Module 5: Data Security & Breach Management

Module 5 of 10 · Intermediate · 4 hours · Data Security and Breach Management

Reasonable security safeguards, the minimum controls in the Rules, breach intimation timelines, and retention and erasure. This DPDPA 2023 course page explains data security and breach management in plain language.

data security and breach management - DPDPA 2023 course lesson banner

Module 5 lessons (about 4 hours) (data security and breach management)

Read the lessons in order, like chapters of a book. Each has reading, a click-through diagram, an activity and a quiz.

Lesson	Time
Lesson 5.1: The security duty and why it matters most	30 min
Lesson 5.2: Rule 6: the minimum safeguards	30 min
Lesson 5.3: Practical risk assessment for a small company	30 min
Lesson 5.4: What is a personal data breach	30 min
Lesson 5.5: Telling affected people: Rule 7(1)	30 min
Lesson 5.6: Reporting to the Board: the 72-hour rule	30 min
Lesson 5.7: Incident response plan and drills	30 min
Lesson 5.8: Security and breach practice and module test	30 min

Start Lesson 5.1 →

What you will learn about data security and breach management

Apply the minimum safeguards in the Rules
Run a breach response in the right order
Know who must be told and when
Set retention and erasure schedules

Security safeguards

Section 8(5) requires reasonable security safeguards. The Rules spell out a floor:

Encryption, obfuscation, masking or virtual tokens
Access control to computer resources
Logging, monitoring and review to detect unauthorised access
Backups and continuity of processing
Retention of logs and personal data for one year for detection and investigation
Security terms in contracts with processors

Breach notification (data security and breach management)

Tell each affected Data Principal without delay, covering the nature, extent, timing, likely impact, mitigation and a contact point. Tell the Board without delay, followed by a detailed report within 72 hours (or a longer period if the Board allows).

A six-step runbook

Detect, contain, assess impact, notify, remediate, review. Run a tabletop exercise at least once a year.

Retention and erasure (data security and breach management)

Erase personal data when consent is withdrawn or the purpose is served, unless law requires retention. For large e-commerce, online gaming and social media platforms, the Rules set a three-year inactivity limit with advance notice before erasure.

Key takeaway
Failure to keep reasonable security safeguards carries the highest penalty in the Schedule.

Check your understanding of data security and breach management

Q1. Maximum penalty for failing to take reasonable security safeguards?

Q2. Detailed breach report to the Board is due within…

Q3. Minimum log retention under the Rules?

Quick FAQs

Must every breach be reported?

Yes, a personal data breach must be intimated to the Board and affected principals; no minimum harm threshold is stated.

Does the Act require ISO 27001?

No, but a recognised framework helps prove “reasonable” safeguards.

Do it yourself: practical guides (data security and breach management)

← Notice & Consent Management Cross-Border Transfers & Exemptions →

Educational material for learning purposes, not legal advice. Check the official text of the DPDP Act, 2023, the DPDP Rules, 2025 and MeitY notifications for the latest position.

Official sources for data security and breach management: Digital Personal Data Protection Rules, 2025 (MeitY, PDF) and DPDP Rules 2025, English text (PDF). Always check the latest official notifications.