Implement reasonable security safeguards and notify breaches

Practical action

Extend incident response to cover AI training data and model outputs that reveal personal data.

Who does it apply to?

All Data Fiduciaries.

Actors

Provider / developerDeployer / user organisation

Sectors

Cross-sector / all sectors

Use cases

AI in healthcareGenerative AI and foundation models

Which controls meet this duty?

Satisfies: the control, operated properly, does the work the duty asks for. Supports: it contributes but the duty needs more. Each control page lists every other duty it serves, so work done once can be counted once.

• satisfiesProcessIncident coordinator · continuous
  AI incident management and regulatory reporting

  Serves 14 recorded duties · evidence: AI incident response playbook, AI incident record, Incident report to an authority

  Breach notification to the Board and individuals within the incident process.

• supportsTechnical measureQuality or testing lead · at launch and on material change
  Accuracy, robustness, fairness and security testing

  Serves 15 recorded duties · evidence: Pre-release test report, Test plan and acceptance criteria, Release test sign-off

  Reasonable security safeguards evidenced by testing.

• supportsProcessData protection officer · once per ai system
  Privacy and data-protection controls for AI

  Serves 13 recorded duties · evidence: Data protection impact assessment for an AI system, AI data-flow and legal-basis record, Privacy notice section on AI use

  Breach handling extended to model outputs and training data.

Templates that cover this duty

Generated from the records. Free · no account · links emailed to your work address. This duty is cited in each file with its source reference and a link back here.

• AI Incident Response Playbook and Log

  Procedure · DOCX and XLSX · v3

• AI Post-Market Monitoring Plan

  Procedure · DOCX and XLSX · v2

• Frontier AI Safety Framework and Transparency Report

  Kit · DOCX and XLSX · v3

What evidence would a reviewer expect?

Framework mappings

Original editorial crosswalks. They cite clause numbers only and reproduce no standard text; confidence reflects how direct the mapping is.

See every India duty mapped this way →

Frequently asked questions

Cite this record

AIPolicyTracker (2026). “Implement reasonable security safeguards and notify breaches (India DPDP Act)” [AIPT-OBL-0050, verified 26 September 2026 by Bhaskar Bhatt]. https://aipolicytracker.org/id/AIPT-OBL-0050 (accessed 27 October 2026). Data licensed CC BY 4.0.

Permanent id AIPT-OBL-0050: it never changes or gets reused, and its address keeps working if this page moves.

Cite the official text alongside it: Data Protection Framework — Digital Personal Data Protection Act, 2023, Ministry of Electronics and Information Technology, Government of India, https://www.meity.gov.in/data-protection-framework.

@misc{aipolicytracker2026_implementreasonablesecur,
  author       = {{AIPolicyTracker}},
  title        = {{Implement reasonable security safeguards and notify breaches (India DPDP Act)}},
  year         = {2026},
  howpublished = {\url{https://aipolicytracker.org/obligations/india-dpdp-security-and-breach-notification}},
  url          = {https://aipolicytracker.org/obligations/india-dpdp-security-and-breach-notification},
  urldate      = {2026-10-27},
  note         = {Data licensed CC BY 4.0. Accessed 27 October 2026}
}

Change history

Similar obligations in other instruments

• Report serious incidents to market surveillance authorities — EU AI Act, European Union
• Providers must take corrective action and inform the supply chain about non-conforming high-risk AI — EU AI Act, European Union
• Providers of systemic-risk GPAI models must track and report serious incidents to the AI Office — EU AI Act, European Union
• Report critical safety incidents to the Office of Emergency Services — California SB 53, California (United States)
• Developers must notify the Attorney General and deployers of discovered algorithmic discrimination — Colorado AI Act, Colorado (United States)
• Deployers must notify the Attorney General of discovered algorithmic discrimination — Colorado AI Act, Colorado (United States)