01. DPDP Act Enforcement Timeline (2025–2027)
The Ministry of Electronics and Information Technology (MeitY) notified the DPDP Rules, 2025 in November 2025 (G.S.R. 846(E)). The implementation operates under a phased transition schedule:
| Effective Date | Commencing Provisions | Operational Requirement |
|---|---|---|
| November 2025 | Rules 1, 2, and 17–21 | Establishment and operationalization of the Data Protection Board of India (DPBI) and adjudication procedures. |
| November 2026 | Rule 4 | Framework for registration and technical operation of interoperable Consent Managers. |
| May 2027 (18 Months) | Rules 3, 5–16, 22–23 | Core compliance enforcement: Rule 6 security safeguards, Rule 7 breach intimation, and Significant Data Fiduciary obligations. |
02. Data Fiduciaries vs. Data Processors
The DPDP Act applies to the processing of digital personal data within the territory of India, and extraterritorially to processing outside India in connection with offering goods or services to Data Principals within India:
Data Fiduciary Responsibility
Any entity determining the purpose and means of processing personal data. The Data Fiduciary retains ultimate legal responsibility for data security, including processing executed by third-party SaaS vendors and sub-processors.
Data Processor Engagement
Entities processing personal data on behalf of a Data Fiduciary under a valid contract. Contracts must mandate that processors implement reasonable security safeguards identical to Rule 6 standards.
03. Section 8(5) & Rule 6 Security Safeguards
Section 8(5) establishes the foundational legal duty: "A Data Fiduciary shall protect personal data in its possession or under its control, including in respect of any processing undertaken by it or on its behalf by a Data Processor, by taking reasonable security safeguards to prevent personal data breach."
Minimum Prescribed Security Safeguards
Rule 6 sets out seven mandatory control objectives that organizations must demonstrate:
- Data Security: Mandatory encryption, obfuscation, masking, or virtual tokenization of sensitive identifiers.
- Access Control: Granular role-based access controls to prevent horizontal privilege escalation between users.
- Access Logging: Comprehensive logging and monitoring to detect unauthorized queries, exfiltration, or tampering.
- Log Retention: Mandatory retention of security access logs for at least one year.
- Disaster Recovery: Resilience and backup controls to maintain data continuity during security incidents.
- Processor Due Diligence: Contractual enforcement of technical safeguards across all third-party APIs.
- Regular Technical Testing: Effective technical and organizational measures to ensure controls operate reliably.
04. Rule 7: 72-Hour Breach Intimation & CERT-In Alerts
When a personal data breach occurs, Indian law imposes aggressive dual reporting timelines:
Immediate Notice + 72-Hour Detailed Dossier
Data Fiduciaries must notify affected Data Principals and the Data Protection Board without delay upon becoming aware of a breach. A detailed formal dossier detailing facts, root cause vulnerabilities, mitigation steps, and remediation evidence must reach the Board within 72 hours.
Mandatory 6-Hour Incident Notification
Under CERT-In's April 2022 cyber directions, cybersecurity incidents (including unauthorized access to IT systems, ransomware, and database leaks) must be formally reported to CERT-In within 6 hours of detection.
05. &rupee;250 Crore Penalties & SDF Periodic Audits
Severe Administrative Fines
Failure to take reasonable security safeguards to prevent a personal data breach carries fines up to &rupee;250 crore (~$30M USD). Failure to notify the Board or affected Data Principals carries penalties up to &rupee;200 crore.
Significant Data Fiduciaries (SDF)
Entities processing high volumes of personal data or posing systemic risks will be designated as SDFs. Under Rule 13, SDFs must conduct annual Data Protection Impact Assessments (DPIAs) and independent periodic cybersecurity audits.
06. Where Penetration Testing Delivers Legal Proof
While the DPDP Act sets legal obligations, independent penetration testing provides the verifiable evidence that safeguards are operational and effective:
Validating Access Control Efficacy (BOLA/IDOR)
Penetration testing systematically validates that authorization checks prevent one user from accessing another user's Aadhaar numbers, phone numbers, or financial details.
Testing Data Processor APIs
Verify that third-party integrations, payment aggregators, and microservices properly enforce encryption and tokenization across transit boundaries.
Deterministic Remediation Proof
When developers patch vulnerabilities, execute automated delta retests to produce verifiable technical proof that flaws were resolved prior to release.
07. How Infiltra Automates DPDP Compliance
On-Demand Autonomous Pentesting
Test web applications, mobile backends, and APIs on demand before production deployment, fulfilling the Section 8(5) reasonable safeguards requirement.
Eliminate False Positives
Infiltra provides deterministic exploit reproduction evidence for every finding, ensuring engineering teams fix real vulnerabilities without wasting hours on scanner noise.
Indian Enterprise Architecture Alignment
Engineered to assess complex Indian digital public infrastructure integrations, including payment gateways, Aadhaar eKYC endpoints, and account aggregator APIs.
DPBI-Ready Attestation Reports
Generate formal executive summaries and technical finding dossiers to evidence technical due diligence during Board inquiries and regulatory audits.
08. Frequently Asked Questions
Clarifications on DPDP Act 2023 technical safeguards, Rule 6 compliance, and penalty mitigation.
Section 8(5) Safeguards
Does the DPDP Act Require Penetration Testing?
Does the DPDP Act Require Penetration Testing?
The Act mandates reasonable security safeguards under Section 8(5), detailed in Rule 6 of the DPDP Rules 2025. While the Act does not mandate a single testing vendor, independent penetration testing is the accepted industry method to prove that access controls, encryption, and authorization logic prevent unauthorized data exposure.
Commencement Timelines
When Do the DPDP Security Obligations Officially Commence?
When Do the DPDP Security Obligations Officially Commence?
Rule 6 on reasonable security safeguards and Rule 7 on personal data breach intimation commence 18 months after notification of the Rules, which is May 2027. Organizations must establish and test their security programs well before this deadline.
Dual Reporting
How Does DPDP Reporting Interact with CERT-In 6-Hour Mandates?
How Does DPDP Reporting Interact with CERT-In 6-Hour Mandates?
Both reporting regimes operate concurrently. If a cyber incident involves a compromise of personal data, organizations must submit an initial report to CERT-In within 6 hours, while notifying affected Data Principals and the Data Protection Board without delay, followed by a formal 72-hour dossier to the DPBI.
Statutory Penalties
What Are the Maximum Penalties Under the DPDP Act?
What Are the Maximum Penalties Under the DPDP Act?
Under the Schedule to the Act, failure to take reasonable security safeguards to prevent a personal data breach carries penalties up to ₹250 crore. Failure to notify the Board or affected Data Principals of a breach carries penalties up to ₹200 crore.