Rule 6(1)(d) Explained: Data Backups and Availability Under DPDP Rules 2025

The Digital Personal Data Protection Rules, 2025 mandate that large enterprises maintain continuous processing capabilities when personal data faces a loss of confidentiality, integrity, or availability. Under Rule 6(1)(d), a Data Fiduciary must implement mechanisms like data backups to restore access after destruction, corruption, or ransomware events. The Head of Compliance cannot treat backups merely as an IT function. The law defines them as a statutory security safeguard. Failure to restore access quickly transforms a technical outage into a compliance violation. Data processing under Section 4 requires a lawful purpose based on consent or certain legitimate uses. Maintaining data availability is part of fulfilling the operational requirements of that lawful purpose.

Statutory Anchors For Availability

Section 8(5) of the Digital Personal Data Protection Act, 2023 dictates that a Data Fiduciary protect personal data by taking reasonable security safeguards. The DPDP Rules, 2025 specify this duty in Rule 6(1)(d). The clause demands reasonable measures for continued processing when data faces compromise. The text explicitly names data backups as a required measure to handle destruction or loss of access. This links infrastructure continuity directly to data protection law. The mandate applies regardless of the technical environment. A ransomware attack locking a primary database triggers this rule. A server failure causing data loss triggers this rule. The Fiduciary must possess the capacity to restore the environment and resume processing without undue delay.

Fiduciary Liability For Shared Systems

This requirement binds the Data Fiduciary directly. Section 8(1) holds the Fiduciary responsible for any processing undertaken on its behalf by a Data Processor. This applies irrespective of any agreement to the contrary. When a vendor holds the primary database, the Fiduciary must verify the vendor runs isolated and tested backups. Shared systems across corporate groups or third-party cloud providers do not dilute Fiduciary liability. A Data Fiduciary may engage a Data Processor only under a valid contract under Section 8(2). The Head of Compliance must confirm that these processor contracts define backup frequency, isolation methods, and restoration testing parameters. If the cloud vendor drops the database and loses the backup, the Data Protection Board holds the Data Fiduciary liable.

Accuracy And Integrity Intersections

Rule 6(1)(d) addresses compromises in data integrity alongside availability. Integrity loss directly impacts Section 8(3) obligations. Section 8(3) requires a Data Fiduciary to ensure data is complete, accurate, and consistent when it is used to make a decision that affects the Data Principal or is disclosed to another Data Fiduciary. If a database corruption alters records, the Data Fiduciary risks making incorrect decisions about a Data Principal. Restoring from a backup resolves the integrity gap. The restoration process itself must map back to a verified point in time. A Fiduciary cannot claim compliance if it restores outdated or malformed data that subsequently violates the accuracy requirements of Section 8(3).

Cross-Border Transfers And Backups

Data storage locations complicate backup compliance. Section 16(1) of the DPDP Act empowers the Central Government to restrict the transfer of personal data to notified countries or territories outside India. A Data Fiduciary storing primary data in India might configure backups to a lower-cost overseas region. The compliance team must verify that this backup location does not fall under a restricted territory notification. Section 16(2) preserves the applicability of sector-specific laws that provide for a higher degree of protection or restriction. Financial sector regulations often mandate local backups. The Head of Compliance must cross-reference DPDP obligations with these sectoral requirements to ensure the backup strategy remains legally viable across all regimes.

Minimum Baselines Versus Reasonable Measures

The text establishes backups and restoration capabilities as the floor for compliance. A basic daily snapshot satisfies the minimum text of having a backup. What qualifies as reasonable depends on the volume of data, the nature of processing, and the impact of the outage on Data Principals. An enterprise processing high volumes of personal data must match its recovery time objectives with the risk to the data. If a restoration takes weeks, the measure ceases to be appropriate. The Data Protection Board evaluates the time to recovery during a security incident. An enterprise facing an availability compromise must demonstrate that its specific response mechanisms align with the scale of its operations.

Common Myths Regarding Data Availability

Several myths exist around data availability compliance. One common myth is that ISO 27001 certification alone satisfies Rule 6(1)(d). The certification provides a framework, but the Data Protection Board evaluates specific outcomes. The Board checks whether personal data actually restored promptly during a live incident. Another misconception claims encrypted data eliminates backup duties. Encryption protects confidentiality. It does nothing to restore availability if the primary dataset is locked by an attacker. A third error involves treating backups as a purely operational metric. Unavailable data violates the statutory baseline and exposes the Fiduciary to legal penalties regardless of internal IT performance targets.

Building The Evidence Pack

Regulator-ready compliance demands a structured evidence pack.

1. Define the recovery control owner. Map the internal owner responsible for data restoration within the Record of Processing Activities.

2. Document backup schedules. Keep verifiable logs showing frequency and completion status for personal data stores.

3. Store restoration test results. Maintain quarterly or bi-annual audit trails proving backups are viable and data is recoverable within defined timeframes.

4. Validate processor attestation. Collect evidence that vendors acting under Section 8(2) contracts regularly test their own recovery environments.

5. Map geographic locations. Record the hosting jurisdiction for all backup instances to verify compliance with Section 16 restrictions.

Related Duties And Penalty Exposure

A failure in data availability triggers cascading obligations under the Act and Rules. If a compromise in availability qualifies as a personal data breach, Rule 7 mandates intimation to affected Data Principals without delay and a detailed report to the Data Protection Board within 72 hours. Section 8(2) requires a valid contract with processors detailing their role in incident recovery. The Schedule to the Act links breaches of Section 8(5) security safeguards to a maximum penalty of 250 crore rupees. A missing backup plan directly exposes the enterprise to this tier of regulatory action.

Next Steps For Compliance Teams

Exactly 218 days remain until the DPDP hard compliance deadline of 13 May 2027. Manual evidence gathering leaves gaps in vendor oversight and audit trails. Evaluate enterprise recovery controls against the statutory standards. Verify that every vendor contract clearly allocates liability for data loss. Run a security-safeguards gap check to build your Rule 6 evidence pack at https://www.complydp.com/audit-preview.