Meet India's SPDI Rules with evidence of reasonable security

The SPDI Rules are India's Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. Notified on 11 April 2011 under Section 43A of the Information Technology Act, 2000, they require body corporates to publish a privacy policy, obtain consent before collecting sensitive personal data, limit disclosure and transfer, and protect the data with reasonable security practices and procedures.

Rule 3 defines sensitive personal data or information as personal information about passwords, financial information such as bank account, credit or debit card details, physical, physiological and mental health conditions, sexual orientation, medical records and history, and biometric information. Information that is freely available or accessible in the public domain, or provided under the Right to Information Act, is not treated as sensitive personal data.

Any body corporate, or person acting on its behalf, that collects, receives, possesses, stores, deals with or handles sensitive personal data or information in India must comply. This covers companies, firms and other associations carrying on commercial or professional activities, including Indian subsidiaries of foreign groups, SaaS providers and outsourcing businesses.

Under Section 43A of the IT Act, a body corporate that is negligent in implementing reasonable security practices and so causes wrongful loss or gain to any person is liable to pay damages by way of compensation to the affected person. Claims are heard by adjudicating officers or courts, so the exposure depends on the harm caused rather than a fixed fine.

Rule 8 names IS/ISO/IEC 27001 as one example of a standard that meets the requirement for reasonable security practices and procedures. Organisations following ISO 27001, or another code of best practices approved by the Central Government, are treated as complying, provided their practices are audited periodically by an independent auditor approved by the Government. Many organisations use ISO 27001 controls as their SPDI evidence base.

Yes. Section 44(2) of the Digital Personal Data Protection Act, 2023 omits Section 43A of the IT Act, which is the legal basis for the SPDI Rules. The DPDP Rules were notified on 13 November 2025 with phased commencement, and Section 44(2) is scheduled to commence on 13 May 2027. Until then, the SPDI Rules continue to apply, so organisations should comply with both regimes during the transition.

Start by identifying the sensitive personal data you hold, then publish a privacy policy, obtain written consent for collection, appoint a grievance officer and limit disclosure and transfer to what the Rules allow. Finally, implement a documented information security programme with managerial, technical, operational and physical controls, such as ISO 27001, and have it independently audited.

Yes. OneClickComply supports the SPDI Rules today, mapping them to a shared control set so evidence collected for ISO 27001 or other frameworks counts here too. It generates the policies you need, collects evidence automatically from connected tools, and monitors controls continuously. OneClickComply does not issue certifications, but our audit team can help you prepare for independent audit.