Rule 6 security safeguards under DPDP, explained for non-technical staff

Rule 6 of the Digital Personal Data Protection Rules, 2025 requires every organisation that handles digital personal data to put seven minimum security safeguards in place. In short: protect the data (for example by encryption or masking), control who can get into systems, keep logs that show who accessed what, be able to carry on if data is lost, keep those logs and data for one year, write security duties into contracts with vendors who process data, and back all of this with appropriate technical and organisational measures. The legal duty sits with the organisation, but most of these safeguards only work if people at their desks use them properly.

This guide is for sales, HR, front desk and support teams and their managers. It is not legal advice; your legal or compliance team decides how Rule 6 applies to your organisation.

Where does Rule 6 come from in the DPDP Act?

The Digital Personal Data Protection Act, 2023 sets the duty and the Rules fill in the detail. Section 8(5) of the Act says a Data Fiduciary, meaning the organisation that decides why and how personal data is used, “shall protect personal data in its possession or under its control, including in respect of any processing undertaken by it or on its behalf by a Data Processor, by taking reasonable security safeguards to prevent personal data breach.”

Section 8(4) adds a wider duty to “implement appropriate technical and organisational measures” so that the Act and the Rules are actually followed. Rule 6(1) then lists what the security safeguards must include “at the minimum”. That word matters: the list is a floor, not a complete security programme.

Two definitions from the Act help here:

• Personal data breach (section 2(u)) is not limited to hacking. It covers any unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises its confidentiality, integrity or availability. A salary file emailed to the wrong list fits that definition.
• Data Processor (section 2(k)) is anyone who processes personal data on the organisation’s behalf, such as a payroll vendor, a cloud provider or an outsourced call centre.

When does Rule 6 come into force?

The Rules were published in the Gazette of India on 13 November 2025 as G.S.R. 846(E). Under Rule 1(4), Rule 6 comes into force eighteen months after publication, which places it in May 2027. Reports in early 2026 said MeitY was considering a shorter window for some organisations, but we have not seen an amending notification as of the date of this article. Check the current position with your compliance team.

That can sound far off, but habits such as shared logins and personal spreadsheets take time to unwind.

What are the seven minimum safeguards in Rule 6(1)?

Here is the list in the order the Rule gives it, kept close to the Gazette wording.

1. Clause (a), securing the data. Appropriate data security measures, “such as securing of personal data through encryption, obfuscation, masking or the use of virtual tokens mapped to that personal data”.
2. Clause (b), access control. Appropriate measures to control access to the computer resources used by the organisation or its Data Processor, wherever applicable. Rule 6(2) takes the meaning of “computer resource” from the Information Technology Act, 2000, which covers computers, computer systems and networks, data, databases and software.
3. Clause (c), visibility. Visibility on the accessing of personal data “through appropriate logs, monitoring and review”, so that unauthorised access can be detected, investigated and remediated to prevent it happening again.
4. Clause (d), continuity. Reasonable measures to keep processing going if the confidentiality, integrity or availability of the data is compromised, for example through destruction or loss of access, “such as by way of data-backups”.
5. Clause (e), one-year retention. Retain those logs and personal data for a period of one year, to support detection, investigation, remediation and continued processing, “unless compliance with any law for the time being in force requires otherwise”.
6. Clause (f), contracts. An appropriate provision in the contract between the organisation and each Data Processor, wherever applicable, for taking reasonable security safeguards.
7. Clause (g), making it stick. “Appropriate technical and organisational measures to ensure effective observance of security safeguards.”

The Rule does not name products, password lengths or settings. Words such as “appropriate” and “reasonable” let an organisation match controls to its size and risk.

What does each safeguard mean at your desk?

Which everyday habits matter most?

Five situations come up again and again in sales, HR, front desk and support work. Each maps to a clause of Rule 6. Logs get their own section after these.

Passwords and shared logins

A shared login defeats two safeguards at once. Clause (b) expects access to be controlled, and clause (c) expects logs that show who accessed personal data. If five people use one “sales-admin” account, the log can only say that sales-admin did it.

• Use your own account for every system, including the CRM, HR system and helpdesk.
• Never share your password, OTP or authenticator code, even with a colleague covering your shift or a vendor engineer.
• Turn on multi-factor authentication wherever it is offered.
• If a team genuinely needs a common mailbox, ask IT to set it up so that each person signs in as themselves.

Exports and personal sheets

Copying a lead list or payroll file into a personal Google Sheet or onto a pen drive takes the data outside access control, logging and backup. It is also the copy most likely to be forgotten when someone leaves.

