DPDP Act Security Safeguards: A Rule 6 Checklist for Indian SMEs, Drawn From 2026 Breach Fines

Most Indian founders hear "DPDP compliance" and think of consent banners and privacy notices. The part that tends to cost real money is less glamorous: DPDP Act security safeguards, set out in Section 8(5) of the Act and spelled out in Rule 6 of the DPDP Rules, 2025. If a breach happens after 13 May 2027 and the Data Protection Board finds your safeguards were thin, the penalty ceiling for that failure is ₹250 crore. Recent fines in Europe show what regulators actually look at when they decide a company was careless.

What Rule 6 actually asks of you

Rule 6(1) lists the minimum measures a Data Fiduciary must put in place. In plain terms:

• Protect the data itself. Encryption, obfuscation, masking, or tokens that stand in for the real value.
• Control access. Limit who can reach the systems that hold personal data, whether they are yours or your processor's.
• Keep logs and watch them. Monitor and review access so unauthorised use can be detected, investigated and fixed.
• Plan for loss. Reasonable steps, such as backups, to keep processing going if data is destroyed, lost or locked.
• Retain logs and personal data for one year, unless another law requires something different.
• Put security terms in processor contracts.
• Make it real. Technical and organisational measures that ensure the safeguards are actually followed.

Notice the wording: "reasonable". Rule 6 does not name a product or a certification. It expects a sensible, documented set of controls that fits the risk of the data you hold. A 15-person SaaS firm and a hospital chain will not look the same, but both need to show their thinking.

What regulators punish: three recent examples

Europe's regulators have been fining companies for exactly these gaps, and the pattern is instructive.

In January 2026, France's data regulator CNIL fined Free Mobile and Free a combined €42 million (€27 million and €15 million) after an October 2024 breach exposed data tied to roughly 24 million subscriber contracts. CNIL pointed to weak authentication on the VPN used for remote access and to detection tools that failed to flag abnormal activity (CNIL; The Register).

In May 2026, CNIL fined IQVIA Operations France €5 million over two health data warehouses. Reported failings included no multi-factor authentication on one warehouse and no regular review of connection logs or detection of unusual activity (CNIL).

The UK's ICO fined South Staffordshire Water £963,900 in May 2026 after a phishing email led to an intrusion that sat undetected for about 20 months (per a GDPR enforcement roundup from GDPRLocal).

Look at what these have in common. None involved exotic zero-day attacks. They came down to weak login protection, nobody reading the logs, and slow detection. Those are precisely the things Rule 6(1)(b) and (c) address.

A practical Rule 6 checklist for an Indian SME

You do not need a big security team to start. Work through this in order.

1. Map where personal data lives. Production databases, yes, but also support tools, spreadsheets on shared drives, analytics exports and WhatsApp groups. You cannot protect what you have not listed. The DPDP Act compliance overview is a good place to begin the inventory.

2. Turn on multi-factor authentication everywhere that touches personal data. Admin consoles, cloud accounts, VPNs, CRM, HR software. This single step would have addressed a visible weakness in two of the three cases above.

3. Encrypt at rest and in transit. Most cloud databases offer this as a setting. Check it is on rather than assuming.

4. Cut access to what each role needs. Your marketing intern probably does not need customer phone numbers in clear text. Masking columns in dashboards is often an afternoon of work.

5. Switch on logging, then assign a human to look. Logs that nobody reads satisfy neither the rule nor common sense. Even a weekly review of failed logins, bulk exports and new admin accounts counts as a start. Store the logs for a year.

6. Test your backups. Restore one. A backup you have never restored is a hope, not a control.

7. Fix your vendor contracts. Every processor handling your customers' data (hosting, payroll, email, support desk) should be bound by written security obligations. If your contracts are silent, our note on the services we offer explains how we help tidy these up.

The log retention trap

One detail catches teams out. Rule 6(1)(e) requires logs and personal data to be retained for one year. That sits awkwardly beside erasure promises, because a customer may ask you to delete their data while the rule expects you to keep certain records. The practical answer is to separate things: delete the customer-facing profile and marketing data when the purpose ends, but keep the access and processing logs the rule requires, and say so plainly in your privacy notice. Sources differ slightly on wording, with some commentary saying "at least one year", while the rule text itself says "one year". Read the official text and decide with your advisers.

Where to start this month

The full obligations apply from about 13 May 2027, which leaves roughly seven months. That sounds comfortable until you list the work: inventory, access clean-up, logging, vendor paper. Do a short gap assessment now, ideally alongside a privacy impact assessment for your highest-risk system, so the fixes are sequenced rather than rushed in April.

If you also serve EU customers, the same controls count under GDPR, so one effort covers both. Our GDPR compliance consulting page explains the overlap.

Security safeguards are the part of DPDP that a regulator can measure after something goes wrong. Build them while nothing has.

This article is general guidance and not legal advice. Consult a qualified professional about your specific situation.

Want to see where you stand? Start with our DPDP checklist, or get in touch for a short, practical review.