Lesson 5.2: Rule 6: the minimum safeguards
The Rules list the minimum technical and organisational measures. This lesson turns each into a task. This DPDPA 2023 course page explains the minimum safeguards in plain language.
'%2F%3E%3Ccircle%20cx%3D'650'%20cy%3D'15'%20r%3D'62'%20fill%3D'%2314b8a6'%20opacity%3D'.35'%2F%3E%3Ctext%20x%3D'28'%20y%3D'54'%20font-family%3D'Poppins%2CArial%2Csans-serif'%20font-size%3D'26'%20font-weight%3D'800'%20fill%3D'white'%3EDPDPA%202023%20COURSE%3C%2Ftext%3E%3C%2Fsvg%3E)
What you will learn about the minimum safeguards
- List the Rule 6 safeguards
- Turn each into a task
- Know the one-year log requirement
What Rule 6 requires (the minimum safeguards)
Reasonable safeguards include: encryption, obfuscation, masking or virtual tokens; control of access to computer resources; visibility on access through logs, monitoring and review; reasonable measures for continued processing in case of compromise, such as backups; retention of logs and personal data for a minimum of one year for detection, investigation and remediation; contract terms with processors for safeguards; and appropriate technical and organisational measures to ensure effective observance.
Rule 6 tasks: click each
Select a numbered box to read more.
Small-company tool ideas (the minimum safeguards)
| Control | Easy option |
|---|---|
| Encryption | Full-disk encryption on laptops, HTTPS, encrypted database |
| Access | Password manager, MFA |
| Logs | Cloud provider logging switched on |
| Backups | Daily cloud backup with restore test |
Worked example
A 20-person agency turns on MFA, enables disk encryption, switches on cloud logs with one-year retention, and adds a security clause to each vendor contract. Total cost: staff time, not a new product.
Activity (5 minutes) (the minimum safeguards)
Score yourself 0 to 2 against each of the six Rule 6 items. See How to meet the security safeguards.
Check your understanding of the minimum safeguards
Q1. Rule 6 requires logs to be kept for at least:
Q2. Which is a safeguard in Rule 6?
Q3. Processor contracts should include:
Educational material for learning purposes, not legal advice. Check the official text of the DPDP Act, 2023, the DPDP Rules, 2025 and MeitY notifications for the latest position.