Logging and Monitoring
Recording activity on systems and watching those records to spot misuse or attacks.
Logging means keeping a record of what happens on your systems, and monitoring means watching those records so that misuse or attacks are spotted early.
Meaning of Logging and Monitoring
Rule 6 asks for visibility on how personal data is accessed through logs, monitoring and review, to detect unauthorised access and investigate it. Rule 8 requires logs to be kept for at least one year.
A log is a time-stamped entry that records an event: a login, a failed password, a file opened, a record exported, a setting changed. Monitoring turns those entries into alerts and reviews, either by people reading reports or by tools that flag unusual patterns such as a bulk download at midnight. Logging without monitoring is like a camera nobody watches.
Rule 6 of the DPDP Rules 2025 asks a Data Fiduciary for visibility on the accessing of personal data, through logs, monitoring and review, so that unauthorised access can be detected, investigated and remedied. It also refers to retaining relevant logs and personal data for a period of one year, unless another law requires something different. This supports the duty in Section 8(5) of the Act to prevent a personal data breach.
The Rule works with other obligations. Section 8(6) and Rule 7 require breach notification to the Board and to affected Data Principals, and a fiduciary cannot report what it cannot detect. Rule 8 separately deals with retention of logs and traffic data for the purposes listed in the Seventh Schedule. CERT-In directions add their own requirements, such as reporting cyber incidents within six hours and keeping certain logs for 180 days within India.
Logging differs from surveillance of individuals. The purpose is system security and accountability, so employee monitoring needs to be proportionate, explained in notices, and limited to the legitimate purpose. Logs also hold personal data, such as user IDs and IP addresses, so they need their own access control and retention discipline.
Examples of Logging and Monitoring
A system records which employee opened which customer file, and flags an unusual download of 10,000 records at midnight.
A retailer's system flags a support agent who opened 800 customer profiles in an hour. The security team suspends the account, checks the logs to see which records were viewed and notifies the affected customers.
A lender logs every query against its customer database with the user, time and purpose code. When a customer complains of misuse, the team traces the query to a specific officer within minutes.
A clinic has software that records changes but nobody reads the records. After a patient reports that her results were seen by a relative of staff, the clinic starts weekly reviews and enables alerts for access to flagged files.
Why Logging and Monitoring matters
Without logs and monitoring, an organisation may learn about a breach months later from a journalist or a regulator, and cannot tell which records were taken or whom to notify. A delay in notifying the Board and affected people, after discovery, can attract a penalty of up to ₹200 crore, while a failure of the underlying safeguards can reach ₹250 crore.
Good logs also protect the organisation. They can show that an employee, not the system, misused data, that a processor acted outside instructions, or that a suspected incident was in fact harmless. For individuals, early detection can mean the difference between a locked account and a drained bank balance.
How it works in practice
- 1Decide what to log: authentication events, access to personal data records, exports and bulk queries, administrative changes, permission changes and security tool alerts.
- 2Send logs to a central, protected store that administrators cannot edit, and synchronise clocks so that events from different systems line up.
- 3Set alert rules for patterns such as repeated failed logins, access from unusual locations, large exports and access to records by staff with no business reason, and assign a person to respond.
- 4Review logs and alerts on a fixed schedule, document findings, and feed lessons into your incident response plan.
- 5Retain relevant logs for at least one year, longer where CERT-In directions or sector rules require, and remove them securely afterwards.
- 6Tell employees what is monitored and why, through a clear policy.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Logging everything but reading nothing. Unmonitored logs give no early warning.
Letting administrators delete or alter logs. A log that can be edited has little value as evidence.
Writing personal data, such as full ID numbers or passwords, into logs. This creates a new, poorly protected dataset.
Keeping logs for a few weeks only. An incident found later then cannot be investigated.
Compliance tips
Start with the systems that hold the most personal data and add others in order of risk.
Test your alerts by simulating suspicious activity and checking that someone responds.
Match retention periods to the longest applicable requirement and record the reasons.
Common questions about Logging and Monitoring
What does Rule 6 say about logs and monitoring?
Rule 6 asks fiduciaries to have visibility over access to personal data through logs, monitoring and review, so that unauthorised access can be detected, investigated and remedied, and to retain relevant logs for one year.
How long should logs be kept under the DPDP Rules?
At least one year for the logs the Rules point to, unless another law requires a different period. CERT-In directions separately ask for certain logs to be kept for 180 days within India.
Is employee monitoring allowed for security?
Monitoring systems for security is expected, but it should be proportionate, tied to a clear purpose and explained in policy and notices. This is general information, so check your facts with a qualified adviser.
Are logs personal data?
Often yes. Logs can include user IDs, IP addresses and records of what a person did. They therefore need access control, security and a [retention period](term/retention-period) like any other personal data.