DPDP Rules network security: preparing your network for May 2027
For DPDP Rules network security, the text that matters is Rule 6 of the Digital Personal Data Protection Rules, 2025. It sets the minimum "reasonable security safeguards": encryption or masking, access control, logs and monitoring, backups for continuity, one year of log retention, safeguard clauses in processor contracts, and technical and organisational measures. Rule 6, and the 72-hour breach report in Rule 7, come into force eighteen months after the Rules were published on 13 November 2025, which is mid-May 2027. Failing to take reasonable safeguards can draw a penalty of up to ₹250 crore under the DPDP Act.
Key facts
| Instrument | Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), dated 13 November 2025 (MeitY gazette PDF) |
| Act commencement | G.S.R. 843(E), 13 November 2025 (MeitY gazette PDF) |
| In force now | Rules 1, 2 and 17–21 (Data Protection Board), from publication |
| November 2026 | Rule 4 (consent managers), one year after publication |
| May 2027 | Rules 3, 5–16, 22 and 23, including notice, security safeguards (Rule 6), breach intimation (Rule 7) and log retention (Rule 8(3)), eighteen months after publication |
| Breach report to the Board | Without delay, then a detailed report within 72 hours of becoming aware (Rule 7(2)) |
| Log retention | At least one year (Rule 6(1)(e) and Rule 8(3)) |
| Maximum penalties | Up to ₹250 crore for failing to take reasonable security safeguards; up to ₹200 crore for failing to notify a breach (DPDP Act, Schedule) |
Phase-in dates, and the 13 or 14 May question
Rule 1 of the notified Rules sets three stages. Rules 1, 2 and 17 to 21 came into force on publication. Rule 4 comes into force "one year after the date of publication". Rules 3, 5 to 16, 22 and 23 come into force "eighteen months after the date of publication". The notification is dated 13 November 2025, which puts the main date at 13 May 2027. The gazette copy was digitally signed on 14 November 2025, and some firms count from that day. The safe plan is to be ready well before 13 May 2027, and to let your counsel fix the exact day.
Section 8(5) of the DPDP Act already says a Data Fiduciary must protect personal data "by taking reasonable security safeguards to prevent personal data breach". Rule 6 turns that into a minimum list. That list is what your network team will be asked to evidence.
Rule 6 safeguards mapped to network controls
Rule 6(1) says the safeguards "shall include, at the minimum" the seven items below. The wording in the second column is quoted or closely paraphrased from the gazette text.
| Rule 6(1) | What it asks for | Network and security controls that support it | Evidence to keep |
|---|---|---|---|
| (a) | Securing personal data "through encryption, obfuscation, masking or the use of virtual tokens" | IPsec on every WAN and branch tunnel; TLS 1.2 or 1.3 on management and apps; no clear-text protocols across sites | Tunnel and cipher inventory; list of exceptions with an end date |
| (b) | "Appropriate measures to control access to the computer resources" | ZTNA per application instead of network VPN; MFA; RADIUS or TACACS+ for device admins; segmentation of POS, CCTV, guest and vendor traffic | Access policies; admin account list; segmentation diagram |
| (c) | "Visibility on the accessing of such personal data, through appropriate logs, monitoring and review" | Central logging from firewalls, SD-WAN, SSE and VPN into your SIEM; alarms on unusual access | Log source list; monitoring runbook; review records |
| (d) | "Continued processing" after a compromise, "such as by way of data-backups" | Dual-link or dual-SIM WAN; controller HA in DC and DR; configuration backups and rollback | DR test reports; backup restore tests |
| (e) | Retain "such logs and personal data for a period of one year", unless another law requires otherwise | Log storage sized for at least 12 months; retention settings on every platform | Retention settings screenshot; storage capacity plan |
| (f) | Safeguard clauses in contracts with Data Processors | Security schedules in contracts with managed network, SSE, cloud and NOC providers | Signed contracts; processor list |
| (g) | "Appropriate technical and organisational measures to ensure effective observance" | Change control, configuration review, vulnerability management, staff roles | Policies; audit reports |
Two points are easy to miss. First, Rule 6 covers processing "undertaken by it or on its behalf by a Data Processor". If a managed service provider runs your network, or a cloud security service inspects traffic that contains personal data, their safeguards are part of yours. Second, logs themselves often contain personal data, such as usernames, IP addresses and device identifiers, so protect and control access to the log store too.
Breach reporting: 72 hours to the Board, 6 hours to CERT-In
Rule 7 has two tracks. Each affected Data Principal must be told "without delay", in plain language, what happened and what they can do. The Data Protection Board must get a first intimation "without delay", then, "within seventy-two hours of becoming aware of the breach", a detailed report covering the facts, the cause, mitigation, any findings about who caused it, remedial steps and the notices sent to individuals. The Board can allow longer on a written request.
This sits alongside shorter clocks you may already run:
| Obligation | Clock | Who |
|---|---|---|
| CERT-In Directions, 28 April 2022 | Report cyber incidents within 6 hours of noticing them (CERT-In) | Service providers, intermediaries, data centres, body corporates and government organisations |
| RBI Directions, 31 July 2026 | Report on DAKSH within 6 hours of detection (our summary) | Regulated entities such as banks |
| DPDP Rules, Rule 7(2) | Intimation without delay; detailed report within 72 hours | Every Data Fiduciary, from May 2027 |
For the network team, the practical work is the same for all three: alarms that reach the SOC quickly, logs that show what was accessed, and a timeline you can reconstruct.
