Obligation
Reasonable security safeguards are the technical and organisational measures a Data Fiduciary must take to protect personal data and prevent breaches.
A Data Fiduciary shall protect personal data in its possession or under its control, including in respect of any processing undertaken by it or on its behalf by a Data Processor, by taking reasonable security safeguards to prevent personal data breach.
Security is a standing duty, not an afterthought. The fiduciary must protect data it holds or controls, including data handled by its processors.
The measures must be reasonable and aimed at preventing a personal data breach. The Rules give more detail on what safeguards are expected.
Encrypting stored customer data, controlling access, and monitoring for intrusions are the kind of safeguards Section 8(5) expects.
What penalty applies for weak security?
A breach of the security duty may attract a penalty that may extend to two hundred and fifty crore rupees, the highest on the Schedule.
Does the duty cover my vendors?
Yes. It extends to processing done on your behalf by a Data Processor.