Guides ·
DPDP Rules 2025 on AWS: one-year logs, security safeguards and 72-hour breach reports
DPDP Rules 6 and 7 apply from 13 May 2027. Here is what they require for security safeguards, one-year log retention and breach reports, and how each clause maps to AWS.
By Upvantix team
India's Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025 (G.S.R. 846(E)). Most of them, including Rule 6 (reasonable security safeguards) and Rule 7 (intimation of personal data breach), come into force eighteen months after publication: 13 May 2027. The Consent Manager rule (Rule 4) starts earlier, one year after publication: 13 November 2026.
Rule 6 sets a minimum: encrypt, obfuscate, mask or tokenise personal data; control access to the systems that hold it; keep logs and monitoring that let you detect, investigate and fix unauthorised access; keep backups so processing can continue after a compromise; retain those logs and personal data for one year unless another law requires otherwise; and put security obligations in your contracts with Data Processors, such as your cloud and SaaS providers.
Rule 7 says that when you become aware of a breach you must tell each affected person without delay, and tell the Data Protection Board twice: a first description without delay, then a detailed report within 72 hours (or a longer period the Board allows on written request).
On AWS, these map to services you already have: AWS KMS and service-side encryption, IAM and AWS IAM Identity Center, CloudTrail trails and CloudWatch Logs with one-year-plus retention, S3 Object Lock for tamper-resistant log storage, Amazon GuardDuty and AWS Security Hub for detection, Amazon Macie to find personal data, and AWS Backup. AWS gives you the tools. You, as the Data Fiduciary, remain responsible for configuring them and for the evidence.
This page is general information, not legal advice. Confirm your obligations with qualified counsel.
The dates that matter (and the one that doesn't change anything)
On 5 October 2026 MeitY issued the DPDP (Removal of Difficulties) Order, 2026, S.O. 5458(E), published in the Gazette on 6 October 2026. It fixes two pieces of wording in the Act: section 9(1) now reads "child or of a person with disability", and section 10(2)(c)(ii) now says "data audit" instead of "audit". It adds no new duty and does not change any commencement date. It does not touch Rule 6 or Rule 7.
| Criterion | What happens | Source |
|---|---|---|
| 13 Nov 2025 | DPDP Rules, 2025 notified. Rules 1, 2 and 17–21 (definitions and the Data Protection Board's constitution and working) in force. | G.S.R. 846(E), Rule 1(2) |
| 13 Nov 2026 | Rule 4 (Consent Manager registration and obligations) in force. | Rule 1(3) |
| 13 May 2027 | Rules 3, 5–16, 22 and 23 in force, including Rule 6 (security) and Rule 7 (breach intimation). | Rule 1(4) |
What Rule 6 requires, clause by clause, and how to do it on AWS
Rule 6(1) applies to personal data in a Data Fiduciary's possession or under its control, including processing undertaken on its behalf by a Data Processor. If your data sits on AWS, the Rule applies to that data.
One year is a minimum here, not a target. Other Indian rules can require more or different retention. For example, CERT-In's April 2022 directions require ICT system logs to be kept for a rolling 180 days within Indian jurisdiction, and sector regulators (RBI, SEBI, IRDAI) set their own. Rule 8(3) also requires keeping personal data, associated traffic data and processing logs for at least one year from the date of processing for the purposes in the Seventh Schedule. Set retention to the longest period that applies, then erase.
