Security Safeguards under the DPDP Act

The Digital Personal Data Protection Act, 2023 requires organisations that determine why and how personal data is processed, called Data Fiduciaries, to take reasonable steps to keep that data secure. Under Section 8(5), a Data Fiduciary must protect personal data in its possession or under its control by taking reasonable security safeguards to prevent a personal data breach.

Scope of the security duty

The duty covers personal data held or controlled by the Data Fiduciary, including processing undertaken on its behalf by a Data Processor. Outsourcing processing therefore does not remove the fiduciary's security responsibility.

• The statutory objective is to prevent a personal data breach, rather than merely respond after one occurs.
• A breach includes unauthorised processing or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access that compromises the confidentiality, integrity or availability of personal data.
• Section 8(5) requires reasonable safeguards; it does not express the duty as an absolute guarantee that no breach will ever occur.

Implementation and responsibility

The security obligation operates alongside the fiduciary's broader duty under Section 8(4) to implement appropriate technical and organisational measures to ensure effective observance of the Act.

• Under Section 8(1), the fiduciary remains responsible for compliance concerning processing undertaken by it or on its behalf, irrespective of any agreement to the contrary or a Data Principal's failure to perform statutory duties.
• Under Section 8(2), a fiduciary may engage a processor for activities related to offering goods or services to Data Principals only under a valid contract.
• A processing contract does not replace the fiduciary's own statutory obligation to ensure reasonable security safeguards.

Breach reporting and consequences

Prevention and reporting are separate obligations. Under Section 8(6), a personal data breach must be intimated to the Data Protection Board of India and each affected Data Principal in the prescribed form and manner.

• The Act's Schedule provides a monetary penalty of up to ₹250 crore for breach of the Section 8(5) obligation to take reasonable security safeguards.
• This is a maximum penalty, not an automatic amount payable whenever a breach occurs.