Definition
Security controls refer to the rules, technologies, and procedures an organisation uses to prevent security threats and safeguard information from being accessed by unauthorized entities.
They are the controls built into an organisation’s systems and daily operations which determine who can access information, what actions each user can perform and how unusual or potentially harmful activity is handled.
Under Section 8(5) of India’s Digital Personal Data Protection (DPDP) Act, 2023, a Data Fiduciary must take reasonable steps to protect personal data from security breaches.
Regularly testing and updating security measures helps keep them effective against new threats and changing business needs.
Security Controls Required Under the DPDP Rules
Rule 6 of the DPDP Act sets out the minimum security safeguards that Data Fiduciaries must implement to protect personal data. The required safeguards include:
- Securing personal data through encryption, obfuscation, masking or virtual tokens mapped to it.
- Controlling access to the computer resources used by the Data Fiduciary or its Data Processor.
- Keeping logs and monitoring access to personal data, to detect unauthorised access, investigate it and prevent recurrence.
- Having reasonable measures, such as data backups, for continued processing if personal data is compromised.
- Retaining logs and personal data for one year, unless any law in force requires otherwise.
- Including security safeguards in the contract with the Data Processor, wherever applicable.
- Having technical and organisational measures to ensure the safeguards are effectively observed.
Frequently asked questions
What does the DPDP Act define as reasonable security protections?
Reasonable security protections refer to the use of encryption, data masking, access controls, monitoring for activity and creation of backups in order to provide protection from breaches of personal data.
Are companies required to record who accesses personal data?
Yes. The DPDP Rules mandate that companies maintain specific records to trace unauthorized access and therefore require records to be maintained for at least one year.
Are Data Fiduciaries accountable for security practices of the vendors they hire?
Yes. Data Fiduciaries have to ensure that their vendors protect personal data properly.
What should a Data Fiduciary do should their security measures fail?
The Data Fiduciary has to inform the Data Protection Board regarding the breach and the data subjects. If the protection is not adequate, it may incur penalties as high as ₹250 crore.
