On this page
- Why an unpatched website flaw is a DPDP compliance issue
- Where Indian websites expose personal data when server software is outdated
- What reasonable security safeguards require on your web stack
- How the 72-hour breach clock runs after a website compromise
- Our view: a seven-step web-security hygiene plan for Indian businesses
- Common questions
- In the news
- Sources
When national cybersecurity coordinators warn that tens of thousands of Indian websites run vulnerable server software—including recent alerts covering nearly 60,000 PHP-based portals and web applications—the risk extends far beyond website defacement. Any public-facing website that collects inquiry forms, customer logins, online payments, patient bookings or job applications is a gateway to personal data. Under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, an unpatched website vulnerability that allows unauthorized access to customer records triggers strict statutory liability from 13 May 2027.
Why an unpatched website flaw is a DPDP compliance issue
Many small and mid-sized businesses treat website maintenance as an occasional design task handled by an external web agency or freelance developer. Once the site goes live, server runtimes, content management plugins, contact-form scripts and database connectors often sit unpatched for years.
The data protection law defines a personal data breach broadly to include any unauthorized processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access that compromises the confidentiality, integrity or availability of personal data. When an automated scanner exploits a known web-server flaw—such as a remote code execution bug in an outdated PHP runtime—to dump a website's customer table or read uploaded documents, that event is a reportable personal data breach regardless of the size of the company.
Where Indian websites expose personal data when server software is outdated
Looking across typical business websites in India shows how quickly a web-server exploit turns into a statutory breach across multiple tables and folders.
| Website component | Personal data commonly stored on the server | Required DPDP Act and Rules safeguard |
|---|---|---|
| Inquiry, callback and lead-capture forms | Full names, mobile numbers, work emails, city and service requests stored in the web database | Encrypt database storage and backups; erase unaccepted lead inquiries when no longer needed |
| Customer account and checkout tables | Billing addresses, order histories, hashed passwords, session tokens, tax invoice records | Enforce strong access control on server administration panels; apply security patches promptly |
| Uploaded document folders | Job applicant resumes, identity proofs, clinic reports or loan documents saved in public web directories | Store uploads outside public web roots with obfuscation or encryption; restrict access by role |
| Web server and application logs | Visitor IP addresses, login attempts, database query logs, file-access histories | Maintain visibility logs to detect unauthorized access and retain traffic and processing logs for at least one year |
| Outsourced web hosting and agency access | Shared administrator accounts, unmonitored FTP or SSH keys held by external web developers | Sign a valid Data Processor contract with your hosting and maintenance vendor; revoke unused developer credentials |
| Incident detection and breach response | Web shell alerts, hosting provider abuse notices, database exfiltration indicators | Notify affected individuals without delay and file the six-point Data Protection Board report within 72 hours |
What reasonable security safeguards require on your web stack
The DPDP Rules set out specific baseline measures that every Data Fiduciary must take to protect personal data in its possession or under its control, including data processed by its web-hosting or development Data Processors:
- Data security and masking: Protect personal data through appropriate encryption, obfuscation, masking or virtual tokens so that a raw database table dump does not expose plain-text sensitive identifiers.
- Access controls: Enforce appropriate access controls on the computer resources that run your website, database and administration dashboard, eliminating shared passwords and open test endpoints.
- Visibility and one-year logs: Maintain visibility over who accesses personal data through appropriate logs, monitoring and review for enabling detection of unauthorized access, and retain those logs and traffic data for a minimum of one year.
- Continuity and backups: Maintain appropriate data-backups and recovery controls so that if an attacker or ransomware strain corrupts your web database, availability of personal data can be restored safely.
- Data Processor contracts: Include mandatory security and reporting provisions in the contract with every web-hosting company, cloud provider and digital agency that manages your site.
How the 72-hour breach clock runs after a website compromise
When a web-server vulnerability is exploited and customer or applicant records are accessed, waiting weeks to clean up the server quietly is not lawful once the enforcement provisions take effect on 13 May 2027. On becoming aware of a personal data breach, the website owner must give each affected individual a clear, plain-language notice without delay explaining what happened, the likely consequences, the mitigation steps taken, what safety steps the user should take and the business contact of the responsible officer.
In parallel, the organisation must send an initial intimation to the Data Protection Board of India without delay, followed within 72 hours by a detailed filing covering the updated facts, the events that led to the breach, mitigation actions, findings on the person who caused the breach, remedial measures to prevent a repeat and a report on the customer notifications sent.
Our view: a seven-step web-security hygiene plan for Indian businesses
In our view, business owners, IT managers and web teams running PHP, WordPress, custom portals or e-commerce sites should complete seven practical checks ahead of 13 May 2027:
- Upgrade your web server runtime, content management system and plugins to supported versions and subscribe to national cybersecurity advisories so critical patches are applied within hours.
