DPDP Act and Rules 2025: do you need employee security training?
The DPDP Act and Rules do not name staff awareness training. What section 8 and Rule 6 require, when they apply (13 May 2027 by our count), and what evidence a simulation programme can add.
The Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 do not mention staff awareness training. They require “reasonable security safeguards” and “appropriate technical and organisational measures”. This post quotes and paraphrases what the text says, when the security duties apply, and what a documented awareness programme can add to your safeguards file.
Key takeaway
Training is not named. Section 8(5) and Rule 6 set an outcome: take reasonable safeguards to prevent a personal data breach. A simulation programme is supporting evidence, not a requirement being met.
What the Act and Rules say
| Detail | Text |
|---|---|
| Section 8(5) | “A Data Fiduciary shall protect personal data in its possession or under its control… by taking reasonable security safeguards to prevent personal data breach.” |
| Section 8(4) | “A Data Fiduciary shall implement appropriate technical and organisational measures to ensure effective observance of the provisions of this Act and the rules made thereunder.” |
| Rule 6(1) | Reasonable security safeguards must include, at the minimum: encryption or equivalent; access controls; logs and monitoring; backups; retaining logs and personal data for one year unless the law requires otherwise; security provisions in processor contracts; and, at (g), appropriate technical and organisational measures to observe the safeguards. |
| Schedule, item 1 | For failure to take reasonable security safeguards (section 8(5)), the penalty may extend to two hundred and fifty crore rupees. The Data Protection Board decides after an inquiry. |
Words searched across the Act and Rules: “awareness” does not appear, and “training” appears only in the name of a government department.
When the security duties apply
The Act and Rules commence in phases from the Gazette of India (Extraordinary) dated 13 November 2025 (G.S.R. 843(E) and G.S.R. 846(E)). Counting from the 13 November date printed in the Gazette:
- 13 November 2025: Board provisions and early rules.
- 13 November 2026 (one year): Consent Managers and related Act sections.
- 13 May 2027 (eighteen months): the rest of the Act, including section 8 and Rule 6 (security safeguards) and Rule 7 (breach intimation).
A Removal of Difficulties Order (S.O. 5458(E), 6 October 2026) corrects the wording of sections 9(1) and 10(2)(c)(ii) only and does not change these dates. Confirm the exact day with counsel before you rely on it.
What auditors look for
The Data Protection Board judges whether safeguards are reasonable. Dated campaign reports, completion records and a trend report are a documented organisational measure (section 8(4), Rule 6(1)(g)) you can add to the file. Encryption, access control, logging, backups and breach intimation are outside an awareness tool.
Evidence checklist
- Campaign reports and per-person lesson-completion records (organisational measures).
- An executive trend report showing whether click results change over time.
- Dated PPT, PDF or CSV exports for the safeguards file.
- Everything else in Rule 6: still your systems and contracts.
How SecurityRing helps
SecurityRing can add that awareness record. It does not provide the technical safeguards in Rule 6, breach intimation or consent management, and no regulator endorses it. The Board decides what is reasonable.
Sources
Every clause, incident and figure above comes from these official or original sources.
- MeitYDigital Personal Data Protection Act, 2023Published 11 August 2023 · Accessed 16 October 2026.
- MeitYDigital Personal Data Protection Rules, 2025 (MeitY PDF)Published 13 November 2025 · Accessed 16 October 2026.
- eGazetteGazette of India Extraordinary, No. 757: G.S.R. 843(E), commencement of the ActPublished 13 November 2025 · Accessed 16 October 2026.
- eGazetteGazette of India Extraordinary, No. 760: G.S.R. 846(E), DPDP Rules, 2025Published 13 November 2025 · Accessed 16 October 2026.
- eGazetteGazette of India Extraordinary, No. 5248: S.O. 5458(E), Removal of Difficulties Order, 2026Published 6 October 2026 · Accessed 16 October 2026.
