DPDP Act Part 3: Security, 72-Hour Breach Reporting & Data Retention

An auto-components maker’s HR manager emails an unencrypted salary spreadsheet with 900 employees’ bank details to the wrong vendor. Under the DPDP Act, that is a personal data breach. The Board and all 900 employees must be told, and the company must show it had reasonable safeguards in place. “It was a human error” is not a defence.

Section 8 obligations on every Data Fiduciary

Security safeguards: the Rule 6 baseline

The Act says “reasonable security safeguards”. Rule 6 spells out the minimum. Failing here carries the Act’s highest penalty, up to ₹250 crore.

These are minimums. For a manufacturer, they typically mean encrypted HRMS and payroll files, role-based access to dealer KYC, CCTV footage retention rules, and backups for ERP data. For a startup, add secrets management, production-data access logging and vendor security reviews.

Breach reporting: the 72-hour rule

A “personal data breach” is any unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data that compromises its confidentiality, integrity or availability (s.2(u)). A lost laptop, a misdirected email, ransomware and an exposed S3 bucket all qualify.

Retention and erasure: delete what you no longer need

Under section 8(7), you must erase personal data when consent is withdrawn or when it is reasonable to assume the purpose is no longer served, whichever is earlier, unless a law requires you to keep it. Your processors must erase it too.

Fixed deadlines for large platforms (Third Schedule)

These platforms must warn the person at least 48 hours before erasure, so they can log in and keep the account (Rule 8(2)). Everyone else has no fixed number, but must still erase once the purpose ends.

But some data must be kept

Rules 6 and 8(3) require logs and associated personal data to be kept for at least one year. Other laws impose longer periods: books of account under section 128 of the Companies Act, 2013 must be kept for eight financial years, and GST records generally for 72 months from the annual return due date. “Required by law” retention overrides DPDP erasure, so build one retention schedule that reconciles all of them.

Extra duties for children’s data (section 9)

A “child” under the Act is anyone below 18 years. Before processing a child’s data, you need verifiable consent from a parent or lawful guardian (s.9(1); Rule 10). You also cannot:

• Process data in a way likely to harm the child’s well-being (s.9(2)).
• Track, behaviourally monitor or target advertising at children (s.9(3)).

Rule 12 and the Fourth Schedule exempt certain classes, such as healthcare, educational institutions, crèches and their transport, and certain purposes, such as real-time location tracking for safety. Edtech, gaming and consumer startups must design age-gating and parental verification now. See Part 4 for detail.

Extra duties for Significant Data Fiduciaries (section 10)

The Government may notify a fiduciary or class as “significant” based on volume and sensitivity of data, risk to people, and impact on sovereignty, electoral democracy, security and public order. An SDF must:

1. Appoint a Data Protection Officer based in India, answerable to the board of directors.
2. Appoint an independent data auditor.
3. Carry out a Data Protection Impact Assessment and audit at least once every 12 months, and report significant observations to the Board (Rule 13).
4. Verify that algorithmic software does not pose a risk to people’s rights.
5. Follow any localisation restrictions the Government specifies for certain data.

No SDF notification had been issued as at 24 October 2026 (confirm). Most startups and mid-size manufacturers are unlikely to be notified, but large consumer platforms should prepare.

Hyderabad context

Many startups in Madhapur, Kondapur and the Financial District run on third-party SaaS. Under section 8(1), every one of those tools is your processor, and your liability. Start by listing vendors and adding DPDP clauses at the next renewal. Our guide on why legal drafting is business insurance explains why contract wording decides who bears the loss.

Why work with ComplianceKart

Breach readiness, vendor contracts and retention schedules cut across law, tax records and operations. ComplianceKart is a boutique practice bringing CAs, CSs and advocates under one roof, like a multi-speciality hospital where the specialists coordinate before the procedure. Our advocates draft processor agreements, our CAs reconcile retention with tax and company law, and our CSs align board-level oversight. We do not guarantee any regulatory outcome.

Frequently asked questions

Sources

• DPDP Act, 2023: sections 2(u), 8, 9 and 10 — MeitY
• DPDP Rules, 2025: Rules 6, 7, 8, 9, 10, 12, 13 and 14, Third and Fourth Schedules (G.S.R. 846(E))
• PIB release on DPDP Rules, 14 November 2025 — pib.gov.in
• CERT-In Directions under section 70B(6) of the IT Act, 28 April 2022 — cert-in.org.in

Previous: Part 2 — consent and notice. Next: Part 4 — rights, duties, children and cross-border.

This article is general information on the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 as at 24 October 2026. It is not advice on any specific situation. Phased commencement dates and pending government notifications can change; check the official text on meity.gov.in before acting.