Logs and Evidence Retention: What Cyber Teams Should Preserve
A log-governance framework covering security purpose, CERT-In 180-day requirement, future DPDP safeguards, time synchronisation, integrity, privacy, access and legal holds.
Logs are useful only if they exist, share a reliable clock, can be searched and have not been altered by the attacker or administrator under review.
The DPDP framework is phased. The 14 November 2025 commencement notification brought specified institutional and enabling provisions into force immediately; Consent Manager-related provisions follow after one year; most operating duties and Rules follow eighteen months after Gazette publication. As of 22 June 2026, the control should distinguish current obligations from future-state DPDP readiness.
CERT-In’s Directions require covered entities to securely maintain ICT-system logs for 180 days within Indian jurisdiction.
The DPDP Rules include future log and evidence-related safeguard requirements when the relevant provisions commence.
Logs can contain personal data, secrets and message content and therefore need access and minimisation controls.
What the organisation should understand
- The DPDP framework is phased. The 14 November 2025 commencement notification brought specified institutional and enabling provisions into force immediately; Consent Manager-related provisions follow after one year; most operating duties and Rules follow eighteen months after Gazette publication. As of 22 June 2026, the control should distinguish current obligations from future-state DPDP readiness.
- CERT-In’s Directions require covered entities to securely maintain ICT-system logs for 180 days within Indian jurisdiction.
- The DPDP Rules include future log and evidence-related safeguard requirements when the relevant provisions commence.
- Logs can contain personal data, secrets and message content and therefore need access and minimisation controls.
- Retention should distinguish operational search, security investigation, legal hold and archival integrity.
The five-point review
| Check | What to examine |
|---|---|
| Source | Identity, endpoint, network, cloud, database and application. |
| Content | Event, actor, object, result and risk. |
| Clock | Time source, zone and synchronisation. |
| Integrity | Write protection, centralisation and access. |
| Retention | CERT-In, future DPDP, sector and incident hold. |
Practical example
An application keeps login logs for seven days, while the company discovers an account takeover after a month. The root-cause evidence has expired despite cloud audit logs being available elsewhere.
How to apply the framework
Create a source-to-use map showing which incident questions each log can answer. Do not retain verbose payloads merely because storage is cheap.
Test retrieval during tabletop exercises. A contractual right to logs is not useful if a vendor takes two weeks to deliver them.
Operating workflow
Define the real process before selecting the legal label
Identify the people, data, systems, purpose, owner, processor, user journey and failure scenario. Review source, content and clock together. A policy statement or vendor assurance cannot replace evidence of how the live product behaves.
Separate current obligations from scheduled DPDP controls
Apply the 14 November 2025 commencement notification provision by provision. Continue complying with currently operative CERT-In, banking, telecom, insurance, employment, consumer, contract and criminal-law requirements. Build the scheduled DPDP workflow now, but do not describe a future provision as already enforceable.
Test and preserve evidence
Run the workflow in the live or controlled test environment. Preserve screenshots, approvals, logs, vendor responses, user communications, exceptions and remediation. Assign a named owner and completion date to every failed control so management can distinguish an operating safeguard from a policy intention.
Action checklist
- Inventory critical log sources.
- Synchronise clocks.
- Centralise and protect evidence.
- Apply 180-day CERT-In control where covered.
- Minimise sensitive content.
- Test search, export and legal hold.
Evidence to keep
- Log inventory
- Time-sync configuration
- Access and integrity controls
- Retention settings
- Incident export and custody record
Warning signs
- Logs disabled for cost
- Different time zones with no normalisation
- Administrators can erase their own logs
- Full passwords or tokens logged
- Vendor logs unavailable during incident
Finin2min takeaway
Privacy and cyber maturity are visible in operating behaviour: what the organisation collects, who can use it, how vendors are controlled, how users exercise choices, how incidents are handled and whether evidence survives scrutiny.