Rule 6 — DPDP Rules, 2025
Every Data Fiduciary shall protect personal data in its possession or under its control by implementing appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including— (a) the use of appropriate encryption, obfuscation, masking or de-identification techniques; (b) controls to manage access to personal data; (c) maintaining logs of access to personal data; (d) steps to prevent unauthorised disclosure, modification or destruction of personal data; (e) steps to prevent loss or theft of personal data; (f) ensuring data processors meet equivalent security standards; (g) reviewing and updating security practices at regular intervals.
Source: Digital Personal Data Protection Rules, 2025. Official text available at truconsent.io/resources/dpdp-rules.pdf.
Rule 6 replaces the vague 'reasonable security safeguards' obligation in Section 8(5) with seven specific minimum controls. These are seven floors, not a menu — all seven must be in place simultaneously. 'Appropriate encryption' in Rule 6(a) does not mean encryption is optional for lower-risk data — it means the encryption method must match the risk profile. 'Logs of access' in Rule 6(c) is a direct, auditable requirement — if your system cannot produce access logs for personal data, it is non-compliant. Rule 6(f) extends the security standard to every Data Processor the Data Fiduciary uses.
Health records require stronger encryption (AES-256 minimum, encryption at rest and in transit) than marketing email preferences. 'Appropriate' is calibrated to the sensitivity and risk of the data category. A one-size-fits-all TLS-in-transit policy that leaves data unencrypted at rest will not satisfy Rule 6(a) for sensitive categories.
Rule 6(b) requires controls to manage access to personal data. This means role-based access control (RBAC) — only the people whose job requires accessing a data category should be able to access it. A developer having read access to the production customer database is not a controlled access environment.
Rule 6(c) requires maintaining logs of access. 'Who accessed what data, when, and from which system' must be answerable from your logs. If the Board requests access logs during an inquiry and you cannot produce them, this is a direct Rule 6(c) violation independent of any other finding.
If a Data Fiduciary uses a cloud analytics vendor who stores customer data in unencrypted S3 buckets with no access logging, the Data Fiduciary is in violation of Rule 6(f) — even if the Data Fiduciary's own systems are fully compliant. The processor contract must include Rule 6-equivalent security obligations, and the Data Fiduciary must verify compliance.
Rule 6(g) requires periodic review and update of security practices. An annual third-party penetration test that produces a report that then sits unread is not sufficient. The review must result in updates, and the updates must be documented. The Board can ask for evidence of the last review cycle and what changes it produced.