Section 8(5): Mandatory Reasonable Security Safeguards & ₹250 Cr Fine

Statutory Text (Official Gazette)

Section 8(5): A Data Fiduciary shall protect personal data in its possession or under its control, including in respect of any processing undertaken by it or on its behalf by a Data Processor, by taking reasonable security safeguards to prevent personal data breach.

What Section 8(5) Means in Plain English

Section 8(5) carries the highest penalty in the DPDP Act: up to ₹250 Crore for failing to protect customer data from security breaches.

The law holds your company responsible not just for data in your direct database, but also for data handled on your behalf by third-party processors (cloud servers, payment gateways, marketing tools).

Operational Standards Under DPDP Rule 6

Rule 6 of the DPDP Rules 2025 (in force from May 13, 2027) lists the minimum “reasonable security safeguards”:

1. Data Security Measures: Protect personal data through encryption, obfuscation, masking or virtual tokens mapped to the data. Rule 6 names no specific standard; TLS 1.3 in transit and AES-256 at rest are sensible defaults.
2. Access Control: Appropriate measures to control access to the computer resources you or your processors use. RBAC and MFA are common ways to meet this.
3. Logging and Monitoring: Visibility into who accessed personal data, through logs, monitoring and review, so unauthorised access can be detected, investigated and fixed.
4. One-Year Retention: Keep those logs and the personal data for one year for detection, investigation and continuity, unless another law requires otherwise.
5. Backups and Continuity: Reasonable measures, such as backups, to keep processing going if data is lost or compromised.
6. Processor Contracts: Contracts with Data Processors must require reasonable security safeguards.
7. Organisational Measures: Appropriate technical and organisational measures to make sure safeguards actually work. Regular penetration testing and security reviews are good ways to show this.

What Triggers a Section 8(5) Penalty?

• Storing user passwords or API keys in plaintext.
• Leaving AWS S3 buckets or database ports publicly open to the internet.
• Failing to revoke credentials of former employees or contractors.
• Lack of audit logs showing who accessed or exfiltrated customer records.

← Back to Full Section 8: General Obligations