| TL;DR Rule 6 of the Digital Personal Data Protection (DPDP) Rules, 2025 names backups, access logs and one-year retention as minimum safeguards, including for work a Data Processor does on your behalf. A DPDP rules backup and breach response checklist turns these into records a hosting provider can show: restore test logs, log retention settings, an incident notice clause and a contract annexure. Rules 6 and 7 are scheduled from 13 May 2027; the Indian Computer Emergency Response Team (CERT-In) 6-hour reporting and 180-day log directions already apply. |
Rule 6 of the Digital Personal Data Protection (DPDP) Rules, 2025 specifies reasonable security safeguards, including access controls, monitoring, logs, data backups and the retention of relevant logs and personal data for one year, subject to applicable legal requirements. Rule 7 addresses the intimation and reporting of personal data breaches.
When a hosting or managed services provider operates part of an organisation’s infrastructure, evidence of these safeguards may be distributed between the organisation and its provider. This can include access-control configurations, infrastructure logs, backup execution reports and incident records. This checklist maps the relevant provisions of the Rules to the operational evidence that hosting and managed services providers can supply.
It is written for CIOs, IT heads and infrastructure leads at Indian organisations that act as Data Fiduciaries, the entities that decide why and how personal data is processed, and that run personal data on colocated, dedicated or managed infrastructure. A Data Processor is any entity that processes personal data on a Data Fiduciary’s behalf. This is not legal advice; counsel decides how the Rules apply to your processing. The focus here is the engineering side: which provider records show that a safeguard exists.
Our data center managed services checklist sets out who owns monitoring, patching and backup in a hosting contract. This article builds on that split and asks a narrower question: what evidence the DPDP Rules make worth collecting from the provider side of that line.
When do the DPDP Rules’ backup and breach duties start to apply?
The security safeguards in Rule 6 and the breach intimation steps in Rule 7 are scheduled to apply from 13 May 2027, eighteen months after the Rules were published. CERT-In’s directions on incident reporting and log retention have applied since 2022, so part of the evidence trail is already expected today.
The Rules were notified as General Statutory Rules (G.S.R.) 846(E), dated 13 November 2025. Under Rule 1 of the published DPDP Rules, Rule 4 commences one year after publication and Rules 3, 5 to 16, 22 and 23 eighteen months after, while Rules 1, 2 and 17 to 21 took effect on publication. The Press Information Bureau’s backgrounder describes an eighteen-month period for phased compliance.
Counted from the Gazette date, that places the Consent Manager rule on 13 November 2026 and the substantive rules on 13 May 2027. PIB reports the notification date as 14 November 2025; counting from that date moves each milestone by one day. In a written Lok Sabha answer, the Ministry of Electronics and Information Technology (MeitY) placed security safeguards and breach notification in the phase due within eighteen months. At notification, The Economic Times reported that security safeguards and breach notification would come into force after 18 months, with the consent manager framework operative after 12.
| Date | What applies | Relevance to a hosting contract |
|---|---|---|
| 28 April 2022 directions, effective 60 days later | CERT-In: 6-hour reporting of listed incidents, 180-day information and communications technology (ICT) logs within Indian jurisdiction | Already applies; data centres and body corporates are named |
| 13 November 2025 | DPDP Rules 1, 2 and 17 to 21: definitions and the Board | No new infrastructure safeguard |
| 13 November 2026 | Rule 4: Consent Managers | Consent platforms |
| 13 May 2027 | Rules 3, 5 to 16, 22 and 23, including Rule 6 (safeguards), Rule 7 (breach) and Rule 8 (retention) | Backups, logs, breach response, processor contracts |
Sources: MeitY, DPDP Rules 2025, Rule 1 (dates counted from the Gazette date); CERT-In Directions of 28 April 2022; Lok Sabha Unstarred Question 3960, 12 Aug 2026.
The table points to one practical question for procurement. If a hosting contract renews before 13 May 2027, does it already name the Rule 6 safeguards, or will it need an amendment partway through its term?
What Rule 6 asks of backups, logs and retention at your provider
Rule 6 sets minimum safeguards for personal data a Data Fiduciary holds, including processing done on its behalf by a Data Processor. Three of them land directly on hosting: backups for continued processing, logs that show access, and keeping those logs and the personal data for one year. A fourth asks for the safeguards to be written into the processor contract.
The full list in Rule 6(1) runs from (a) to (g): encryption, obfuscation, masking or virtual tokens; access control over computer resources; visibility on access through logs, monitoring and review; reasonable measures for continued processing if confidentiality, integrity or availability is compromised, “such as by way of data-backups”; retention of logs and personal data for one year unless another law requires otherwise; a contract provision with the Data Processor; and technical and organisational measures to make the rest effective.
Whether your hosting provider holds the Data Processor role for a given service is a question to settle with counsel; the checks below assume it does.
Figure 1. An illustrative checklist view: the four Rule 6 safeguards that touch a hosting contract, each paired with a record a reader could ask the provider for.
