Processing Logs
Records of operations performed on personal data, such as who accessed or changed it and when.
Processing logs are records of what was done with personal data, such as who opened, changed, shared or deleted a record and when.
Meaning of Processing Logs
Rule 8 requires fiduciaries to retain personal data, traffic data and processing logs for at least one year from the date of processing, for the purposes in the Seventh Schedule, such as investigating security incidents. Logs also contain personal data, so they need access control.
A processing log answers four questions about an operation on personal data: who did it, what was done, to which data and when. It can come from an application, a database, an identity system or a network device. The record usually includes a user ID, a time stamp, an action such as view or export, and an identifier of the record or system involved.
The DPDP Rules 2025 deal with such logs in two places. Rule 6 expects visibility over access to personal data through logs and monitoring, as part of reasonable security safeguards under Section 8(5) of the Act. Rule 8 requires a Data Fiduciary to retain personal data, traffic data and logs of processing for a minimum period of one year from the date of processing, for the purposes specified in the Seventh Schedule, after which they are erased unless another law requires further retention.
The Seventh Schedule purposes are tied to security and investigation, such as detecting, investigating and remedying incidents. This is why logs are kept even for people who have withdrawn consent or asked for erasure. The retention is limited to what the Rules prescribe, and the logs should not become a secret second copy of the entire customer database.
A processing log is different from an ordinary application log of errors, and from a consent log that records permissions. It is also different from the personal data itself. Because logs mention identifiable users and customers, they are personal data, and the fiduciary must apply notice, security and erasure principles to them as well, while respecting the longer period that applies to the logs themselves.
Examples of Processing Logs
An application keeps a year of access logs showing each staff login and each record viewed.
A payments app keeps logs of each staff view of a merchant's settlement data. A year later, a dispute about a leaked report is resolved by tracing the exact user and time of access.
A SaaS HR provider keeps logs for customer data operations and can show each client who from its support team opened their files. Logs are accessible only to a small security team and are deleted after the [retention period](term/retention-period).
A reseller keeps call-centre records of which agent updated a subscriber's address. It finds the logs include full ID numbers in text fields and rewrites the logging rules to store only a record reference.
Why Processing Logs matters
Without usable processing logs, an organisation cannot prove who touched a record, which makes breach investigation, insider-misuse cases and rights requests hard to handle. If a Data Principal complains that her data was shared, the log is often the only evidence of what happened.
Rule 8 and Rule 6 together mean that a gap in retention can become a compliance finding, and weak protection of the logs can lead to a failure of safeguards with a penalty ceiling of ₹250 crore. A well-run log programme also helps with sector audits by RBI, IRDAI or SEBI and with CERT-In reporting.
How it works in practice
- 1Identify the systems that process personal data and switch on logs for access, change, export, sharing and deletion events at the record level, not only at login.
- 2Include the minimum fields: user or service ID, time with a reliable clock, action, system, and record or object identifier, while avoiding the content of the data itself.
- 3Send logs to a central store with restricted access and tamper protection, and apply role-based access so that only security and audit staff can read them.
- 4Set a retention rule of at least one year from the date of processing, extend it for any other law that requires more, and automate secure deletion once it ends.
- 5Test that you can answer a real question, such as who viewed this customer's file last month, within a reasonable time.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Keeping logs for 30 or 90 days only, because storage is costly: Rule 8 sets a minimum of one year for the logs it covers.
Storing sensitive content in the logs: record that a record was opened, not everything it contained.
Deleting logs on the day the Data Principal asks for erasure: the Rules allow retention of the logs for the prescribed period for security purposes.
Leaving logs open to wide staff access, which turns them into a new privacy risk.
Compliance tips
Write a short logging standard that lists the events, fields, retention and access rules for every system.
Use hashed or tokenised identifiers in logs where full identifiers are not necessary.
Check the sector rules you follow, since the longest period usually governs.
Common questions about Processing Logs
What are processing logs under the DPDP Rules?
They are records of operations performed on personal data, such as access, changes, sharing and deletion, with details of who did it and when. Rule 8 requires them to be retained for at least one year.
How long must processing logs be retained?
Rule 8 sets a minimum of one year from the date of processing for personal data, traffic data and processing logs for the purposes specified in the Seventh Schedule, unless other law requires longer retention.
Do I delete logs when a user asks for erasure?
Not necessarily. The Rules allow logs to be kept for the prescribed period for security and legal purposes. Delete the underlying data as required, and erase the logs when the retention period ends.
Are processing logs the same as consent records?
No. Processing logs show what happened to data. Consent records show what permission the Data Principal gave. Both are useful, and both need to be protected and retained for the right period.