DPDP Act Compliance: A Security Testing Guide

• Offensium Vault
• November 7, 2026
• No Comments

India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and the DPDP Rules notified in November 2025 have turned data protection from a best practice into a legal obligation. For any business that collects personal data of people in India, DPDP Act compliance now means proving that you protect that data with reasonable security safeguards, and that you can respond quickly when something goes wrong.

This guide focuses on the security side of DPDP Act compliance: what the law expects, how security testing supports it and a practical checklist to prepare before the main obligations take effect. It is general information, not legal advice.

The DPDP Act in Brief

The DPDP Act governs how organisations (called data fiduciaries) process digital personal data of individuals (data principals). It covers consent, notices, rights of individuals, obligations for significant data fiduciaries, cross-border transfers and penalties, and it establishes the Data Protection Board of India to enforce the law.

The DPDP Rules, notified by the Ministry of Electronics and Information Technology in November 2025, set out how the Act works in practice and introduced a phased timeline:

What “Reasonable Security Safeguards” Means

Every data fiduciary must protect personal data in its possession or under its control, including data processed by its vendors, by taking reasonable security safeguards to prevent a personal data breach. The Rules set out minimum measures, including:

• Appropriate data security measures such as encryption, obfuscation, masking or virtual tokens.
• Access controls over the computer resources used to process personal data.
• Visibility into access through logs, monitoring and review, so unauthorised access can be detected and investigated.
• Measures for continued processing if confidentiality, integrity or availability is compromised, such as backups.
• Retaining relevant logs and personal data for at least one year to help detect and investigate breaches, unless another law requires otherwise.
• Appropriate security provisions in contracts with data processors.
• Technical and organisational measures to make sure the safeguards are actually observed.

In practice, regulators will look for evidence that you identify weaknesses and fix them in time, which is exactly what vulnerability management and regular security testing provide.

Breach Notification Under the DPDP Rules

If a personal data breach occurs, the data fiduciary must inform each affected data principal and the Data Protection Board without delay, and provide the Board with a detailed report, generally within 72 hours of becoming aware of the breach. Remember that incidents may also need to be reported to CERT-In within six hours; our guide to CERT-In guidelines for businesses explains those requirements.

Penalties

The Schedule to the DPDP Act sets significant penalties. Failure to take reasonable security safeguards to prevent a personal data breach can attract a penalty of up to INR 250 crore, and failure to notify the Board and affected individuals of a breach can attract a penalty of up to INR 200 crore. The amount depends on factors such as the nature, gravity and duration of the breach.

How Security Testing Supports DPDP Act Compliance

• Find exposures before they become breaches. VAPT uncovers access control flaws, injection issues and data leaks in the applications that hold personal data.
• Verify access controls. Testing with multiple user roles confirms that people can only see the data they should.
• Check encryption and configuration. Cloud security and configuration reviews confirm data is encrypted, storage is not public and logging is enabled.
• Test your vendors’ integrations. APIs connecting to processors and partners are common sources of leaks.
• Create evidence. Reports, remediation records and retest results show the Board and customers that you take safeguards seriously.
• Prepare for incidents. An incident response plan makes the 72-hour reporting window achievable.

DPDP Security Readiness Checklist

1. Map where personal data is collected, stored and shared, including vendors.
2. Classify data and apply encryption, masking or tokenisation where appropriate.
3. Enforce least-privilege access and multi-factor authentication for privileged users.
4. Enable logging and monitoring for systems that process personal data, and retain logs for at least one year.
5. Run VAPT on internet-facing applications, APIs and mobile apps, and fix findings promptly.
6. Review cloud and infrastructure configurations against security baselines.
7. Add security clauses to data processor contracts and assess key vendors.
8. Document an incident and breach response process covering DPB and data principal notification.
9. Test backups and continuity arrangements.
10. Repeat testing at least annually and after major changes.

Frequently Asked Questions

When do the DPDP security obligations become enforceable?

The DPDP Rules were notified in November 2025 with a phased rollout. Most substantive obligations, including reasonable security safeguards, breach notification and data principal rights, apply after an 18-month transition period, which ends in May 2027. Organisations should use the transition period to prepare rather than wait.

Does the DPDP Act require penetration testing?

The Act and Rules do not name penetration testing specifically. However, they require reasonable security safeguards, including timely vulnerability management, and penalties apply when safeguards fail. Regular VAPT is one of the most practical ways to demonstrate that you identify and fix vulnerabilities.

What is the maximum penalty for failing to protect personal data?

Under the Schedule to the DPDP Act, failure by a data fiduciary to take reasonable security safeguards to prevent a personal data breach can attract a penalty of up to INR 250 crore.

Conclusion

DPDP Act compliance is ultimately about trust: showing your customers and the Data Protection Board that personal data is genuinely protected. With most obligations applying from May 2027, now is the time to find and fix vulnerabilities, strengthen access controls and logging, and prepare your breach response.

Want to understand where your applications and infrastructure stand? Talk to the Offensium Vault team about a security assessment, or explore our full range of cybersecurity services.