On 13 November 2025, the Government of India notified the Digital Personal Data Protection (DPDP) Rules, 2025. The Rules activate the DPDP Act, 2023 and turn it into an enforceable compliance regime.
The substantive obligations on Data Fiduciaries take effect after an 18-month runway, by 13 May 2027. Most organizations are still mapping what the Rules require of their systems.
Two obligations carry the most risk at the application and API layer. Rule 6 converts the Act’s duty to maintain reasonable security safeguards (Section 8(5)) into a concrete minimum set of technical controls. Section 8(6), read with Rule 7, requires every personal data breach to be reported to the Data Protection Board and to affected individuals.
DPDP compliance runs across three layers. Governance covers consent, notices and rights. The data layer covers retention, erasure and storage. The application and API layer is where personal data is collected, requested and attacked. Rule 6 and Rule 7 apply to this third layer, and so do the two highest penalties under the Act.
This guide covers the key application security requirements under the DPDP Rules, where most organizations are falling short, and how AppTrana WAAP addresses all of it in one platform.
A 60-Second DPDP Check for App and API Security
| Control Area | DPDP Requirement | AppTrana Capability |
| Security Safeguards | Reasonable security safeguards to prevent a personal data breach. Section 8(5), Rule 6. Penalty up to Rs 250 crore. | Inline WAAP in active block mode from request #1. OWASP Top 10 and OWASP API Top 10 coverage with a zero false positive guarantee. |
| AI Systems | Safeguards extends to personal data processed through AI applications. Supports Rule 6. | AppTrana AI Shield secures LLM and copilot endpoints against the OWASP LLM Top 10. |
| Detect and Remediate | Detect and remediate unauthorized access. Rule 6. | Real-time behavioural ML detection. SwyftComply AI applies an expert-verified virtual patch at the edge autonomously. |
| Access Control | Restrict who can reach personal data and at what volume. Rule 6. | Positive security model, granular rate limiting, geo and IP controls, behavioral bot defense. |
| Attack Surface | Know where personal data is exposed. Supports the Rule 6 risk basis. | Continuous discovery of apps, documented APIs, and shadow and zombie APIs, with PII, PCI and PHI classification. |
| Logging and Retention | Logging, monitoring and review, with a one-year minimum log retention. Rule 6. | 365-day log retention within Indian jurisdiction. 24×7 monitoring with SIEM integration. |
| Breach Notification | Notify the Board and affected Data Principals without delay. Detailed report to the Board within 72 hours. Section 8(6), Rule 7. | Real-time incident characterization, attack forensics, and retained payload evidence. |
| Processor Due Diligence | Safeguards must hold across the processing chain. Rule 6 processor contracts. | CERT-In empanelled with named expert ownership and audit-ready zero-vulnerability reports. |
What the DPDP Rules Actually Change
The 2023 Act defined duties and penalties. It did not prescribe how to meet them. For application security teams, the Rules change three things.
| Area | DPDP Act, 2023 | DPDP Rules, 2025 |
| Security Safeguards | “Reasonable security safeguards” left undefined | Rule 6 sets a minimum: access controls, encryption, logging and monitoring, one-year log retention |
| Data Breaches | Reporting required | Rule 7 prescribes content, channels and a 72-hour detailed report to the Board |
| Timelines | Not specified | Substantive duties apply from 13 May 2027, after an 18-month runway |
DPDP Security Requirements in Depth
Requirement 1: Reasonable Security Safeguards (Section 8(5), Rule 6)
Earlier, each organization decided what “reasonable safeguards” meant. Rule 6 removes that discretion. Data Fiduciaries must implement technical controls, document them, review them periodically, and prove them during a Board inquiry. Every web application and API that handles personal data is in scope.
Where most teams fall short: Controls exist on paper. Production tells a different story. A WAF left in monitor mode, or OWASP API Top 10 risks left unaddressed, will not hold up as a reasonable safeguard after a breach. This is the obligation with the highest penalty, up to Rs 250 crore.
Requirement 2: Personal Data in AI Systems (Rule 6)
DPDP makes no exception for AI. Personal data entered into chatbots, copilots and LLM-driven applications is still personal data. Rule 6 safeguards apply to it.
Where most teams fall short: LLM endpoints are deployed outside the usual security review. Prompt injection and jailbreak attacks can expose personal data through an interface that traditional WAF rules do not inspect.
Requirement 3: Detect and Remediate Unauthorized Access (Rule 6)
Detection is half the obligation. Rule 6 also expects remediation. The exposure window between finding a vulnerability and fixing it is where personal data leaks.
Where most teams fall short: Scanners find vulnerabilities in hours. Development teams ship code fixes in weeks or months. Without an interim control at the edge, the vulnerability stays exploitable for the whole release cycle.
Requirement 4: Access Control and Abuse Prevention (Rule 6)
Rule 6 names access controls as part of the minimum safeguard set. At the application layer, this means limiting who can reach personal data endpoints and at what volume.
