DPDP Act for engineering teams: a security safeguards checklist.

India's Digital Personal Data Protection (DPDP) Act 2023 introduces strict obligations for Data Fiduciaries. Under Section 8(5), organizations must implement 'reasonable security safeguards' to prevent personal data breaches, with penalties reaching up to ₹250 crore.

Technical Safeguards Every Indian Startup Needs

• Data at Rest Encryption: AES-256 encryption across databases, S3 buckets, and backup archives.
• Strict Access Controls: Multi-factor authentication (MFA) and least-privilege role-based access.
• Incident Logging & CERT-In Alignment: Retaining audit and access logs for 180 days to comply with CERT-In 6-hour breach reporting guidelines.
• Regular Security Auditing: Documented periodic VAPT assessments demonstrating proactive vulnerability remediation.