Lesson 5.1: The security duty and why it matters most

Module 5 · Lesson 5.1 of 8 · About 30 minutes · The security duty and why

Failure to keep data safe carries the highest penalty in the Act. Start here. This DPDPA 2023 course page explains the security duty and why in plain language.

the security duty and why - DPDPA 2023 course lesson banner
Advertisement

What you will learn about the security duty and why

  • State the security duty
  • Know the penalty exposure
  • Understand reasonable safeguards

Section 8(5) (the security duty and why)

A Data Fiduciary must protect personal data in its possession or under its control, including data processed by a processor on its behalf, by taking reasonable security safeguards to prevent a personal data breach. Failure can attract a penalty up to Rs 250 crore.

Security in layers: click each

Select a numbered box to read more.

1People2Process3Technology4Physical5Contracts
Tap or click a step to see exactly what to do.
Advertisement

Penalty snapshot (maximum) (the security duty and why)

FailureUp to
Reasonable security safeguardsRs 250 crore
Breach notificationRs 200 crore
Children’s obligationsRs 200 crore
Significant Data Fiduciary dutiesRs 150 crore
Data Principal dutiesRs 10,000
Other breachesRs 50 crore

Worked example

A small online seller keeps customer data in a shared spreadsheet with no password. A leak happens. The Board considers the lack of safeguards, the nature of the breach and steps taken after.

Activity (5 minutes) (the security duty and why)

List where your most sensitive data sits and who can open it.

Key takeaway: Security is not a product. It is a set of habits that you can show with records.

Check your understanding of the security duty and why

Q1. The highest listed penalty is for failing:

Q2. The duty covers data held by:

Q3. Security should be:

← Module 5 homeRule 6: the minimum safeguards →

Educational material for learning purposes, not legal advice. Check the official text of the DPDP Act, 2023, the DPDP Rules, 2025 and MeitY notifications for the latest position.

Official sources for the security duty and why: Digital Personal Data Protection Rules, 2025 (MeitY, PDF) and DPDP Rules 2025, English text (PDF). Always check the latest official notifications.