From 13 May 2027, businesses that hold personal data in India must be able to keep working if that data is destroyed or lost, and the DPDP Rules name backups as one way to do it. Here is which parts of Rule 6 concern your backups, and which do not.
Rule 6 lists seven minimum safeguards. One names backups, three apply to your backup copies, and three are about your own systems. They are grouped that way here, so it is clear what a backup product can do for you and what it cannot.
"reasonable measures for continued processing … such as by way of data-backups"
Scheduled backups you can restore onto the same machine or a new one, with recent copies locked so nothing can delete them for a period you choose.
Decide what to back up, and test a restore before you need one.
Your backups hold the same personal data as the originals, so they need the same protection.
Backups are encrypted on your machine before they leave it, and stay encrypted where they are stored.
Encrypt the live data on your own machines and systems too.
Keeping a year of backups is a practical way to hold on to the personal data. The logs are a separate duty.
Retention settings keep daily, monthly and yearly copies, so a year or more of your data can be kept and restored. If your applications write logs to files, those folders can be backed up on the same schedule.
Set retention to at least a year, and keep the access logs from your own systems for a year.
A backup provider that handles personal data for you is a Data Processor.
We offer a Data Processing Agreement for Satkosh.
Sign it, and have one with each of your other processors.
These are about your own systems and how you run them, so a backup product does not meet them for you. Satkosh's own console has multi-factor sign-in, Microsoft 365 sign-in and an audit trail, but those protect your backups, not the rest of your systems.
This is not legal advice. It is our reading of Rule 6 as it applies to backups, last reviewed October 2026. Satkosh helps you meet the backup parts of Rule 6 described above. It does not make a business compliant with the DPDP Act on its own, because compliance covers how you collect, use and share personal data, not only how you protect it. Check your own obligations with a lawyer.
Source: the DPDP Rules, 2025, published in the Gazette of India as G.S.R. 846(E) on 13 November 2025. For a readable summary of the Rules and their commencement dates, see SCC Online's note on the notification. See also our Data Processing Agreement and security page.
Book 30 minutes. We will look at what you hold, show you how Satkosh covers the backup parts of Rule 6, and run a real restore while you watch.
No spam, just a reply from our team. Managed backup by Serverstock. Made in India.
