident review.
Vendors and processorsAssessments and contract (DPA) tracking for processors that reach your data.
What is DSPM?
Data security posture management: a view of where personal data sits, who can reach it and what to fix. In TruePrivacy it covers devices, cloud stores and databases.
What does Rule 6 require?
At least: encryption, obfuscation, masking or virtual tokens; access control; visibility of access through logs, monitoring and review; backups and continuity; keeping logs and personal data for one year; security terms in processor contracts; and measures to enforce these.
How are fixes tracked?
Each fix runs through a remediation flow: request, approval, the change at the source and verification. Every action is logged on the audit trail.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin