DPDP Readiness
Build the identity and access controls behind DPDP Rule 6.
Control who and what can access systems processing personal data, keep a traceable record of identity activity, and revoke compromised access across customers, APIs, services, workloads, and agents.
What they can reachApplications, APIs, and systems processing personal data
DPDP Rule 6
What does Rule 6 require from engineering teams?
Data Fiduciaries must put reasonable security safeguards in place: controlled access, logs and monitoring, investigation of unauthorized access, one-year retention, and technical and organisational measures.
Who or what can reach systems processing personal data?
Can users, services, workloads, and agents be distinguished from each other?
Can you trace relevant identity and access activity?
Can compromised access be removed quickly?
From regulation to architecture
Turn the Rule into controls your engineering team can check.
Cedar policies decide which APIs and scopes an identity may receive before a token is issued. Default deny blocks anything missing a permission.
Machine-to-machine and SPIFFE workload identity let every service, job, and agent authenticate on its own, with certificate-bound tokens.
MonoCloud records authentication, access, and administrative events. Audit logs can be pulled through the API into your own storage.
Managed sessions, reference tokens, introspection, certificate revocation, and banned workload identities end access after a security event.
How MonoCloud fits
Customers are not the only identities reaching personal data.
A customer, a backend service, a workload, and an AI agent are four different identities. MonoCloud gives each its own, so access can be granted, traced, and revoked separately.
Check your current setup
Start with what you have today.
We use cookies to personalise content and analyse traffic. Choose which purposes you allow.
Consent Banner Generator
Build and preview a consent banner for your site, configure purposes and user choices, then copy the generated code.
Website Scanner
Check public DPDP signals on your site: consent behaviour, privacy links, trackers, user controls, and security headers.
machine identity · logging
sessions · revocation
Identity Readiness Check
Answer a short set of questions on authentication, APIs, machine identity, authorization, logging, and revocation, then get a report.
Practical guide
Turn DPDP requirements into an engineering checklist.
The DPDP for Engineering Teams Playbook takes the technical parts of readiness and turns them into a practical implementation plan.
DPDP for Engineering Teams6 chaptersRule 6 mappedImplementation plan
DPDP Act and identity security
FAQs, answered
What engineering teams ask about Rule 6, access controls, and audit logs.
What is Rule 6 of the DPDP Rules?
Rule 6 covers reasonable security safeguards. It includes data-security measures, access controls, logs and monitoring, investigation of unauthorized access, backups, one-year retention of specified logs and data, processor safeguards, and technical and organisational measures.
Does the DPDP Act require access controls?
The DPDP Rules specifically require appropriate measures to control access to computer resources used by the Data Fiduciary or Data Processor.
Does DPDP require audit logs?
Rule 6 requires visibility into access through appropriate logs, monitoring, and review to support detection, investigation, remediation, and prevention of unauthorized access.
How long must relevant DPDP logs be retained?
Rule 6 specifies one year for the logs and personal data described in that provision, unless another applicable law requires otherwise. MonoCloud's native audit-log retention varies by subscription. Audit logs can be retrieved through MonoCloud API endpoints and retained in the customer's own logging or storage environment according to their retention requirements.
Can MonoCloud audit logs be retrieved for longer retention?
Yes. MonoCloud provides API endpoints for retrieving audit logs, based on the customer's subscription. Teams can periodically retrieve the relevant logs and retain them in their own logging or storage environment.
When do the main DPDP Rules take effect?
The Rules were notified in November 2025. Rules 3 and 5–16 come into force eighteen months after publication, placing the main operational requirements in May 2027.
How does MonoCloud help with DPDP readiness?
MonoCloud provides identity and access controls across customers, APIs, services, workloads, and agents, including authentication, Cedar authorization, API protection, machine and workload identity, audit events, mTLS, session and token controls, and revocation.
Put the identity and access controls in place before the DPDP deadline.
Check your current setup, or see how MonoCloud controls access across customers, APIs, services, workloads, and agents.