Rule 6: Reasonable Security Safeguards

Quick summary

What Rule 6 says

• Appropriate data security measures, such as encryption, obfuscation, masking, or use of virtual tokens mapped to the data.
• Appropriate measures to control access to the computer resources used by the Data Fiduciary or a Data Processor.
• Visibility over access to personal data, through logs, monitoring and review, enabling detection, investigation and remediation of unauthorised access.
• Reasonable measures for continued processing in the event personal data's confidentiality, integrity or availability is compromised (e.g. through backups).
• Retention of relevant logs and personal data for at least one year for detection, investigation and remediation purposes, unless another law requires otherwise.
• Appropriate contractual provisions with any Data Processor, and appropriate technical and organisational measures generally.

Breaking it down

Six requirements, but they cluster into three practical themes:

Prevent (encryption, access control). Encryption, obfuscation, masking or tokenisation of the data itself, plus access controls over the systems that hold it — the baseline “lock the data and lock the door” measures.

Detect and respond (monitoring, logs, continuity). Logging and monitoring so unauthorised access can actually be noticed, not just prevented in theory; backup and continuity measures so a compromise doesn't mean permanent loss of the ability to keep operating.

Prove it (one-year log retention, contracts). Retaining security logs for at least a year isn't just good practice here — it's a specific requirement, useful for investigating a breach after the fact. And where a Data Processor is involved, the contract between the two needs to actually address security obligations, not leave them implicit.

Why this rule matters

Rule 6 is the rule breach-response and cybersecurity teams will be measured against after the fact. If a breach happens and a Data Fiduciary can't show it had these baseline measures in place, that gap becomes the story — both to the Data Protection Board and, potentially, to a court weighing the penalty under the Act's Schedule.

Real-world example

Who needs to care about this rule

• Security and IT teams — this is effectively your minimum-controls checklist.
• Procurement and legal teams negotiating Data Processor contracts (cloud vendors, outsourced support, payment processors).
• Anyone handling a breach investigation, where these logs and safeguards become the evidence of what was in place beforehand.

Common questions

Related rules