- Stop storing contact-form leads or uploaded customer files indefinitely on your public web server; move them to an encrypted internal system and purge old web-form rows on a fixed schedule.
- Move uploaded resumes, identity documents and invoices out of publicly guessable web folders and protect them behind authenticated, role-checked downloads.
- Turn on web-server access logs, admin login logs and database audit logs, and ship them to tamper-evident storage retained for at least one year.
- Remove dormant administrator accounts belonging to former agencies or freelancers, and require multi-factor authentication for every remaining admin user.
- Sign a written Data Processor addendum with your web-hosting provider and maintenance agency covering encryption, patching SLAs and immediate breach escalation.
- Prepare a pre-drafted customer breach notice and 72-hour Data Protection Board reporting pack so your team is never drafting notices from scratch during an incident.
Common questions
If an external web agency or hosting company manages our PHP website, are we still liable under the DPDP Act?
Yes. The business that decides why and how customer or visitor personal data is collected on the website is the Data Fiduciary and remains legally responsible for compliance, even when hosting or maintenance is outsourced to a Data Processor.
What security controls must an Indian business website maintain under the DPDP Rules?
The Rules require reasonable security safeguards including encryption, obfuscation or masking of personal data, access controls on web servers and admin panels, visibility logs retained for at least one year, data backups, and security clauses in hosting contracts.
Does a compromised contact form or uploaded-resume folder count as a reportable personal data breach?
Yes. Any unauthorized access, disclosure or acquisition that compromises the confidentiality, integrity or availability of personal data stored on your web server is a reportable personal data breach.
How long must web-server access and database processing logs be kept under the Rules?
Traffic data and processing logs must be retained for a minimum period of one year from the date of processing so unauthorized access can be detected and investigated.
Next steps
- Check whether the DPDP Act applies to your business, free, in a few clicks
- How-to 04: Set the rules, in the toolkit
- How-to 11: When something goes wrong, in the toolkit
- The free duties list, every duty in plain words
In the news
Global Response to PHP Security Vulnerabilities as CERT-In Issues Warning
Reports coordinated international and CERT-In patching alerts addressing critical PHP web-server vulnerabilities affecting Indian portals.
DPDP Act & Rules takeaway: Reinforces our website security guide: unpatched web runtimes that expose customer inquiry or login tables trigger DPDP Section 8(5) and Rule 7 breach liability.
View statutory briefing illustration
Source & Courtesy Reference: Observer Voice (original report)CERT-In PHP2Shell Alert: India, UK Warn of Critical PHP Flaws Threatening Websites Worldwide
Joint cybersecurity warning on critical PHP remote code execution flaws enabling web-shell compromise across unpatched websites.
DPDP Act & Rules takeaway: Explains why website owners must patch server runtimes, encrypt form databases, and keep 1-year server logs under DPDP Section 8(5) and Rule 6.
View statutory briefing illustration
Source & Courtesy Reference: Sikkim News (original report)'India’s cybersecurity agency has flagged 60,000 vulnerable PHP sites': MeitY Secy S Krishnan
MeitY Secretary S Krishnan stated that India's cybersecurity agency flagged nearly 60,000 vulnerable PHP-based websites requiring urgent patching.
DPDP Act & Rules takeaway: Our article breaks down how an unpatched website flaw becomes a reportable personal data breach under the DPDP Act and how to lock down web forms and hosting vendors.
View statutory briefing illustration
Source & Courtesy Reference: The New Indian Express (original report)
Videos
Sources
Every section, rule and date above was checked against the official text on 24 Oct 2026.
Digital Personal Data Protection Act, 2023 (No. 22 of 2023)
- Section 2(i)Data Fiduciary definition
- Section 2(k)Data Processor definition
- Section 2(u)Personal data breach definition
- Section 8(1)Data Fiduciary responsibility for compliance by Data Processors
- Section 8(2)Valid contract required to engage a Data Processor
- Section 8(5)Duty to protect personal data by taking reasonable security safeguards
- Section 8(6)Duty to notify the Board and each affected Data Principal of a personal data breach
- The Schedule, items 1 and 2Penalty ceilings: up to ₹250 crore for security safeguards breach; up to ₹200 crore for failure to report a breach
DPDP Rules, 2025 (G.S.R. 846(E), 13 November 2025)
- Rule 6(1)Encryption, masking, access control, visibility logs, backups, one-year log retention and processor contract clauses
- Rule 7(1)Immediate plain-language breach intimation to each affected individual
- Rule 7(2)Immediate Board intimation and detailed six-point report within 72 hours
- Rule 8(3)Minimum one-year retention of personal data, traffic data and logs
- Seventh SchedulePurposes for one-year retention of logs and records
Notifications
- G.S.R. 843(E), clause (c)Substantive security and breach duties in force from 13 May 2027
A drafting aid. Get legal advice for your situation. This article explains the published text of the Act and the Rules.
