DPDP Rules 2025: Security Safeguards Checklist

The DPDP Act, 2023 sets out duties for organizations that decide why and how personal data is processed. The 2025 rules put the detail in place, and the government chose a phased start. The rules that set up the Data Protection Board came into force first. Most of the working rules, including those on notices, consent managers, security safeguards, breach intimation and retention, apply from about May 2027. Check the rules' own commencement clause for the exact dates that apply to you.

The Act requires reasonable security safeguards to prevent a personal data breach, and the rules describe what that includes. In engineering terms, expect to show:

• Protection of data. Encryption, masking or similar measures for personal data, with control over the keys.
• Access control. Only the people and systems that need the data can reach it, with strong authentication for administrators.
• Visibility. Logs and monitoring that let you detect unauthorized access and investigate it, kept for the period the rules set.
• Continuity. Backups, so data can be restored if it is lost or encrypted by an attacker.
• Processors. A contract with every vendor that handles personal data for you, requiring the same safeguards.
• Review. Technical and organizational measures that are tested and kept up to date.

Read the current text of the rule for the exact list and the retention period for logs.

If personal data is breached, the rules require you to tell each affected person and to report to the Data Protection Board. The Board is to be informed without delay, with a fuller report within 72 hours. You cannot meet a window like this without knowing, in advance, who investigates, who decides and who writes the notice. The work belongs in your incident plan now, together with the CERT-In reporting duty described in our CERT-In article.

The rules do not name a penetration test, but a test is the most direct way to check that safeguards work. It answers questions that policies cannot:

• Can someone reach personal data by changing an ID in a request?
• Is personal data exposed in APIs, error messages or logs?
• Can an attacker with one stolen account reach the database?
• Would we notice if they did?

A dated report, with fixes and a retest, is evidence that you took reasonable steps. The penalties under the Act can be large, and the first thing a regulator asks about is what you did to prevent the breach.

1. Map your personal data. Which systems hold it, who can reach it, and which vendors process it.
2. Encrypt and limit. Encrypt data at rest and in transit, and remove access that is not needed.
3. Log and alert. Turn on logging for access to personal data, protect the logs and agree how long to keep them.
4. Back up and practice restoring.
5. Update vendor contracts with security and breach-reporting terms.
6. Test. Run penetration tests on the web applications, mobile apps and APIs that handle personal data, and on the network behind them.
7. Write the breach plan, with roles, contacts and templates for the notice.
8. Train people who handle personal data.

Data you collect now will be in scope when the main duties start. Systems built now are cheaper to fix than systems rebuilt later, and testing in 2026 gives you time to fix what it finds. Our page on DPDP Act security testing shows how we scope it. For a starting point on budget, read the cost guide, or request a scoping call.

Facts in this article were checked on 4 November 2026 against these primary sources:

• PIB: Government notifies DPDP Rules to empower citizens and protect privacy (14 November 2025)
• MeitY: Digital Personal Data Protection Rules, 2025