Reasonable security safeguards
- Status
- Upcoming
- Applies from
- 13 May 2027Rule 1(4)
- Penalty
- Up to Rs 250 croreAct, Schedule, item 1
- Binds
- Every Data Fiduciary
In plain English
Spells out the "reasonable security safeguards" s. 8(5) of the Act requires, and the floor is specific: encryption, obfuscation, masking or tokenisation of personal data; access control on the computer resources used; logging, monitoring and review so unauthorised access can be detected, investigated and remediated; backups and continuity measures; retention of logs and the personal data for one year to support detection and investigation, unless another law says otherwise; contract clauses that bind every Data Processor to the same safeguards; and technical and organisational measures to make all of this stick.
The duty covers data processed on your behalf by a Data Processor, so it is yours even when a vendor holds the data. Failing to take reasonable security safeguards carries the highest penalty in the Act, up to Rs 250 crore.
What you must do
Encrypt, mask, obfuscate or tokenise personal data at rest and in transit, and control access to every system that holds it.
ServiceVAPT and penetration testingKeep access logs, monitor and review them, and retain the logs and the personal data for one year for detection and investigation.
ServiceVAPT and penetration testingMaintain backups and continuity measures so processing can continue after a loss of confidentiality, integrity or availability.
ServiceVAPT and penetration testingPut reasonable security safeguard clauses into every Data Processor contract.
ServiceVAPT and penetration testing
Links marked Product, Service or Free tool are Infofacility's own.
Note
An ISO 27001 ISMS or a SOC 2 security programme already covers most of this list; the one-year log and data retention in clause (e) and the contract clause in clause (f) are the items most often missing.
Gazette text · Rule 6A Data Fiduciary shall protect personal data in its possession or under its control, including in respect of any processing undertaken by it or on its behalf by a Data Processor, by taking reasonable security safeguards to prevent personal data breach, which shall include, at the minimum, —
- (1)A Data Fiduciary shall protect personal data in its possession or under its control, including in respect of any processing undertaken by it or on its behalf by a Data Processor, by taking reasonable security safeguards to prevent personal data breach, which shall include, at the minimum, —
- (a)appropriate data security measures, such as securing of personal data through encryption, obfuscation, masking or the use of virtual tokens mapped to that personal data;
- (b)appropriate measures to control access to the computer resources used by such Data Fiduciary or such a Data Processor, wherever applicable;
- (c)visibility on the accessing of such personal data, through appropriate logs, monitoring and review, for enabling detection of unauthorised access, its investigation and remediation to prevent recurrence;
- (d)reasonable measures for continued processing in the event of confidentiality, integrity or availability of such personal data being compromised as a result of destruction or loss of access to personal data or otherwise, such as by way of data-backups;
- (e)for enabling the detection of unauthorised access, its investigation, remediation to prevent recurrence and continued processing in the event of such a compromise, retain such logs and personal data for a period of one year, unless compliance with any law for the time being in force requires otherwise;
- (f)appropriate provision in the contract entered into between such Data Fiduciary and such a Data Processor, wherever applicable, for taking reasonable security safeguards; and
- (g)appropriate technical and organisational measures to ensure effective observance of security safeguards.
- (a)
- (2)In this rule, the expression “computer resource” shall have the same meaning as is assigned to it in Information Technology Act, 2000 (21 of 2000).
Source: Gazette of India, G.S.R. 846(E), 13 Nov 2025 (MeitY copy)
Act sections and tools that apply
Source: Gazette of India, G.S.R. 846(E), 13 Nov 2025 (MeitY copy) · Change log