Managed Security Costs, Price Drivers and 2026 Rules
DPDP Act and IT Act for security buyers: safeguards, breach intimation and section 43A in 2026
What DPDP Act sections 8(5)–(6), the phased DPDP Rules 2025 and IT Act sections 43, 43A, 66 and 72A mean for buying managed security in India, as of October 2026.
As of October 2026, two layers of law shape what security you need. The Information Technology Act, 2000 applies now: section 43A makes a body corporate that handles sensitive personal data liable to pay compensation if it is negligent in maintaining reasonable security practices and causes wrongful loss, and sections 43, 66 and 72A deal with unauthorised access, computer offences and disclosure in breach of contract. The Digital Personal Data Protection Act, 2023 adds a duty to take reasonable security safeguards (section 8(5)) and to intimate personal data breaches to the Data Protection Board and affected people (section 8(6)); under the DPDP Rules, 2025 (G.S.R. 846(E), 13 November 2025), those business obligations, including the 72-hour detailed report to the Board, apply from 13 May 2027. This guide explains what each means for a managed security contract. It is part of the managed security pricing overview and is general information, not legal advice.
Timeline of the DPDP Rules, 2025
| Phase | From | What applies |
|---|---|---|
| 1 | 13 November 2025 | Provisions on the Data Protection Board |
| 2 | 13 November 2026 | Rules on consent managers |
| 3 | 13 May 2027 | Most obligations on data fiduciaries, including notice, Rule 6 security safeguards and Rule 7 breach intimation |
So in October 2026 the DPDP breach-reporting rule is not yet in force. CERT-In's six-hour reporting under the April 2022 Directions is in force. MeitY has consulted on shortening the transition; check MeitY and the e-Gazette for any change before planning around May 2027.
What "reasonable security safeguards" means in the Rules
Rule 6 of the DPDP Rules lists minimum measures a data fiduciary must take, including:
- encryption, obfuscation, masking or virtual tokens for personal data;
- access control to the computer resources that process it;
- visibility of access through logs, monitoring and review, to detect unauthorised access, investigate and remedy it;
- measures for continued processing if confidentiality, integrity or availability is compromised, such as back-ups;
- retention of such logs and personal data for one year for detection and investigation, unless another law requires otherwise;
- contracts with data processors requiring them to take safeguards;
- appropriate technical and organisational measures to ensure the safeguards are observed.
Notice how close this is to what a managed security service sells: monitoring, logs, detection and response. A contract that keeps logs for 90 days will fall short of the one-year DPDP log expectation once it applies, and of the 180 days CERT-In already expects.
Breach intimation under Rule 7
When the rule applies, on becoming aware of a personal data breach the data fiduciary must:
- inform each affected data principal without delay, in plain language: what happened, likely consequences, what is being done and what they can do, and a contact;
- inform the Data Protection Board without delay, and within 72 hours of becoming aware (or a longer period the Board allows) give a detailed report: facts, cause, mitigation, findings about the person responsible if known, remedial measures and the notices sent.
The Schedule to the Act provides for penalties of up to ₹250 crore for failure to take reasonable security safeguards to prevent a breach and up to ₹200 crore for failure to notify a breach. The Board decides the amount after inquiry, having regard to factors such as the nature, gravity and duration of the breach.
The IT Act provisions that apply today
| Section | What it covers | Relevance to security buying |
|---|---|---|
| 43 | Unauthorised access, downloading, introducing malware, damage, denial of access and similar acts without permission | Compensation is payable to the person affected; it is why pen tests need written authorisation |
| 43A | Body corporate negligent in implementing reasonable security practices for sensitive personal data, causing wrongful loss or gain | Liability for compensation; the SPDI Rules 2011 treat standards such as ISO/IEC 27001 as one way to show reasonable practices |
| 66 | Acts in section 43 done dishonestly or fraudulently | Criminal offence for attackers; again, authorisation separates testing from crime |
| 70B | CERT-In's functions and power to issue directions | Source of the April 2022 Directions |
| 72A | Disclosure of personal information in breach of a lawful contract | After the Jan Vishwas Act, 2023 this is a penalty of up to ₹25 lakh; relevant to provider confidentiality clauses |
Section 43A and the DPDP Act. Section 44(2) of the DPDP Act omits section 43A of the IT Act. The DPDP commencement notification of 13 November 2025 (G.S.R. 843(E), published alongside the Rules) brings section 44(2) into force eighteen months after that date, together with the main obligations, that is in May 2027 (13 May 2027 on the usual count; some advisers give 12 May). Sections 44(1) and 44(3) applied from 13 November 2025. So section 43A and the SPDI Rules continue to apply until then.
What this means for your managed security contract
| Contract point | Why |
|---|---|
| Provider is a data processor acting on your instructions, under a written contract | DPDP Rule 6 requires processor contracts; IT Act 72A protects disclosure in breach of contract |
| Log retention of at least 180 days now, and a plan for one year | CERT-In now; DPDP Rule 6 from May 2027 |
| Breach notification to you within hours, with facts in a usable format | You need them for CERT-In within 6 hours and, from 2027, for the Board within 72 hours |
| Encryption and access controls documented | Evidence of reasonable safeguards (43A now, 8(5) later) |
| Sub-processor list and location of data | You remain accountable for processing on your behalf |
| Deletion or return of data at exit | Retention limits and confidentiality |
Illustrative cost of the gap
A 90-endpoint company's SOC plan keeps logs for 90 days. Extending to one year means 275 more days of archive. At an illustrative 5 GB a day and ₹10 per GB a month, the extra storage is 5 × 275 = 1,375 GB, so ₹13,750 a month, ₹1,65,000 a year before GST. Budget it for the 2027 contract renewal now; see the renewal uplift calculator.
FAQ
Is our MSSP responsible if there is a breach?
Under the DPDP Act the data fiduciary (your business) stays responsible, including for processing by its processors. The contract decides what you can recover from the provider.
What is sensitive personal data under the SPDI Rules?
It includes passwords, financial information such as bank or card details, health information, sexual orientation and biometric information, among others. Check the Rules for the full list.
Do we need to report to both CERT-In and the Board?
Once Rule 7 applies, a personal data breach can trigger both: CERT-In under the 2022 Directions and the Board under the DPDP Rules. Prepare one incident record that serves both.
Sources
- MeitY — DPDP Act, 2023, DPDP Rules, 2025 and IT Act, 2000
- e-Gazette of India — DPDP Rules G.S.R. 846(E) and commencement notification G.S.R. 843(E), both of 13 November 2025
- CERT-In — Directions of 28 April 2022 and incident reporting
