--- title: "DPDP Rule 6 names backups; 8 of 18 backup tools document no Indian copy" summary: "What DPDP Rule 6’s seven safeguards ask of compliance, DLP and backup tools, and where 18 backup products keep the copy, as of September 2026." url: https://www.thetechbag.com/blog/building-impregnable-enterprise-compliance-dlp-backup format: Note desk: "Data & privacy" published: 2026-02-03 facts_checked: 2026-09-30 author: TechBag (The TechBag Journal) tags: ["DPDP","Rule 6","backup","DLP","compliance automation","Commvault","Safetica","Sprinto","data residency","CERT-In"] cover: https://www.thetechbag.com/blog/covers/building-impregnable-enterprise-compliance-dlp-backup.png --- # DPDP Rule 6 names backups; 8 of 18 backup tools document no Indian copy *What DPDP Rule 6’s seven safeguards ask of compliance, DLP and backup tools, and where 18 backup products keep the copy, as of September 2026.* Note · Data & privacy · By TechBag · Published 2026-02-03 · Facts checked 2026-09-30 · Canonical: https://www.thetechbag.com/blog/building-impregnable-enterprise-compliance-dlp-backup Of the three layers the 2024 version of this piece sold as an alliance, compliance software, DLP and backup, only one is named in India’s data-protection rules: the backup. Rule 6 of the DPDP Rules, 2025 lists seven minimum safeguards, and clause (d) asks for reasonable measures to keep processing going after a compromise or loss, naming data backups as the example.[1] The question for an Indian buyer is which of the three answers which clause, and whether the backup can say where the copy lives. ## Seven safeguards, three tools, no clean mapping Rule 6 asks for (a) encryption, masking or tokenisation; (b) access control; (c) logs, monitoring and review of access; (d) continuity measures including backups; (e) logs and personal data kept for one year; (f) security clauses in contracts with data processors; and (g) technical and organisational measures to make the rest effective.[1] A DLP product such as Safetica, which lists US$72 to US$144 a user a year, works on (a) and (c): it finds sensitive data and controls where it moves.[3] A backup product serves (d), and can hold the one-year copy in (e). A compliance-automation tool such as Sprinto, which TechBag’s estate places as a Bengaluru-built, certification-first product for smaller firms, mostly proves (g): it collects the evidence that the other controls run.[4] TechBag countTechBag count: a gap to test, not a verdict When TechBag’s DLP guide was reviewed on 24 August 2026, none of its 18 products documented a ready-made classifier for Aadhaar, PAN or GSTIN numbers. That is a documentation gap, not proof the products cannot find them; ask for the detection to be shown on a sample of your own data before you sign.[3] Our view Our view: buy in the order the rule implies. A restorable backup and a year of logs first, because a breach without them cannot be investigated or recovered from. DLP second, once you know which data is sensitive. A compliance tool last, when there are controls worth evidencing. ## Where the backup copy sits: 8 of 18 do not say India A backup you depend on for clause (d) is also a copy of personal data held by a processor, which brings clause (f), the contract, into play. The contract needs to name where the copy sits. In TechBag’s Backup & Recovery guide, 5 of 18 products document an Indian region for the copy, 5 write to storage you choose, and 8 document no Indian region.[2] **Figure: Only 5 of 18 backup products document an Indian region for the copy; 8 do not** *Backup and recovery products by where the backup copy can sit, count, TechBag guide reviewed August 2026* Indian region documented Commvault Cloud, Druva (three products), Acronis Cyber Protect Cloud 5 products Your own storage Veeam (three products), NetBackup, Acronis on-prem 5 products No Indian region documented Rubrik, Cohesity DataProtect, Clumio, Barracuda, Datto, IDrive and others 8 products | | Value (products) | | --- | --- | | Indian region documented | 5 | | Your own storage | 5 | | No Indian region documented | 8 | Source: TechBag Backup & Recovery guide, India tag, verified against vendor documentation · as of 30 September 2026 · 'Your own storage' means residency is your design, not the vendor's Commvault, the 2024 post’s backup pick, sits in the first bar for its Cloud Backup & Recovery service, at a SaaS list of US$58.50 to US$90 a terabyte a month; its AWS-only Clumio service sits in the last.[2] **Buying it in India.** All three products list in US dollars; the rupee price is a reseller quote on that list plus 18% GST. The DPDP Rules were notified on 13 November 2025, and the Rule 6 safeguards and breach-notice duties apply from 13 May 2027.[5] CERT-In’s Directions of 28 April 2022 already require incidents reported within six hours and ICT logs kept for 180 days within Indian jurisdiction.[6] Banks add the RBI’s Cybersecurity, Technology Risk and Resilience Framework Directions of 31 July 2026.[7] How we did this Figures as of 30 September 2026 The Rule 6 clauses are paraphrased from a published copy of the notified text, not quoted; the Gazette PDF itself was not fetched. The backup counts come from the version of TechBag’s Backup & Recovery guide committed on 30 September 2026 (18 products, India tags verified on 22 August 2026); the DLP count from the DLP & Insider Risk guide of the same date (18 products, reviewed 24 August 2026). The mapping of tools to clauses is our reading, not a legal opinion. No vendor was asked for a quote. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [Digital Personal Data Protection Rules, 2025, Rule 6: reasonable security safeguards (text as published by dpdpa.com)](https://dpdpa.com/dpdparules/rule6.html) — rules notified 13 November 2025 2. [TechBag, Backup & Recovery decision guide: 18 products, India tag, Commvault list prices](https://www.thetechbag.com/browse/backup-cyber-resilience/backup-recovery) — verified 22 August 2026 3. [TechBag, DLP & Insider Risk decision guide: 18 products, Safetica list, Indian data types](https://www.thetechbag.com/browse/data-security-privacy/dlp-insider-risk) — reviewed 24 August 2026 4. [TechBag, MetricStream Compliance intel page: Sprinto placed as Bengaluru-built and certification-first](https://www.thetechbag.com/metricstream/metricstream-compliance) — undated page 5. [MeitY, Digital Personal Data Protection Rules, 2025 (phased commencement)](https://www.meity.gov.in/data-protection-framework) — notified 13 November 2025 6. [CERT-In, Directions under section 70B(6) of the IT Act (six-hour reporting, 180-day logs)](https://www.cert-in.org.in/Directions70B.jsp) — 28 April 2022 7. [RBI, Cybersecurity, Technology Risk and Resilience Framework Directions, 2026, via practitioner summary](https://taxguru.in/rbi/rbi-issues-commercial-banks-cybersecurity-technology-risk-resilience-framework-directions-2026.html) — 31 July 2026 RBI PDF not fetched. Related on TechBag: the [Backup & Recovery guide](https://www.thetechbag.com/browse/backup-cyber-resilience/backup-recovery) narrows 18 products by workload, delivery and where the copy sits; the [DLP & Insider Risk guide](https://www.thetechbag.com/browse/data-security-privacy/dlp-insider-risk) compares the products that watch data leave. **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [Backup & Recovery guide](https://www.thetechbag.com/browse/backup-cyber-resilience/backup-recovery) — 18 products, and where each documents the copy can sit - [DLP & Insider Risk guide](https://www.thetechbag.com/browse/data-security-privacy/dlp-insider-risk) — 18 products that watch sensitive data leave - [Commvault Cloud Backup & Recovery](https://www.thetechbag.com/commvault/commvault-backup-recovery) — the 2024 pick, with an Indian SaaS region