Rule 6 Access Control: Securing Computer Resources Under the DPDP Act

Rule 6(1)(b) Access Control Mandates

Rule 6(1)(b) of the Digital Personal Data Protection Rules 2025 compels Data Fiduciaries to implement strict access controls across all computer resources processing digital personal data. This requirement applies equally to systems owned by the enterprise and those operated by contracted Data Processors. The Head of Compliance directs the security team to configure permissions so that only authorised personnel interact with these specific systems. Access privileges rely directly on lawful purposes defined under Section 4 of the DPDP Act. Broad system access creates immediate regulatory exposure. Employees viewing records without a business need violate the principle of purpose limitation.

Statutory Anchors and IT Act Definitions

Section 8(5) of the DPDP Act 2023 requires Data Fiduciaries to take reasonable security safeguards to prevent a personal data breach. Rule 6 operationalises this specific mandate. Rule 6(1)(b) demands the implementation of access control mechanisms for computer resources used by the fiduciary or its processor. Rule 6(2) directs fiduciaries to the Information Technology Act 2000 for the definition of a computer resource. The term covers computers, computer systems, computer networks, data, databases, and software. Security teams evaluate every network node and database table holding personal data. This broad definition prevents enterprises from excluding legacy systems from security audits.

Minimum Requirements versus Reasonable Safeguards

The baseline text establishes a strict floor for compliance. Fiduciaries need a documented access control policy covering every computer resource processing personal data. What qualifies as reasonable depends on the context of the specific processing activity. A simple password gate meets the minimum requirement for a low-volume internal directory. High-volume enterprise environments demand stronger technical controls. Auditors expect multi-factor authentication, role-based access limits, and regular permission reviews. A static GRC tool fails to capture real-time deviations in system access logs. Security managers deploy dynamic identity management systems to track employee interaction with data. The architecture restricts user visibility to the exact fields required for their daily tasks.

Applicability Under Section 3

Section 3 sets the territorial and material scope of these access control requirements. The mandate applies to processing digital personal data within India collected in digital form. It also covers non-digital data digitised subsequently. Physical paper records scanned into a central database immediately fall under Rule 6(1)(b) protection. The rules extend beyond Indian borders. Data Fiduciaries operating outside India must apply these exact access controls if their processing relates to offering goods or services to Data Principals within India. Overseas vendors cannot claim exemption based on geographic location. Foreign servers storing Indian personal data require identical logical boundaries and access restrictions.

Scope of Liability Across Shared Systems

Section 8(1) of the Act holds the Data Fiduciary completely responsible for any processing undertaken on its behalf. The access control mandate flows directly from the enterprise to its vendors. Section 8(2) restricts fiduciaries to engaging Data Processors only under a valid contract. This contract dictates the exact access parameters the processor implements. A Data Processor leaving a cloud storage bucket open or misconfiguring database access triggers liability for the Data Fiduciary. Enterprise compliance teams evaluate Rule 6(1)(b) controls across internal IT infrastructure, third-party SaaS platforms, and external vendor systems. Shared environments require precise segregation to block unauthorised lateral movement across datasets. Fiduciaries audit these external environments to confirm vendor adherence.

Section 4 Lawful Purposes and Access Rules

Section 4 establishes that personal data processing happens only for a lawful purpose based on consent or certain legitimate uses. Access controls enforce this statutory boundary. Technical safeguards ensure an employee cannot retrieve data obtained via Section 7 legitimate uses for an unrelated marketing campaign. The identity management system maps user access levels to specific consent receipts. A Data Principal withdrawing consent triggers the access control mechanism to automatically revoke employee visibility into that record. Segregating data by its collection purpose prevents internal misuse. Fiduciaries configure their databases to isolate records based on the original lawful processing basis.

Required Audit Evidence and Artefacts

1. Access Control Policy: The Chief Information Security Officer owns this document. It defines the exact rules for granting, reviewing, and revoking access to all computer resources.

2. Identity and Access Management Logs: IT Operations maintains these digital records. They prove that multi-factor authentication is active and track daily login attempts across systems holding personal data.

3. Quarterly Access Review Attestation: The Head of Compliance holds these written sign-offs. System owners actively verify permissions and permanently remove access for departed or transferred staff.

4. Processor Access Audit Reports: The Vendor Risk Management team collects these assessments. They verify that third-party processors enforce access controls equivalent to internal enterprise standards and contractual obligations.

Breach Intimation and Penalty Exposure

Failure to secure access controls directly increases the risk of a personal data breach under Section 8(5). Rule 7 requires the fiduciary to submit a detailed report to the Data Protection Board within 72 hours of a breach discovery. Poor access controls accelerate the spread of unauthorised data exfiltration. The Schedule to the Act imposes penalties up to 250 crore rupees for failing to implement reasonable security safeguards. Regulatory bodies examine the access logs immediately following a security incident. Missing or incomplete login records compound the compliance failure and demonstrate systemic negligence.

Evaluation Criteria and Next Steps

Enterprises have 220 days until the DPDP hard compliance deadline of 13 May 2027 to implement these controls. Reliance on fragmented spreadsheets makes verification of enterprise-wide access controls impossible. Organizations need automated solutions to consolidate identity data. ComplyDP integrates with existing identity providers to map access logs against your Record of Processing Activities. The platform generates regulator-ready evidence packs verifying Rule 6(1)(b) compliance across your digital infrastructure. Visit https://www.complydp.com/audit-preview to evaluate your computer resource security safeguard gaps today.