Which logs must we keep, for how long, and where?

Short answer: At least one year; 180 days of ICT logs in India

Keep logs that show who accessed personal data and what they did, for at least one year under the DPDP Rules. CERT-In separately asks for ICT system logs to be kept for 180 days within India. Logs must be protected so nobody can quietly change them.

What the law says

Rule 6 lists logs and monitoring as a minimum safeguard. Rule 8(3) asks for logs to be kept for at least one year. The CERT-In Directions of 2022 ask for 180 days of ICT logs kept within India.

Section 8(5) · Rule 6: Protect personal data with reasonable security safeguards. Rule 6 lists the minimum: encryption, masking or tokenisation; access control; logs and monitoring; backups for continuity; keeping logs for at least one year; and security terms in contracts with processors.
Section 8(7) · Rule 8: Erase personal data when its purpose is over or consent is withdrawn, unless a law requires you to keep it, and have your processors erase it too. Rule 8(3) asks every Data Fiduciary to keep personal data, traffic data and logs for at least one year for purposes listed in the Rules.

Steps

List systems holding personal data and what each logs today.
Turn on access logging where it is missing.
Send logs to one protected store, with at least one year of retention.
Keep a copy of ICT logs in India for at least 180 days.
Sync clocks and review alerts every day.

Evidence to keep

Log source list
Retention settings
Alert review records

Common mistakes

Logging only failures, not who viewed a record
Logs stored on the same server they describe
Clocks out of sync, so timelines cannot be built

How it plays out by sector

Banking, financial services and insurance: Core banking, internet banking and card systems already log heavily. Check retention and that logs stay in India.
IT, ITeS, BPO and GCC: Keep logs of access to client systems, as well as your own systems.
Central government: ministries and departments: Integrator-run systems must give the department access to logs.
Public sector undertakings and utilities: Consumer systems and township systems both need logging.
Healthcare and hospitals: HIS and PACS access logs show who opened which record; keep them a year.

From each seat

CISO / Security head: Check retention on every log source against one year, and make sure ICT logs stay in India for 180 days. Logs that can be edited by the admins they record are weak evidence.
CIO / IT head: Make sure applications log who viewed a record, not only system errors. That is what a request or a breach review needs.
IT department: Set retention on every log source: one year for DPDP, and 180 days in India for CERT-In.

What a good answer from management sounds like

“Every system with personal data sends access logs to a protected store kept for one year, with a copy in India.” Effort and time: Medium · 6 to 12 weeks.