| Criterion | AWS controls to consider | Evidence to keep |
|---|---|---|
| (a) Encryption, obfuscation, masking or virtual tokens | AWS KMS customer managed keys for S3, EBS, RDS and DynamoDB; TLS in transit; tokenise or mask in the application or data pipeline | Key policies, encryption-by-default settings, AWS Config rules showing encryption status |
| (b) Control access to computer resources | IAM least privilege, IAM Identity Center with MFA, SCPs in AWS Organizations, IAM Access Analyzer | Access reviews, SCPs, Access Analyzer findings and their closure |
| (c) Logs, monitoring and review to detect, investigate and remediate unauthorised access | Organisation-wide CloudTrail trail (management events, plus data events for buckets and tables holding personal data); VPC Flow Logs; GuardDuty; Security Hub; CloudWatch alarms | Trail configuration, alert runbooks, review records |
| (d) Continued processing after a compromise, e.g. backups | AWS Backup plans with vault lock, cross-Region copies (e.g. Mumbai to Hyderabad), tested restores | Backup policies and restore-test results |
| (e) Retain logs and personal data for one year, unless another law requires otherwise | CloudTrail event history only covers 90 days, so deliver a trail to S3; set CloudWatch Logs retention to at least 365 days; S3 Object Lock and lifecycle rules for log buckets | Retention settings, Object Lock configuration, lifecycle rules |
| (f) Security safeguards in Data Processor contracts | Review AWS's Data Processing Addendum and your SaaS and managed service provider contracts | Signed DPA / contract clauses |
| (g) Technical and organisational measures to ensure the safeguards are actually followed | AWS Config conformance packs, Security Hub standards, periodic internal reviews | Conformance reports, review minutes |
Rule 7: two notices to the Board, one to people affected
This sits alongside CERT-In, not instead of it. CERT-In's April 2022 directions require specified cyber incidents to be reported to CERT-In within 6 hours of noticing them. One incident can trigger both clocks.
On AWS, the 72-hour report depends on what you logged before the breach. Rule 7(2)(b) asks for broad facts and reasons. You can only give those if the trail, data events, flow logs and GuardDuty findings already exist and are retained. Prepare an incident runbook that pulls these together, and rehearse it.
- To each affected Data Principal, without delay (Rule 7(1)): a description of the breach (nature, extent, timing), likely consequences for them, what you are doing to mitigate, what they can do to protect themselves, and a business contact who can answer questions. Send it through their user account or a registered contact channel.
- To the Data Protection Board, without delay (Rule 7(2)(a)): a description of the breach, including its nature, extent, timing, location and likely impact.
- To the Board, within 72 hours of becoming aware (Rule 7(2)(b)), or a longer period the Board allows on written request: updated details; the facts, circumstances and reasons behind the breach; mitigation; any findings about who caused it; remedial measures to prevent recurrence; and a report on the notices given to affected people.
A readiness plan before 13 May 2027
- Map personal data across accounts and Regions (Amazon Macie for S3; data inventories for databases).
- Decide Regions. The DPDP Act does not impose blanket localisation, but sector rules may. Asia Pacific (Mumbai) and Asia Pacific (Hyderabad) are AWS's India Regions.
- Turn on an organisation-wide CloudTrail trail to a dedicated log-archive account, with data events where personal data lives.
- Fix retention: CloudWatch Logs log groups at 365 days or more; S3 log buckets with Object Lock and lifecycle rules.
- Encrypt by default with KMS and check it with AWS Config.
- Tighten access: IAM Identity Center with MFA, least privilege, SCPs.
- Detection: GuardDuty and Security Hub across all accounts and Regions in use.
- Backups: AWS Backup with vault lock and tested restores.
- Breach runbook: who decides, who drafts the Board and Data Principal notices, and how CERT-In's 6-hour report fits in.
- Contracts: confirm security clauses with every Data Processor.
How Upvantix can help
As an AWS Select Tier Services Partner, Upvantix can review your AWS accounts against the technical side of Rules 6 and 7: logging and retention, encryption, access, detection and backups. We can then help you close the gaps. We do not give legal advice or certify DPDP compliance.
DPDP Rules on AWS: FAQ
When do DPDP Rules 6 and 7 apply?
From 13 May 2027, eighteen months after the Rules were published on 13 November 2025.
Does the DPDP Rules' one-year log requirement mean I must keep all logs for exactly one year?
No. Rule 6(1)(e) requires logs and personal data to be retained for one year for detecting and investigating unauthorised access, unless another law requires otherwise. Where another rule requires longer, follow the longer period.
How fast must I report a personal data breach to the Data Protection Board?
Report a description without delay, then a detailed report within 72 hours of becoming aware of the breach. The Board can allow a longer period if you ask in writing.
Do I still need to report to CERT-In?
Yes, where the incident is one CERT-In's 2022 directions cover. CERT-In's deadline is 6 hours, and it runs separately from the DPDP Board notice.
Did the October 2026 Removal of Difficulties Order change the deadlines?
No. S.O. 5458(E) only corrects wording in sections 9(1) and 10(2)(c)(ii) of the Act.
Does using AWS make me DPDP compliant?
No. AWS provides the security services and runs the underlying infrastructure. You, as the Data Fiduciary, must configure the controls, keep the evidence and meet the notice duties.