Backups for continued processing
Rule 6(1)(d) presents backups as an example of a continuity measure, tied to the loss of confidentiality, integrity or availability of personal data. The text sets no backup frequency, recovery point objective (RPO) or recovery time objective (RTO).
- Who sets the backup frequency, RPO and RTO for systems holding personal data, and where is that written down?
- Where are backup copies held, and is at least one copy outside the primary site?
- When was the last restore of a system holding personal data, what was restored, and how long did it take?
- Can a compromised administrator account delete or encrypt the backup copies?
- Are backup copies encrypted at rest, given that Rule 6(1)(a) names encryption as a safeguard, and who holds the keys?
The difference between holding copies and being able to recover a service is covered in our explainer on the differences between backup and disaster recovery.
Logs and the one-year floor
Rule 6(1)(c) asks for visibility on access to personal data through logs, monitoring and review, so that unauthorised access can be detected, investigated and remediated. Rule 6(1)(e) then requires those logs and the personal data to be retained for one year, unless another law requires otherwise. Separately, Rule 8(3) requires a Data Fiduciary, for the purposes specified in the Seventh Schedule, to retain personal data, associated traffic data and other logs of processing, including processing by a Data Processor, for a minimum of one year from the date of processing.
For the provider side, the useful question is specific: which provider-run logs record access to systems holding your personal data, such as console and out-of-band access, hypervisor and storage administration, backup jobs and firewall changes, and how long is each one kept?
| Obligation | Source | Period | Status on 30 Oct 2026 |
|---|---|---|---|
| Retain logs and personal data for detection, investigation and continued processing | DPDP Rules, Rule 6(1)(e) | One year, unless another law requires otherwise | Scheduled from 13 May 2027 |
| Retain personal data, traffic data and processing logs for the purposes in the Seventh Schedule | DPDP Rules, Rule 8(3) | Minimum one year from the date of processing | Scheduled from 13 May 2027 |
| Enable and keep logs of all ICT systems within Indian jurisdiction | CERT-In Directions, direction (iv) | Rolling 180 days | Applies since 2022 |
Sources: MeitY, DPDP Rules 2025, Rules 6 and 8; CERT-In Directions of 28 April 2022.
Read side by side, a log store set to a rolling 180 days matches the CERT-In figure but stops short of the one-year period in Rule 6(1)(e) once that rule applies. The CERT-In text also says the logs are to be maintained within the Indian jurisdiction. Where logs and backup copies physically sit is a residency question, which our article on data sovereignty for Indian businesses takes up.
The processor contract
Rule 6(1)(f) asks for an appropriate provision in the contract between the Data Fiduciary and the Data Processor for taking reasonable security safeguards. The check is simple: does the master services agreement, or a data processing annexure, name the Rule 6 safeguards the provider is responsible for, or does it refer only to generic security language?
| WHAT TO VERIFY The retention setting on every provider log source that touches personal data, shown as a configuration export rather than a policy line. A restore test record for at least one system holding personal data, with date, scope and measured duration. Encryption status of backup copies at rest, and who holds the keys. The contract clause or annexure that names each Rule 6 safeguard the provider runs. |
How breach response splits between you and your hosting provider
Rule 7 places the duty to inform the Data Protection Board and affected people on the Data Fiduciary, not on the host. Where some affected systems are run by a hosting provider, one question for the contract is how quickly the provider’s facts about an incident reach you. CERT-In’s 6-hour clock runs alongside.
Under Rule 7(2), the Data Fiduciary intimates the Board without delay with a description of the breach: its nature, extent, timing and location, and the likely impact. Within 72 hours of becoming aware, or a longer period the Board allows on a written request, it adds updated details, the broad facts behind the breach, mitigation measures, any findings on who caused it, remedial measures and a report on the intimations given to affected Data Principals, the individuals the personal data relates to. PIB’s backgrounder adds that affected individuals are told without delay, in plain language, what happened, the possible impact, the steps taken and whom to contact.
The CERT-In directions of 28 April 2022 require service providers, data centres and body corporates to report listed cyber incidents within 6 hours of noticing them or being told about them. The same directions ask for logs to be provided to CERT-In with an incident report or when CERT-In directs.
| What the Board asks for | When | Provider-side record to request |
|---|---|---|
| Nature, extent, timing and location; likely impact | Without delay | First-alert time, affected hosts and storage, the time-stamped incident ticket |
| Updated and detailed description | Within 72 hours | Incident timeline built from provider logs |
| Broad facts on events, circumstances and reasons | Within 72 hours | Access logs, change records and root cause notes for provider-run layers |
| Mitigation implemented or proposed | Within 72 hours | Containment actions such as host isolation, credential resets and restores |
| Findings on who caused the breach | Within 72 hours | Preserved logs and images with a record of who handled them |
| Remedial measures to prevent recurrence | Within 72 hours | Patch and configuration changes with ticket references |
| Report on intimations to Data Principals | Within 72 hours | Your own record of notices sent |
Source: MeitY, DPDP Rules 2025, Rule 7(2).
