It Has To Be In The Contract
The Processor contract must carry the safeguards clause
Read the full guide: Rule 6(1)(f) — DPDP Act compliance guide
Watch in English
Summary
The safeguards must reach the contract.
The Processor contract must carry the safeguards clause
Full transcript
The safeguards must reach the contract.
Rule 6(1)(f) requires appropriate provision
in the contract with the Data Processor,
for taking reasonable security safeguards.
Pause. Who does the rule bind?
The Data Fiduciary. It is their contract.
Section 8(2) already required a valid contract.
This says what has to be inside it.
Wherever applicable, says the rule.
Safeguards on paper, then in practice.
r.6(1)(f) — Digital Personal Data Protection Act, 2023 + Rules, 2025
In force from 13 May 2027