Skip to main content

The 3rd and main DPDP commencement date is computed as 13 May 2027, which is interpretation until officially confirmed.

dpdprules.org
Data breached?
☰

Sources last verified on 28 October 2026. Methodology

DPDP Rules 2025 · Rule 6

Reasonable security safeguards

Status
Not yet in force
Commencement
13 May 2027 · computed date, presented as interpretation until officially confirmed (how it is computed)
Source
Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) · G.S.R. 846(E) · Gazette page 26
Last verified
16 August 2026

What Rule 6 says, in plain English

Plain English

Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed. The summary below is what the provision says, not what is in force today. Status last checked 29 October 2026 against the MeitY library and India Code.

Reasonable security safeguards are required from every Data Fiduciary to prevent a personal data breach, covering encryption or masking, access controls, logs and monitoring to detect unauthorised access, backups for continuity, retention of relevant logs and data for 1 year unless law requires otherwise, contractual safeguards with any Data Processor, and technical and organisational measures.

How 13 May 2027 is computed, and why it could be 1 day later

Publication date 13 November 2025 printed on Gazette issue No. 760, plus eighteen months. Rule 1(4) states a period rather than a calendar date and does not state how the period is counted. The eGazette portal lists this document with a code embedding 14112025 and the Government's own PIB release states 14 November 2025, which would move the computed date by 1 day. Taken with the unstated counting, the 2 uncertainties together could move it by up to 2 days, to 15 May 2027 at the latest; the printed masthead date is used, and the interpretation label carries both uncertainties. The corrigendum wording change does not affect this computation. A MeitY press release of 16 May 2026 (PRID 2261823) reports the Secretary, MeitY, as noting that the Act becomes fully enforceable from 13 May 2027; it is reported speech in a press release and not an instrument, so it corroborates this computation and does not confirm it, and the date basis stays derived.

Official text of Rule 6

Official requirement · verbatim

Rule 6. Reasonable security safeguards.(1) A Data Fiduciary shall protect personal data in its possession or under its control, including in respect of any processing undertaken by it or on its behalf by a Data Processor, by taking reasonable security safeguards to prevent personal data breach, which shall include, at the minimum, — (a) appropriate data security measures, such as securing of personal data through encryption, obfuscation, masking or the use of virtual tokens mapped to that personal data; (b) appropriate measures to control access to the computer resources used by such Data Fiduciary or such a Data Processor, wherever applicable; (c) visibility on the accessing of such personal data, through appropriate logs, monitoring and review, for enabling detection of unauthorised access, its investigation and remediation to prevent recurrence; (d) reasonable measures for continued processing in the event of confidentiality, integrity or availability of such personal data being compromised as a result of destruction or loss of access to personal data or otherwise, such as by way of data-backups; (e) for enabling the detection of unauthorised access, its investigation, remediation to prevent recurrence and continued processing in the event of such a compromise, retain such logs and personal data for a period of one year, unless compliance with any law for the time being in force requires otherwise; (f) appropriate provision in the contract entered into between such Data Fiduciary and such a Data Processor, wherever applicable, for taking reasonable security safeguards; and (g) appropriate technical and organisational measures to ensure effective observance of security safeguards. (2) In this rule, the expression “computer resource” shall have the same meaning as is assigned to it in Information Technology Act, 2000 (21 of 2000).

Commencement basis · Rules 3, 5 to 16, 22 and 23

“Rules 3, 5 to 16, 22 and 23 shall come into force eighteen months after the date of publication in the Official Gazette.”

Wording as corrected by corrigenda G.S.R. 892(E).

Sources cited on this page

  1. [1]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 6, p. 26. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · Official requirement · Verified 16 August 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  2. [2]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 1, (4), p. 24. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · Printed text, since corrected by G.S.R. 892(E); quoted as published · Verified 16 August 2026In force since 13 November 2025
    Rules 3, 5 to 16, 22 and 23 shall come into force eighteen months after the date of publication of this Gazette.
    As printed. Corrigenda G.S.R. 892(E) item (i)(b) corrects the closing words to read in the Official Gazette; the computation is unaffected.
  3. [3]
    Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E)), p. 1. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · Interpretation, requires judgment · Verified 16 August 2026Document status: published; text subject to corrigendum G.S.R. 892(E)The calendar date 13 May 2027 is computed from the printed publication date and is presented as interpretation until officially confirmed.
  4. [4]
    “National Consultative Workshop on ‘Strengthening Cyber Security Frameworks for State Data’” (Press Information Bureau release, PRID 2261823) (Release ID 2261823), p. 1. Published 16 May 2026. Official source ↗ · An official record, not a legal requirement · Verified 18 October 2026Document status: published official press release of 16 May 2026 on a MeitY workshop of 11 May 2026; it reports the Secretary, MeitY, in reported speech, as noting that the Act becomes fully enforceable from 13 May 2027; a press release and not an instrument, it cites no provision and no publication dateA press release of 16 May 2026 reporting the Secretary, MeitY, in reported speech, as noting that the Act becomes fully enforceable from 13 May 2027: the only official statement this site has located, as at 18 October 2026, that names the date this group computes to. Not an instrument and not a confirmation; the period in Rule 1(4) is what the Rules state.