10 security controls to audit before May 2027
Security safeguards and breach reporting under India's DPDP Act become enforceable on 13 May 2027. See where you stand in two minutes, then get a prioritised plan from our specialists.
For CISOs, CIOs and DPOs · 20+ years · 500+ customers · 30+ technology partnerships
What does the DPDP Act require for data security?
India's Digital Personal Data Protection (DPDP) Act, 2023 and the DPDP Rules, 2025 require every organisation that processes digital personal data to take reasonable security safeguards (Rule 6) and to report personal data breaches (Rule 7). Both apply from 13 May 2027. The 10 controls below are how 22by7 helps you evidence them.
Last reviewed 29 October 2026 by the 22by7 security team. Sources: Ministry of Electronics and IT, DPDP Rules, 2025 (notified 13 November 2025). This page is not legal advice.
- Security and breach rules apply from
- 13 May 2027
- Security safeguards
- Rule 6
- Detailed breach report to the Board
- Within 72 hours
- Minimum log retention
- 1 year
- Max penalty, weak safeguards
- ₹250 crore
- Max penalty, breach not notified
- ₹200 crore
The 10 DPDP security controls: how many can you evidence today?
Each control maps to a DPDP obligation. Your score updates as you go, and shows the gaps to close first.
A clear view of where you stand, and what to fix first
Our specialists review your environment against Rules 6 and 7, working alongside your legal and privacy teams.
Control-by-control gap analysis
All 10 controls rated, with the evidence found or missing.
Breach readiness review
Your response plan tested against the 72-hour Board report and CERT-In's 6-hour timeline.
Prioritised remediation roadmap
What to fix first, sequenced to the time left before 13 May 2027.
Board-ready summary
A short readout your leadership team can act on.
From gap to evidence, end to end
We assess, implement, run and prove your DPDP security controls as your solution provider, implementation partner and managed services provider, so you reach May 2027 with evidence, not promises.
Assess
Gap analysis against Rules 6 and 7, with a prioritised roadmap
Implement
Zero Trust access, identity, data protection, DLP and resilient backup
Operate
24x7 SOC and NOC operations with AI-powered operational intelligence
Prove
Continuous vulnerability management and audit-ready evidence
One partner to modernize, secure and manage your business
From the first assessment to round-the-clock operations, 22by7 is your solution provider, implementation partner and managed services provider in one. For two decades, enterprises across India have trusted us to design, deploy and run their security, networking and infrastructure, backed by top-tier partnerships with the world's leading technology providers.
Top-tier technology partnerships
Top-tier partner status with 30+ leading global security, networking and infrastructure providers, with advice that stays vendor-agnostic.
20+ years of proven delivery
2,200+ projects delivered for some of India's most demanding enterprises since 2006.
Certified depth
100+ certified professionals and 500+ OEM certifications. ISO 27001 and ISO 9001 certified.
AI-powered operational intelligence
AI-assisted security assessments cut the assessment cycle from 15 days to 3, with AI-led support across SOC and NOC operations.
Know where you stand, with time to fix it
Start with a short scoping call. No obligation, and no change to the tools you run today.
When do the DPDP Act security obligations apply?
+
The security safeguards in Rule 6 and the breach notification duties in Rule 7 apply from 13 May 2027, 18 months after the Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025. Consent Manager provisions apply earlier, from 13 November 2026.
Does the DPDP Act apply to my organisation?
+
Yes, if your organisation processes digital personal data in India, or processes it outside India to offer goods or services to people in India. Every such organisation, as a Data Fiduciary, must put reasonable security safeguards in place.
What security safeguards does Rule 6 require?
+
Rule 6 of the DPDP Rules, 2025 requires reasonable security safeguards. These include encryption, masking or tokenisation, access control, logging and monitoring to detect unauthorised access, backups for continuity, one-year log retention, and matching safeguards in contracts with Data Processors.
How long must logs be kept under the DPDP Rules?
+
At least one year. Rule 6 asks Data Fiduciaries to retain logs and related personal data for one year, so unauthorised access can be detected and investigated, unless another law requires a longer period.
What are the penalties under the DPDP Act?
+
Up to ₹250 crore for failing to take reasonable security safeguards to prevent a personal data breach, and up to ₹200 crore for failing to notify the Data Protection Board of India and affected individuals of a breach.
What has to happen after a personal data breach?
+
Under Rule 7, inform affected individuals and the Data Protection Board of India without delay, then send the Board a detailed report within 72 hours of becoming aware of the breach. The Board may allow longer on written request. CERT-In's separate 6-hour reporting rule for cyber incidents still applies.
Is the 22by7 DPDP readiness assessment a legal audit?
+
No. It reviews the technical security controls the DPDP Rules require, working alongside your legal and privacy teams, who own notice, consent and rights processes.
Who should be involved from our side?
+
Usually your CISO or IT head, the owners of key applications that hold personal data, and your DPO or compliance lead.
Do we need to replace our existing security tools?
+
Not necessarily. The assessment starts from what you already run, and the roadmap shows where existing tools can close a gap before anything new is added.