Data & privacyNote
DPDP Rule 6 names backups; 8 of 18 backup tools document no Indian copy
What DPDP Rule 6’s seven safeguards ask of compliance, DLP and backup tools, and where 18 backup products keep the copy, as of September 2026.
Of the three layers the 2024 version of this piece sold as an alliance, compliance software, DLP and backup, only one is named in India’s data-protection rules: the backup. Rule 6 of the DPDP Rules, 2025 lists seven minimum safeguards, and clause (d) asks for reasonable measures to keep processing going after a compromise or loss, naming data backups as the example.1 The question for an Indian buyer is which of the three answers which clause, and whether the backup can say where the copy lives.
01Seven safeguards, three tools, no clean mapping
Rule 6 asks for (a) encryption, masking or tokenisation; (b) access control; (c) logs, monitoring and review of access; (d) continuity measures including backups; (e) logs and personal data kept for one year; (f) security clauses in contracts with data processors; and (g) technical and organisational measures to make the rest effective.1 A DLP product such as Safetica, which lists US$72 to US$144 a user a year, works on (a) and (c): it finds sensitive data and controls where it moves.3 A backup product serves (d), and can hold the one-year copy in (e). A compliance-automation tool such as Sprinto, which TechBag’s estate places as a Bengaluru-built, certification-first product for smaller firms, mostly proves (g): it collects the evidence that the other controls run.4
02Where the backup copy sits: 8 of 18 do not say India
A backup you depend on for clause (d) is also a copy of personal data held by a processor, which brings clause (f), the contract, into play. The contract needs to name where the copy sits. In TechBag’s Backup & Recovery guide, 5 of 18 products document an Indian region for the copy, 5 write to storage you choose, and 8 document no Indian region.2
Only 5 of 18 backup products document an Indian region for the copy; 8 do not
Backup and recovery products by where the backup copy can sit, count, TechBag guide reviewed August 2026
Source: TechBag Backup & Recovery guide, India tag, verified against vendor documentation · as of 30 September 2026 · 'Your own storage' means residency is your design, not the vendor's
Commvault, the 2024 post’s backup pick, sits in the first bar for its Cloud Backup & Recovery service, at a SaaS list of US$58.50 to US$90 a terabyte a month; its AWS-only Clumio service sits in the last.2
Buying it in India. All three products list in US dollars; the rupee price is a reseller quote on that list plus 18% GST. The DPDP Rules were notified on 13 November 2025, and the Rule 6 safeguards and breach-notice duties apply from 13 May 2027.5 CERT-In’s Directions of 28 April 2022 already require incidents reported within six hours and ICT logs kept for 180 days within Indian jurisdiction.6 Banks add the RBI’s Cybersecurity, Technology Risk and Resilience Framework Directions of 31 July 2026.7
Sources
- Digital Personal Data Protection Rules, 2025, Rule 6: reasonable security safeguards (text as published by dpdpa.com) — rules notified 13 November 2025
- TechBag, Backup & Recovery decision guide: 18 products, India tag, Commvault list prices — verified 22 August 2026
- TechBag, DLP & Insider Risk decision guide: 18 products, Safetica list, Indian data types — reviewed 24 August 2026
- TechBag, MetricStream Compliance intel page: Sprinto placed as Bengaluru-built and certification-first — undated page
- MeitY, Digital Personal Data Protection Rules, 2025 (phased commencement) — notified 13 November 2025
- CERT-In, Directions under section 70B(6) of the IT Act (six-hour reporting, 180-day logs) — 28 April 2022
- RBI, Cybersecurity, Technology Risk and Resilience Framework Directions, 2026, via practitioner summary — 31 July 2026 RBI PDF not fetched.
Related on TechBag: the Backup & Recovery guide narrows 18 products by workload, delivery and where the copy sits; the DLP & Insider Risk guide compares the products that watch data leave.
Disclosure. TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.
Keep reading
