Log retention in India: CERT-In 180 days, DPDP one year
Reviewed against the law as of 28 September 2026
How long to keep logs in India: CERT-In's 180 days within India and one year under the DPDP Rules, which logs count, time sync and a checklist.
Two Indian requirements set how long you keep logs, and they differ.
| Requirement | Period | Where | Purpose |
|---|---|---|---|
| CERT-In Directions, 28 April 2022 | Rolling 180 days | Within Indian jurisdiction | Provide to CERT-In for incident response |
| DPDP Rules, 2025 (security safeguards) | At least one year | Not specified | Detect, investigate and remediate personal data breaches |
The practical answer: keep the logs that matter for at least one year, with the retained copy in India.
Which logs count
CERT-In refers to logs of all ICT systems. For DPDP purposes, the Rules refer to personal data, associated traffic data and logs of processing. In practice, include:
- cloud control-plane audit logs (for example AWS CloudTrail, Azure Activity Log, Google Cloud Audit Logs);
- identity provider sign-in and administrative logs;
- access logs for storage holding personal data;
- database audit logs for tables with personal data;
- firewall, VPN, DNS and proxy logs;
- application logs that record access to personal data.
Common failures
- Default retention. Many services keep logs for 30 or 90 days unless configured.
- Wrong region. Central logging in a region outside India.
- Not enabled. Audit logging disabled in some regions or accounts.
- No access logs on the buckets that hold customer exports.
- Tampering risk. Logs writable by the same administrators they record.
Time synchronisation
Logs are only useful in an investigation if timestamps agree. CERT-In requires ICT clocks to be synchronised with the NTP servers of the National Informatics Centre (NIC) or the National Physical Laboratory (NPL), or servers traceable to them. Check servers, containers, network devices and appliances.
Logs are personal data
Logs hold IP addresses and user identifiers, so they need protection too: restricted access, integrity controls, and deletion when the retention period ends.
Checklist
- Audit logging enabled in every account and region.
- Retention of at least 365 days on log stores.
- Retained copy in an Indian region.
- Access logging on storage with personal data.
- NTP configured to NIC or NPL, or traceable servers.
- Write-once or restricted-delete protection on log stores.
TrustNiq tests audit logging, retention periods, log location and time synchronisation across your accounts and shows which resources fail. Start a free trial.
Frequently asked questions
Do CERT-In logs have to be stored in India?
The Directions require logs of ICT systems to be maintained securely for a rolling period of 180 days within Indian jurisdiction. Keeping the retained copy in an Indian cloud region is the simplest way to show this.
Which retention period applies, 180 days or one year?
Both apply to different requirements. Keeping relevant logs for at least one year, with the copy held in India, satisfies both.
Which clocks must be synchronised?
ICT system clocks must be synchronised to the NTP servers of NIC or NPL, or servers traceable to them.
Sources
- CERT-In Directions, 28 April 2022cert-in.org.in
- Digital Personal Data Protection Rules, 2025meity.gov.in
This article is general information about Indian law as published at the date above, written to help organisations plan their compliance work. It is not legal advice. Check the official text and take advice on your own facts.