Reasonable security safeguards
Implement appropriate technical and organisational measures, and reasonable security safeguards to prevent a personal data breach. Failure here carries the highest penalty in the Schedule.
Section 8(4)–(5)DPDP Act, 2023Data FiduciaryData ProcessorUp to ₹250 Cr
What this requires
Implement appropriate technical and organisational measures, and reasonable security safeguards to prevent a personal data breach. Failure here carries the highest penalty in the Schedule.
Up to ₹250 crore for failure to take reasonable security safeguards.
Evidence a regulator would accept
- Security controls assessment
- Encryption and access control configuration
- Monitoring and log retention evidence
How this product discharges it
assessment (primary)dlpaccess assurancedamgatewayai guard
Our position
Changing this recalculates the readiness score immediately.
- Current
- Partially compliant
- Residual risk
- Medium
- Owner
- Priya Nair
- Last reviewed
- 27 Jun 2026
- Next review due
- 11 Oct 2026
Open gaps (5)
Gaps raised against this obligation. Closing one moves this clause forward.
- CriticalUnencrypted personal data columns in three legacy databasesGAP-2026-0212 · Naveen Kulkarni · open
- HighEntitlement certification incomplete for the current quarterGAP-2026-0215 · Meera Iyer · in remediation
- HighBackup restore not tested for the Health Card RegistryGAP-2026-0218 · Sanjay Chauhan · remediated
- MediumTwo directorates below 60% on mandatory security trainingGAP-2026-0220 · Ananya Reddy · verified
- HighShadow AI usage detected across 6 unsanctioned servicesGAP-2026-0231 · Vikram Saxena · in remediation
Evidence (2)
Documents indexed against this obligation in the evidence vault.
History
- Clause status updated following remediationyesterday06 Aug 2026, 00:30Deepika Joshi
- Clause status updated following remediation4 days ago03 Aug 2026, 17:30Rohit Verma
- Clause status updated following remediation6 days ago01 Aug 2026, 10:30Naveen Kulkarni
- Clause status updated following remediation8 days ago30 Jul 2026, 06:30Vikram Saxena
- Clause status updated following remediation10 days ago28 Jul 2026, 00:30Imran Sethi
- Clause status updated following remediation13 days ago25 Jul 2026, 16:30System
- Position reviewed and recordedlast month27 Jun 2026, 11:55Priya Nair
Related obligations
- S.4Grounds for processing personal dataPartially compliant
- S.7Certain legitimate usesCompliant
- S.17ExemptionsNot applicable
- R.5Processing for State subsidy, benefit, service, certificate, licence or permitCompliant
- R.6Reasonable security safeguardsPartially compliant
- R.15Research, archiving and statistical purposesNot applicable