DPDP Rules and CERT-In's log retention, with dates.
The Digital Personal Data Protection Rules and CERT-In's direction on logs set dates and durations that reach access control. This page states them from their sources, then says which evidence Pramaan produces for each safeguard, and what stays with you.
For boards and finance leaders
The compliance clock is a date, not a forecast.
The Digital Personal Data Protection Rules 2025 were notified on 13 November 2025 with an eighteen-month phased compliance period. It ends on 13 May 2027. The largest penalty in the Act is not attached to a form somebody forgot to file — it is attached to the safeguards themselves, which is the category access control sits in.
- 13 May 2027
- End of the DPDP Rules’ eighteen-month phased compliance period, counted from notification on 13 November 2025.
- Up to ₹250 crore
- The Act’s highest penalty: a Data Fiduciary’s failure to maintain reasonable security safeguards. Every other category tops out lower.
- 180 days, in India
- CERT-In requires logs of all ICT systems to be retained for a rolling 180 days and maintained within Indian jurisdiction.
What we will not tell you is what proportion of a breach cost this product removes. Nobody can calculate that honestly, and a vendor who hands you that number should be asked how they derived it. What we will tell you is which line the control attaches to: it does not stop the intrusion. It changes what an intruder can do with what they take, and how long they keep it. When the identity plane never leaves your data centre, that stops being a project and becomes a property of where you installed it.
It does not make your organisation compliant. No product can do that, and any vendor who says otherwise is telling you something checkable and false.
Take a live token and try to reuse it
Sources: Gazette of India Extraordinary No. 760, G.S.R. 846(E), 13 November 2025; Press Information Bureau, Government of India, ‘DPDP Rules, 2025 Notified’; the Digital Personal Data Protection Act 2023; CERT-In Directions No. 20(3)/2022 of 28 April 2022, under section 70B(6) of the Information Technology Act 2000.
Safeguards, and which Pramaan evidence fits each
| Safeguard | What Pramaan produces | What stays with you |
|---|---|---|
| Access control | Each private application is denied unless an access rule allows it, and Pramaan is its own MFA provider. When the web edge refuses a request, because of the person's groups or your access rules, the refusal is written as an audit event. | Deciding who may reach which application, and writing the rules that say so. |
| Log retention support | The broker runs on servers you operate and keeps its audit events in its PostgreSQL database there; each is added to a transparency log. | Running the broker with that database: without a database, the broker keeps all its state in memory and loses it on restart. Keeping the logs of all your ICT systems for a rolling 180 days, within India. Pramaan's audit log is the log of one of those systems. |
| Breach evidence | Refused access to private applications, written as audit events, and a transparency log that proves the integrity of recorded events (how to check it). | Detecting and reporting a breach. The transparency log covers recorded events only: it is not a record of every access decision. |
For your engineers
Technical detail: the evidence chain
On direct connections, the raw-TCP listener writes an audit event when its access checks refuse a connection after the person's token has been read. The transparency log follows RFC 6962; each audit event is a leaf. Run the broker with PostgreSQL: without DATABASE_URL, the broker keeps all its state in memory and loses it on restart.
Questions
Does Pramaan make an organisation compliant with the DPDP Rules?
No. It does not make your organisation compliant. It produces evidence for some safeguards, set out in the table on this page.
When does the DPDP Rules' phased compliance period end?
On 13 May 2027. The Rules were published in the Gazette of India on 13 November 2025, with an eighteen-month phased period.
What is the highest penalty under the DPDP Act?
Up to ₹250 crore, for a Data Fiduciary's failure to maintain reasonable security safeguards.
How long does CERT-In ask for logs to be kept?
For a rolling 180 days, within Indian jurisdiction, for the logs of all ICT systems (CERT-In Directions No. 20(3)/2022 of 28 April 2022).
Does Pramaan keep our logs for CERT-In?
No. Pramaan's audit log is written by the broker you run, on your own servers; keeping the logs of all your ICT systems for 180 days, in India, stays with your organisation.
Talk to us, or try it first
-
Book a walkthrough
Against your own apps, not slides.
-
Run the lab
It uses a demonstration account; none of your data is involved.
-
See pricing
Published floors, named-user bands and what every tier includes.