Six of the seven rows depend on information that has to be gathered inside the 72-hour window. Where the provider runs the infrastructure layer, the questions are how much of the right-hand column it will hand over, in what format, and how soon after it first notices an incident affecting your systems.
Figure 2. An illustration of how a checklist can trace one incident to several reports. It is not a fixed flow: the CERT-In directions also name service providers and data centres as reporters in their own right.
| EVIDENCE TO REQUEST A contract clause stating the time from the provider noticing an incident on your systems to notifying your named contact. Whether and how the provider shares any CERT-In report it files that concerns your environment. A redacted incident report from a past exercise, showing the timeline format the provider uses. The log export format and delivery route during an incident. Who can authorise a host snapshot for evidence, and where preserved images are held. |
Applying the DPDP rules backup and breach response checklist to colocation, managed and cloud hosting
The same Rule 6 and Rule 7 text produces different questions depending on which layers the provider operates. The table below frames them by hosting model; each row is a set of checks, not a statement of who holds what in your contract.
| Hosting model | Questions for the provider |
|---|---|
| Colocation | Which facility records, such as physical access logs and CCTV, relate to racks holding personal data, and how long are they kept? Does the provider hold any copy of your data, such as off-site backup media? |
| Managed dedicated servers | Who runs backup jobs and restore tests? Who keeps OS, console and backup logs, and for how long? Who can isolate a host during an incident? |
| Cloud hosting | Which platform logs are visible to you, for what period, and can they be exported to your own store before they roll off? |
Sources: questions derived from MeitY, DPDP Rules 2025, Rules 6 and 7.
The summary below pulls the earlier sections into one checklist for a provider review.
| Criterion | Why it matters | What to verify |
|---|---|---|
| Backups for continued processing | Rule 6(1)(d) names data backups as a continuity measure | Restore test log with date, scope and duration; an off-site copy |
| Backup encryption | Rule 6(1)(a) names encryption as a safeguard | Encryption at rest for backup copies; key custody |
| Access logs | Rule 6(1)(c) asks for logs, monitoring and review of access | List of provider log sources and who reviews them |
| Log and data retention | Rule 6(1)(e) sets one year; Rule 8(3) sets one year for Seventh Schedule purposes; CERT-In sets a rolling 180 days | Retention configuration for each log source |
| Log location | CERT-In direction (iv) refers to logs maintained within Indian jurisdiction | Site and region of log storage |
| Processor contract | Rule 6(1)(f) asks for safeguards in the contract | Annexure naming each safeguard and its owner |
| Incident notice to you | Rule 7(2) places the Board report on the Data Fiduciary, with details due within 72 hours | Is there a clause with a provider-to-customer notice time? |
| CERT-In reporting | Listed incidents are reported within 6 hours of noticing | How provider reports that concern you are shared |
Sources: MeitY, DPDP Rules 2025, Rules 6, 7 and 8; CERT-In Directions of 28 April 2022.
What this checklist does not settle
The Rules do not prescribe a backup frequency, RPO, RTO or log format, so this checklist cannot set those numbers for you. It does not decide whether a provider is your Data Processor for a given service, and it does not cover consent, notices, children’s data or Significant Data Fiduciary duties. Rule 6(1)(e) also yields to any other law that requires a different retention period, and sector regulators’ own incident and retention rules are outside this checklist.
FAQ
What is the penalty for weak security safeguards under the DPDP Act?
PIB’s backgrounder states that the highest penalty, up to Rs 250 crore, applies when a Data Fiduciary fails to maintain reasonable security safeguards. Not notifying the Board or affected individuals of a personal data breach can attract up to Rs 200 crore.
Does a hosting provider’s CERT-In report cover the DPDP breach report?
The two reports go to different bodies under different texts. The CERT-In directions name service providers and data centres among those who report to CERT-In, while Rule 7 places the Board intimation and the notices to Data Principals on the Data Fiduciary. Whether a provider’s CERT-In report about your environment is shared with you is a contract point.
Does the one-year DPDP log rule replace CERT-In’s 180 days?
The two sit side by side. CERT-In asks for a rolling 180 days of ICT system logs within Indian jurisdiction now, and Rule 6(1)(e) asks for logs and personal data to be kept for one year once it applies. A one-year store kept within India meets the period in both texts.
Where this leaves your provider review
Rule 6 names backups, access logs, retention and a processor contract provision as safeguards, and Rule 7 sets the Data Fiduciary’s breach timeline. The summary table turns each into a record that can be checked. Two questions decide how much of it applies: does a provider operate any layer that holds your personal data, and does the hosting contract renew before 13 May 2027?
| NEXT STEP The summary table can serve as the agenda for a provider review, with each row marked evidenced, missing or not applicable. RackBank’s managed services for backup operations, monitoring and security and compliance management can be reviewed against the same rows. |
