DPDP in practice
Rule 6 sets a floor. Your ISO 27001 or SOC 2 work covers much of it, not all.
The Act expects reasonable security safeguards that keep a breach from happening, and it ties its largest penalty ceiling to neglecting them. The Rules list seven minimum measures. If you run an ISMS or hold a SOC 2 report, most of the controls exist. The gaps are in the details the Act cares about.
Back to DPDP services01 · The duty
A short sentence with a large penalty
Section 8(5), with the Schedule's ceiling of ₹250 crore.
Section 8(5) makes the fiduciary protect personal data in its possession or control, including what its processors do on its behalf, by taking reasonable safeguards against a breach. The Act does not define reasonable. The Schedule sets the ceiling for failing this duty at two hundred and fifty crore rupees, the highest in the Act.
- Ceiling for failing safeguards
- ₹250 cr
- Schedule, item 1
- Minimum measures
- 7
- Rule 6(1)(a) to (g)
- Log retention
- 1 year
- Rule 6(1)(e)
02 · Rule 6
The seven minimum measures
A floor, not a full list. Reasonable may ask for more.
- (a) Data security
- Protect the data itself, with encryption, obfuscation, masking or tokens mapped to it.
- (b) Access control
- Control access to the computer resources you and your processors use.
- (c) Visibility
- Logs, monitoring and review good enough to detect, investigate and stop unauthorised access recurring.
- (d) Continuity
- Keep processing after a loss of confidentiality, integrity or availability, for example with backups.
- (e) Retention for investigation
- Keep logs and personal data for one year for detection and recovery, unless law requires otherwise.
- (f) Processor contracts
- Put the duty to take safeguards into contracts with processors.
- (g) Organisational measures
- Technical and organisational measures that make the rest actually happen.
03 · Mapping
From each measure to a control and its evidence
Where ISO 27001 and SOC 2 already produce the proof.
| Safeguard | Example control | Evidence | Overlap: ISO 27001 / SOC 2 |
|---|---|---|---|
| Data security | Encryption at rest and in transit; masking in non-production | Configuration exports; key management records | Annex A 8.24, 8.11 / CC6.1, CC6.7 |
| Access control | Role-based access, MFA, prompt removal at exit | Access reviews; joiner and leaver tickets | Annex A 5.15 to 5.18, 8.2, 8.5 / CC6.1 to CC6.3 |
| Visibility | Central logging of access to personal data, with alerts and review | Log samples; alert tickets; review sign-offs | Annex A 8.15, 8.16 / CC7.2, CC7.3 |
| Continuity | Backups, tested restores, recovery plans | Restore test records; plan approval | Annex A 8.13, 5.30 / A1.2, A1.3 |
| One-year retention | Log platform retention set to at least a year | Retention settings; storage records | Annex A 8.15 (period is yours to set) / CC7.2 (period not fixed) |
| Processor contracts | Security, breach notice and erasure clauses | Signed clauses; processor register | Annex A 5.19, 5.20 / CC9.2 |
| Organisational measures | Policies, training, ownership, internal review | Training records; management review minutes | Clauses 5 to 10, Annex A 6.3 / CC1, CC2, CC4 |
The overlap column shows where a programme looks, not that it satisfies rule 6. ISO 27001 lets you set log periods by risk; rule 6 fixes a one-year minimum.
04 · Not the same
Why a certificate or report is not compliance
ISO 27001 and SOC 2 test your chosen scope against their criteria. The Act tests every personal data flow against the law.
What the programmes give you
- A tested set of security controls
- A risk process and an audit rhythm
- Supplier oversight
- Independent evidence for customers
What the Act still needs
- Every system holding personal data, even outside the certified scope
- The one-year log floor
- Processor contracts that name DPDP duties
- Breach notices to the Board and to each affected person
- Notice, consent, rights and erasure, which security standards do not cover
The SOC 2 guide on privacy laws covers the broader overlap; this page stays with the security duty.
05 · Evidence file
Building a DPDP safeguards file from what you have
Reuse first, fill gaps second.
- List every system on the data map that holds personal data, and mark which sit inside your ISO 27001 or SOC 2 scope.
- For systems inside scope, link the existing control evidence to the matching rule 6 measure.
- For systems outside scope, test the seven measures directly and record the result.
- Check log retention on every platform reaches one year.
- Read each processor contract for safeguards, breach notice and erasure, and track gaps.
- Keep the file current: refresh after audits, incidents and new systems.
06 · What a reviewer asks
Questions a reviewer will put to you
Have the answer and the evidence together.
- Where is personal data outside your certified scope?. The map, with each such system and its controls.
- Can you show who looked at a given record last month?. A log query that answers it.
- How long are logs kept, everywhere?. Retention settings per platform.
- When did you last restore personal data from backup?. The restore test record.
- Which processors lack a security clause?. The gap list with dates.
Sources: the Digital Personal Data Protection Act, 2023 (section 8(5) and the Schedule); the Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), rule 6; ISO/IEC 27001:2022 clause and Annex A control titles; the AICPA 2017 Trust Services Criteria (common criteria and availability criteria references).
Questions about safeguards
Does ISO 27001 certification satisfy section 8(5)?
No. It helps, but it is not the test.
Certification shows an accredited body found your ISMS conforms to the standard within your scope. The Board asks whether safeguards for personal data were reasonable, across all of it, including at processors.
Is encryption mandatory?
Rule 6 lists it as one way to secure data, beside masking and tokens.
The rule names encryption, obfuscation, masking and virtual tokens as examples of appropriate data security. Pick what fits each data set and record why.
Who is responsible for a processor's security?
You are, under the Act.
Section 8(1) and 8(5) keep the duty with the fiduciary for processing done on its behalf. The contract is how you pass the work down; it does not pass the duty.
Does a SOC 2 report with the Privacy category cover the Act?
It covers more ground, but it is still measured against AICPA criteria, not the Act.
The Privacy category tests notice, choice, access and disposal against the Trust Services Criteria. Those overlap with the Act in places, but a SOC 2 report is not an opinion on DPDP compliance.
Turn your security evidence into DPDP evidence.
A DPDP readiness assessment maps rule 6 to the controls you already run and lists the gaps. Counsel should confirm how the Act and the Rules apply to your contracts and sector.