Security and breaches on a budget

Rule 6 on a small budget

Rule 6 sets the minimum safeguards. You can start on most of them with settings you already have in your email, cloud storage and phones.

Rule 6(1) requires, at the minimum: data security measures such as encryption, obfuscation, masking or virtual tokens (a); access control (b); logs, monitoring and review (c); continuity measures such as backups (d); keeping logs and personal data for one year to detect and investigate unauthorised access (e); security provisions in processor contracts (f); and technical and organisational measures to make all this work (g). Two-factor login is not named in the Rule; it is a common way to control access. The Rules do not define 'reasonable' or name a certification, so these steps are a starting point, not a guarantee.

Habits to start and habits to stop

Everyday habits create much of the risk in a small business. Fixing them costs very little, and it supports the access control that Rule 6 asks for.

None of these habits is named in the law. They are practical ways to meet Rule 6(1)(b) on access control and Rule 6(1)(g) on organisational measures, and the wider duty in s.8(4) to take appropriate technical and organisational measures. A shared password also weakens your logs, because you cannot tell who did what, which matters for Rule 6(1)(c) and for a breach report.

You answer for your vendors

You stay responsible for personal data even when a vendor handles it for you. Use processors only under a valid contract that requires reasonable security safeguards.

Section 8(1) makes the fiduciary responsible for processing done on its behalf 'irrespective of any agreement to the contrary', s.8(2) allows processors only under a valid contract, and s.8(5) extends the security duty to processing by a processor. Rule 6(1)(f) requires appropriate provision for security safeguards in the contract. Breach alerts and deletion clauses are not named in the Rules, but you need them to meet your own duties under s.8(6) and s.8(7)(b). With large vendors you will usually accept standard terms, so read their data processing terms and keep a copy.

Keep it only while you need it

When the purpose is over or consent is withdrawn, erase the data and have your vendors erase it too, unless a law requires you to keep it.

Section 8(7) requires erasure when consent is withdrawn or as soon as it is reasonable to assume the purpose is no longer served, whichever is earlier, unless retention is necessary to comply with a law; you must also cause your processors to erase. The fixed three-year inactivity periods in the Third Schedule apply only to e-commerce and social media platforms with at least two crore registered users in India and online gaming platforms with at least fifty lakh. For everyone else the Rules give no fixed period, so set your own in a simple retention list and note any law that requires longer.

1 year minimum for data and logs

The Rules also set a floor. Keep the data and its logs for at least one year from the date of processing, even if the customer deletes their account.

Rule 8(3) requires retention of personal data, associated traffic data and other logs for a minimum of one year from the date of processing, for the purposes in the Seventh Schedule, and then erasure unless another law or a Government notification requires longer. Its illustrations say an e-book seller must keep order details and logs for a year even if the buyer deletes her account, and that a fiduciary must ensure its cloud provider does the same. Beyond those illustrations, the Rules do not explain how this floor fits with erasure on withdrawal under s.8(7); a cautious reading is to stop using the data and hold it in a restricted archive until the year ends.

A breach is more than hacking

A personal data breach is any unauthorised processing, or accidental disclosure, alteration, loss or destruction, that compromises confidentiality, integrity or availability.

The definition in s.2(u) covers unauthorised processing and accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access. So it reaches exposure (confidentiality), unwanted changes (integrity) and being locked out (availability). Whether a particular incident, such as a lost but encrypted laptop, compromises the data depends on the facts; the Act gives no worked examples.

Two reports for every breach

There is no minor-breach exception. Tell each affected person without delay, tell the Board without delay, and send the Board a detailed report within 72 hours of becoming aware.

Section 8(6) requires intimation to the Board and each affected person 'in the event of a personal data breach', with no size or risk threshold. Under Rule 7(1) the message to people must be concise, clear and plain, sent through their user account or registered contact, and cover what happened, the likely consequences, what you are doing, safety steps they can take, and a contact. Under Rule 7(2)(b) the 72-hour report adds the facts and reasons, mitigation, findings on who caused it, steps to prevent recurrence and a report on the intimations given. The Board may allow more time on a written request. Not intimating can cost up to ₹200 crore.

A simple breach drill

Practise this once on a quiet afternoon. Pretend a staff laptop is lost, and time how long it takes to work out whose data was on it.

The drill itself is not a legal requirement. It prepares you for Rule 7, where the 72 hours run from becoming aware of the breach. Draft the two messages in advance, one for affected people and one for the Board, and keep them with the contact list. How quickly and effectively you act to limit the harm is a factor when the Board sets a penalty (s.33(2)(e)). Other laws or regulators may have their own incident reporting duties; they are outside this guide.

In one line

Next, a thirty-day plan that puts all of this in order.