Where most teams fall short: Identity and database controls are in place. Application-layer abuse is not covered. Credential stuffing, scraping and record enumeration use individually valid requests. Infrastructure rate limits stop volumetric floods and miss this business logic abuse.
Requirement 5: Know the Personal Data Attack Surface (Rule 6 Risk Basis)
You cannot safeguard data flows you do not know exist. A risk-based approach under Rule 6 starts with an inventory of every internet-facing app and API that touches personal data.
Where most teams fall short: Shadow and zombie APIs are the most consistent finding in application security audits. Undocumented endpoints often return PII, PCI or PHI data with no protection in front of them.
Requirement 6: Logging, Monitoring and One-Year Retention (Rule 6)
Rule 6 requires logs that allow detection and remediation of unauthorized access, retained for at least one year. Monitoring must be continuous, and logs must be reviewed.
Where most teams fall short: Default retention is 30 or 90 days. Teams discover the gap during an incident, when the evidence needed to reconstruct the attack is already gone. Logs stored outside India can also raise questions during a Board inquiry.
Requirement 7: Breach Notification and the 72-Hour Report (Section 8(6), Rule 7)
Rule 7 defines the “prescribed manner” for breach reporting. Data Fiduciaries must inform affected Data Principals and the Board without delay. A detailed report to the Board follows within 72 hours. It covers the facts, the likely impact, mitigation steps, and the findings on the person responsible. The penalty for failure to notify is up to Rs 200 crore.
Where most teams fall short: The 72-hour clock starts when you become aware of the breach. Teams without real-time detection and payload-level logs spend that window working out what happened. They have no time left to report it accurately.
Requirement 8: Safeguards Across the Processing Chain (Rule 6 Processor Contracts)
Rule 6 requires Data Fiduciaries to ensure that processors apply equivalent safeguards, set through contract. Accountability stays with the Data Fiduciary.
Where most teams fall short: Vendor due diligence relies on questionnaires. Few teams hold documented, auditable evidence of the security controls protecting each processor’s applications.
Penalties for Non-Compliance
The two highest penalties under the Act map to the two obligations where the application layer carries the risk.
| Violation | Max Penalty |
| Failure to take reasonable security safeguards (Sec 8(5)) | Rs 250 crore |
| Failure to notify a personal data breach (Sec 8(6)) | Rs 200 crore |
| Violation of children’s data obligations (Sec 9) | Rs 200 crore |
| Breach of additional obligations by a Significant Data Fiduciary (Sec 10) | Rs 150 crore |
| Other violations of the Act or Rules | Rs 50 crore |
| Breach of duties by a Data Principal (Sec 15) | Rs 10,000 |
The Data Protection Board decides the amount per instance, based on the nature, gravity and duration of the breach.
Where AppTrana Maps to DPDP Obligations
AppTrana provides a single platform to address the application, API and AI security obligations under DPDP Rule 6 and Section 8(6).
Reasonable Security Safeguards: WAAP is deployed inline in active block mode from request #1. It protects every web app and API that handles personal data. OWASP Top 10 and OWASP API Top 10 coverage with a zero false positive guarantee closes injection, exfiltration and account takeover paths before data is exposed. This supports Section 8(5) and Rule 6.
AI Systems: AppTrana AI Shield secures LLM and copilot endpoints against the OWASP LLM Top 10. It covers prompt injection, jailbreak and data exposure through AI endpoints in chatbots, copilots and AI-driven applications.
Detect and Remediate: Behavioral ML detects attacks in real time. On confirmation, SwyftComply AI applies an autonomous virtual patch at the edge within hours. The exposure window closes with no dependency on the code release cycle.
Access Control and Abuse Prevention: A positive security model, granular rate limiting, geo and IP controls, and behavioral bot defense restrict who can reach personal data endpoints and at what volume. These controls complement identity and database access controls under Rule 6.
Attack Surface Discovery: Continuous discovery covers internet-facing apps, documented APIs, and shadow and zombie APIs. PII, PCI and PHI exposure classification surfaces undocumented flows of personal data so they can be protected.
Logging, Monitoring and Retention: AppTrana retains logs for 365 days within Indian jurisdiction, meeting the Rule 6 one-year minimum. 24×7 monitoring with real-time anomaly detection and SIEM integration feeds full-payload logs into your security operations.
Breach Notification: Real-time incident characterization and attack forensics, with retained payload evidence, give security teams the working space to notify the Board and affected Data Principals within the Rule 7 window.
Processor Due Diligence: AppTrana is CERT-In empanelled, with expert-backed operations built in and named expert ownership. Audit-ready zero-vulnerability reports give organizations documented evidence of safeguards across the processing chain.
The 18-Month Clock Is Already Running
The DPDP Rules make reasonable safeguards measurable and breach reporting time-bound. From 13 May 2027, the Data Protection Board can investigate, audit and penalize against both. Organizations that close application-layer gaps now will have a year of logs and a documented control trail when the first inquiry arrives.
Your DPDP readiness review starts today. Start a free trial with AppTrana and close application security gaps before the May 2027 deadline.