• Work in the system itself. Export only when there is a clear business need and your manager agrees.
• Export only the columns you need, masked where possible.
• Keep any export in the approved drive, not a personal account or USB stick, and remove it as your organisation’s process says once the task is done.

Screen locks and unattended desks

Front desks, reception counters and shared terminals are where access control most often slips. An unlocked screen hands the next person your access, and the log will still show your name.

• Lock your screen every time you step away: Windows key + L on most Windows PCs, Control + Command + Q on a Mac.
• Angle screens away from visitors and queues.
• Do not leave printouts of customer lists, ID copies or forms on the counter.

WhatsApp forwards and personal phones

Forwarding a customer’s ID copy, a salary slip or a lab report from a personal WhatsApp account feels quick. But the organisation cannot control who else sees it, cannot log it and cannot remove it later, and a copy stays on a phone that may be lost or backed up to a personal cloud.

• Use only the channels your organisation has approved for customer or employee data.
• Do not forward documents to your personal number or email to “finish at home”.
• If a customer sends documents to your personal number, move them into the approved system and clear the chat copy as your policy says.

Vendor access

Clause (f) puts security duties into contracts with Data Processors, and section 8(1) of the Act keeps the organisation responsible for processing done on its behalf. A good contract does not help if staff send data informally to vendors who never signed one.

• Do not send data to a new agency, freelancer or online tool until it has been through procurement or legal.
• Never give a vendor your login. Ask IT for a separate, time-limited account.
• Tell IT when a vendor’s work ends so their access can be removed.
• Share only the data the vendor needs for the task.

What does keeping logs for one year mean for non-technical staff?

Clause (e) asks the organisation to retain logs and personal data for one year so that unauthorised access can be detected and investigated and processing can continue, unless another law requires otherwise. Separately, Rule 8(3) requires organisations to keep personal data, associated traffic data and other logs of processing for a minimum of one year from the date of processing, for the purposes listed in the Seventh Schedule to the Rules. Setting retention is a job for IT and legal, but staff can easily undermine it.

• Do not delete ticket histories, call notes, email trails or audit entries to clean up a record.
• Do not ask IT to switch off logging because a system feels slow.
• If you spot something odd, such as a login you do not recognise, report it rather than fixing it yourself.

Logs matter most after something goes wrong. Under Rule 7(2), once the organisation becomes aware of a personal data breach it must inform the Data Protection Board without delay, and within 72 hours (or a longer period the Board allows on a written request) send detailed information, including the events, circumstances and reasons that led to the breach. Without logs, that report becomes guesswork.

What is the penalty for failing to take reasonable security safeguards?

Item 1 of the Schedule to the Act sets the penalty for breaching the section 8(5) duty at up to ₹250 crore, the highest amount in the Schedule. Failing to notify the Board or affected people of a breach under section 8(6) can separately attract up to ₹200 crore.

These are ceilings, not fixed fines. Under section 33, the Data Protection Board can impose a penalty only after an inquiry finds the breach significant and after giving a hearing. It must consider factors such as the nature, gravity and duration of the breach, the type of personal data affected, whether the breach was repeated, and whether the organisation acted promptly and effectively to limit the damage.

The penalty falls on the organisation, not on individual employees. Even so, a shared password or a forwarded file is often where a breach starts, and the organisation then has to show what safeguards it had and how well they were followed.

What should be on your desk checklist?

Print this list or pin it near your screen.

• I use my own account on every system, with multi-factor authentication where offered, and never share passwords or OTPs.
• I lock my screen every time I leave my desk.
• I use masked views and unmask full numbers only when the task needs it.
• I work in the official system, not in personal spreadsheets, pen drives or personal cloud accounts.
• Any export I make is approved, limited to what is needed, kept in the approved drive and removed as per our process.
• I do not forward customer or employee data on personal WhatsApp or personal email.
• I save work in the approved system so it is backed up.
• I never give a vendor my login, and I share data only with vendors that have a contract.
• I tell IT when I change role, when a vendor’s work ends, or when a colleague leaves.
• I do not delete logs, histories or audit trails, and I do not ask for logging to be switched off.
• I report a lost device, a wrong-recipient email or a suspicious login immediately, even if I caused it.

Where does awareness training fit?

Clause (g) asks for technical and organisational measures that make the safeguards stick. The Rule does not spell these out, but written policies, clear responsibilities and staff awareness are the usual organisational side. Training lands better when it uses the systems people actually work in, so sales hears about CRM exports and HR about payroll files.

AuditDPDP runs DPDP awareness sessions built on that idea, with role-based scenarios for tools such as CRMs and shared drives, and examples for different sectors. We are an independent training provider, not affiliated with MeitY or the Data Protection Board, and our sessions do not carry any official certification. If that would help your team, you can get in touch.