Logs: one year under DPDP, 180 days under CERT-In
The Rules add a one-year log duty in two places. Rule 6(1)(e) asks you to retain logs and personal data for one year to detect, investigate and recover from unauthorised access. Rule 8(3) asks you to keep personal data, "associated traffic data and other logs of the processing for a minimum period of one year from the date of such processing", including logs held by your Data Processors.
CERT-In's 2022 Directions separately require ICT system logs for a rolling 180 days within India. Plan storage for the longer of the two, at least one year, and keep the CERT-In copy in India.
Cross-border transfer: allowed by default
The DPDP Rules do not require all personal data to stay in India. Rule 15 allows transfer outside India, subject to any requirements the Central Government sets by order for making data available to a foreign state or its agencies. The narrower exception is Rule 13(4): a Significant Data Fiduciary must ensure that personal data specified by the government, on a committee's recommendation, and its traffic data, are not transferred outside India.
Other rules may still keep your data or logs in India. CERT-In's logs must be kept within India, and RBI requires payment system data to be stored only in India (RBI FAQ). Check each obligation separately rather than assuming DPDP requires localisation.
A network checklist before May 2027
- Map where personal data crosses the network. Branch-to-DC flows, SaaS, POS and payment links, CCTV, guest Wi-Fi and remote users.
- Close clear-text paths. Encrypt every site-to-site and remote-access path, and list any exceptions with a retirement date (Rule 6(1)(a)).
- Replace broad VPN access with per-application access. Add MFA for admins and remote users (Rule 6(1)(b)).
- Segment. Separate POS, CCTV, guest, vendor and corporate traffic so a breach in one zone does not expose the others.
- Centralise logs. Send firewall, SD-WAN, SSE and VPN logs to one store and set retention to at least one year (Rule 6(1)(c) and (e), Rule 8(3)).
- Test continuity. Prove failover of links, controllers and backups at least once before May 2027 (Rule 6(1)(d)).
- Fix processor contracts. Add security schedules and one-year log retention to contracts with managed network, NOC, SSE and cloud providers (Rule 6(1)(f), Rule 8(3)).
- Rehearse a breach. Time a tabletop exercise from alarm to a CERT-In report in 6 hours and a Board report in 72 hours (Rule 7).
- Write it down. Keep policies, diagrams, settings and test results as evidence of "technical and organisational measures" (Rule 6(1)(g)).
Where Nexapp fits
No vendor can make you "DPDP compliant"; the duties sit with the Data Fiduciary. Nexapp's platform helps you meet the network parts of Rule 6:
- Encryption: IPsec IKEv2 on every SD-WAN and Instaroute tunnel, with hybrid post-quantum key exchange (ML-KEM, NIST FIPS 203) and post-quantum TLS 1.3 on consoles and APIs. See post-quantum cryptography.
- Access control: Nexapp SSE/ZTNA grants per-application access by identity and device posture, with passkey sign-in, DLP and CASB. See secure remote access.
- Segmentation: VRF and a zone firewall on SD-WAN edges, plus NGFW IPS, antivirus and web filtering.
- Logs: access, activity, device, firmware and audit logs with configurable retention, which you can set to a year or more, exported by syslog to your SIEM. Nexapp-hosted in India or self-hosted in your data centre.
- Continuity: dual-SIM and multi-link failover, device HA (VRRP), controller HA and DC–DR replication.
For certifications and data residency, see the Trust page. For store networks with POS and guest Wi-Fi, see Retail.
Sources
Frequently asked questions
When do the DPDP security safeguards apply?
Rule 6 comes into force eighteen months after the Rules were published.
The notification is dated 13 November 2025, so the date is 13 May 2027; some advisers count from 14 November. Plan to be ready before then.
What are "reasonable security safeguards" under the DPDP Rules?
Rule 6(1) lists the minimum: encryption, obfuscation, masking or tokens; access control; logs, monitoring and review; continuity measures such as backups; one-year log retention; safeguard clauses in processor contracts; and technical and organisational measures to make them work.
How long must logs be kept under the DPDP Rules?
At least one year, under Rule 6(1)(e) and Rule 8(3), unless another law requires longer.
CERT-In separately requires 180 days of ICT logs within India, so one year covers both if the logs are kept in India.
How fast must a data breach be reported?
To the Data Protection Board, a first intimation without delay and a detailed report within 72 hours of becoming aware.
Affected individuals must be told without delay. CERT-In's 6-hour reporting still applies to cyber incidents.
Does DPDP require data to stay in India?
No. Rule 15 allows transfers abroad, subject to any restrictions the government sets.
Significant Data Fiduciaries may have to keep government-specified data in India under Rule 13(4). Other rules, such as CERT-In's log rule and RBI's payment data rule, have their own India requirements.
What is the maximum DPDP penalty for weak security?
Up to ₹250 crore for failing to take reasonable security safeguards to prevent a personal data breach, and up to ₹200 crore for failing to notify the Board or affected individuals, under the Schedule to the DPDP Act.
Is our network provider a Data Processor?
If it processes personal data on your behalf, for example by operating your network, hosting your logs or inspecting traffic, it may be.
Rule 6(1)(f) then requires safeguard clauses in your contract. Confirm each case with counsel.
Mapping your network to Rule 6 before May 2027? Walk through it with a Nexapp architect.
24×7 NOC in Pune · 75,000+ devices deployed · 400+ enterprise and banking customers since 2014.