# Implement reasonable security safeguards and notify breaches

- **Record type**: Obligation
- **Instrument**: Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025
- **Jurisdiction**: India
- **Category**: incident_handling
- **Binding**: Yes
- **Provision**: Section 8(5) and 8(6); DPDP Rules on breach intimation

## In brief

Implement reasonable security safeguards and notify breaches is a legal requirement under the India DPDP Act in India (Section 8(5) and 8(6); DPDP Rules on breach intimation). The record carries 1 evidence example and mappings to 1 framework. In practice: Extend incident response to cover AI training data and model outputs that reveal personal data.

## What the duty requires

Data Fiduciaries must protect personal data with reasonable security safeguards and, on a personal data breach, inform the Data Protection Board and each affected individual in the form and manner prescribed by the Rules.

## What an organisation does about it

Extend incident response to cover AI training data and model outputs that reveal personal data.

## Controls that meet this duty

- Accuracy, robustness, fairness and security testing (supports): https://aipolicytracker.org/controls/accuracy-robustness-security-testing
- Privacy and data-protection controls for AI (supports): https://aipolicytracker.org/controls/privacy-and-data-protection-for-ai
- AI incident management and regulatory reporting (satisfies): https://aipolicytracker.org/controls/ai-incident-management-and-reporting

## Parent instrument

- Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025
  - Record: https://aipolicytracker.org/policies/india-dpdp-act
  - Context file: https://aipolicytracker.org/policies/india-dpdp-act.md

## Provenance

- **Permanent id**: AIPT-OBL-0050 (https://aipolicytracker.org/id/AIPT-OBL-0050; never changes or gets reused)
- **Record page**: https://aipolicytracker.org/obligations/india-dpdp-security-and-breach-notification
- **Official source**: https://www.meity.gov.in/data-protection-framework
- **Provision**: Section 8(5) and 8(6); DPDP Rules on breach intimation
- **Review status**: verified
- **Confidence**: medium
- **Facts last confirmed**: 2026-09-26
- **Confirmed by**: Bhaskar Bhatt (see https://aipolicytracker.org/reviewers)
- **Retrieved**: 2026-10-27
- **Licence**: https://creativecommons.org/licenses/by/4.0/
- **Cite as**: AIPolicyTracker (2026). "Implement reasonable security safeguards and notify breaches (India DPDP Act)" [AIPT-OBL-0050, verified 26 September 2026 by Bhaskar Bhatt]. https://aipolicytracker.org/id/AIPT-OBL-0050 (accessed 27 October 2026).

> This record is a structured summary with a link to the official text. It is not legal advice. Open the official source before relying on any date or duty. How current each record type must be is published at https://aipolicytracker.org/verification; what a record must carry at all is published at https://aipolicytracker.org/coverage.