Role guide
Security teams
Security carries the safeguards and the breach response. The Act places the duties on the organisation, but the first hours of a breach usually live entirely inside your function.
What does the DPDP framework mean for Security teams?
The first hours of a breach live inside security, so detection, containment and the path for reporting to the Board and each affected Data Principal are your work to design now, ahead of section 8(6) and Rule 7 commencing on 13 May 2027 (computed date, interpretation until officially confirmed). Reasonable safeguards and log retention come next, then vendor security terms.
How to read this page. The obligations belong to your organisation, not to a role or a sector. Everything here is practical emphasis: which official duties this audience usually leads or feeds into, with links to the official text. Finishing one function's work never makes the company compliant by itself.
Work your function usually leads
Reasonable security safeguardsRule 6, official text →
The listed minimums read like a security control catalogue: encryption or masking, access control, logs and monitoring, backups, 1 year log and data retention, contract terms and organisational measures.
Breach response executionRule 7, official text →
Awareness, containment, the without delay intimations and the 72 hour detailed Board submission are driven by security.
Work your function usually feeds into
Vendor security termsRule 6, official text →
The safeguards extend to processing done on your behalf, which makes processor contracts a security review item.
Log and data retentionRule 8, official text →
The 1 year retention of logs and associated data is operated jointly with engineering.
Tools for this role
Tool
Data Breach Response Playbook
Rule 7 is not in force yet, so plan its breach steps now, including the detailed submission to the Board within 72 hours unless it allows longer on a written request, against the exact requirements.
Open
Tool
Vendor and Processor Checklist
Identify DPDP relevant actions for your vendors and Data Processors.
Open