Is Your Cloud Infrastructure Compliant with India’s DPDP Act 2023?

Your cloud infrastructure is not DPDP compliant simply because it runs on AWS, Azure, or Google Cloud. Compliance depends on how your organization collects, processes, stores, secures, accesses, retains, and deletes digital personal data across its cloud environment.

This distinction is important for Indian B2B companies.

The Digital Personal Data Protection Act, 2023 (DPDP Act) establishes obligations around the processing of digital personal data. The Digital Personal Data Protection Rules, 2025 were notified later to support implementation. Together, they make data governance and cloud security an operational responsibility—not just a legal or policy requirement.

So, the question for a business should not be:

“Are we using a compliant cloud provider?”

It should be:

“Can we demonstrate that personal data in our cloud environment is properly controlled and protected?”

That requires visibility across your infrastructure.

What Does DPDP Compliance Mean for Cloud Infrastructure?

For cloud infrastructure, DPDP compliance means having the technical and organizational controls needed to support lawful processing and protect digital personal data under your control.

This includes understanding:

• Where personal data is stored
• Which applications process it
• Who can access it
• Which third parties or processors handle it
• Whether security controls are in place
• How personal data is retained and deleted
• How quickly a breach can be detected and investigated

The DPDP Act places responsibility on the Data Fiduciary for processing undertaken by it or on its behalf by a Data Processor, while also requiring appropriate technical and organizational measures and reasonable security safeguards.

In simple terms, moving personal data to the cloud does not transfer accountability for protecting that data.

A Quick DPDP Cloud Compliance Checklist

Your cloud environment should be able to answer these questions:

1. Do you know where personal data exists?
2. Do you know who can access it?
3. Are sensitive data stores protected against unauthorized exposure?
4. Can you detect unauthorized access or security misconfigurations?
5. Do you maintain logs that support investigation?
6. Do you have backup and recovery controls for critical data?
7. Can you identify and investigate a personal data breach?
8. Do you have contracts and controls for cloud-based Data Processors?
9. Can you enforce data retention and deletion requirements?
10. Can you demonstrate that your controls are working?

If several of these questions cannot be answered clearly, your organization may have a compliance gap.

1. Do You Know Where Personal Data Is Stored?

The first challenge is data visibility.

Personal data may exist across:

• Cloud databases
• Object storage
• SaaS applications
• Virtual machines
• Backups
• Data warehouses
• Analytics platforms
• Development and test environments
• Application logs

For many organizations, the problem is not a lack of security tools.

It is a lack of complete visibility.

A database may be protected while an exported copy of the same data sits in an improperly secured storage location.

What to Review

Identify every cloud service that stores or processes personal data.

Then classify:

• What type of personal data exists
• Why it is being processed
• Who owns the data
• Which application uses it
• How long it needs to be retained

You cannot effectively protect personal data that you cannot locate.

2. Is Access to Personal Data Properly Controlled?

Identity and access management is one of the most important cloud security controls.

Excessive permissions can allow users, applications, or service accounts to access more data than required.

The risk increases when organizations have:

• Shared administrator accounts
• Unused credentials
• Excessive permissions
• Long-lived access keys
• Unmonitored service accounts
• No regular access reviews

The DPDP framework requires appropriate security safeguards and technical and organizational measures. Access control is therefore a critical part of a cloud compliance program.

What to Review

Audit:

• Privileged accounts
• Access to production data
• Service account permissions
• Inactive users
• Third-party access
• Administrative roles

The objective should be simple:

Only the people and systems that need access to personal data should have it.

3. Is Personal Data Exposed Through Cloud Misconfigurations?

A cloud environment can have strong policies and still contain technical misconfigurations.

Common examples include:

• Publicly accessible storage
• Public database endpoints
• Overly permissive security groups
• Unrestricted inbound access
• Disabled encryption
• Exposed credentials
• Unnecessary public IP addresses

These issues can create an unnecessary attack surface.

A compliance assessment should therefore review actual infrastructure configurations—not just written security policies.

What to Review

Continuously monitor cloud environments for:

• Public exposure
• Excessive permissions
• Encryption gaps
• Network misconfigurations
• Logging gaps
• Unused but accessible resources

DPDP readiness requires evidence that security controls are operating in the actual cloud environment.

4. Can You Detect Unauthorized Access?

Detection is as important as prevention.

If an organization cannot identify who accessed a system, when they accessed it, or what happened afterward, investigating a potential breach becomes significantly more difficult.

The notified DPDP Rules include requirements around visibility into access through appropriate logs, monitoring, and review for detecting and investigating unauthorized access.

What to Review

Your cloud environment should provide sufficient visibility into:

• Authentication events
• Privileged activity
• Access to sensitive systems
• Configuration changes
• Unusual activity
• Security alerts

Logging without monitoring is not enough.

Logs must be available, reviewed, and usable during an investigation.

5. Can You Recover From Data Loss or a Security Incident?

Data protection is not only about preventing unauthorized access.

Organizations must also consider what happens when data becomes unavailable.

The DPDP Rules specifically include measures supporting continued processing when confidentiality, integrity, or availability is compromised, including measures such as backups.

This makes backup and recovery relevant to compliance readiness.

What to Review

Assess:

• Backup coverage
• Backup encryption
• Recovery procedures
• Recovery testing
• Data restoration capabilities
• Ransomware resilience

A backup that has never been tested may not provide the protection your organization expects during an incident.

6. Can You Respond to a Personal Data Breach?

A breach response plan should not begin after an incident occurs.

Organizations need to know:

• Who identifies the incident
• Who investigates it
• Which systems contain the relevant logs
• How affected data is identified
• Who is responsible for notifications
• How remediation is tracked

The DPDP Act requires intimation of personal data breaches to the Board and affected Data Principals in the prescribed form and manner. The 2025 Rules further define notification requirements and timelines.

What to Review

Run incident response exercises that test whether your teams can:

• Detect an incident
• Identify affected systems
• Determine what data was involved
• Contain the issue
• Preserve evidence
• Restore affected services

The real test is not whether you have an incident response document. It is whether your cloud teams can execute it.

7. Do You Have Control Over Your Cloud Data Processors?

Most B2B companies rely on external cloud providers, SaaS platforms, managed service providers, and other third parties.

The DPDP Act allows Data Fiduciaries to engage Data Processors under a valid contract, while responsibility for compliance remains with the Data Fiduciary for processing undertaken on its behalf.

This means vendor management should not stop after procurement.

What to Review

Understand:

• Which processors handle personal data
• What data they process
• Where the data is processed
• What security obligations exist
• What happens during an incident
• How data is returned or deleted

Cloud compliance requires visibility beyond infrastructure you directly manage.

8. Are You Retaining Personal Data Longer Than Necessary?

Cloud storage makes it easy to retain data indefinitely.

Backups remain. Old databases remain. Test environments retain production copies. Logs continue growing.

But retention creates risk.

The DPDP Act contains obligations relating to the erasure of personal data when consent is withdrawn or the specified purpose is no longer being served, subject to legal requirements.

What to Review

Identify:

• Unused databases
• Old backups
• Dormant storage accounts
• Production data copied into development environments
• Expired customer records
• Unnecessary log retention

Data lifecycle management should be connected to your cloud infrastructure.

DPDP Compliance Is Not a Cloud Provider Certification

One of the biggest misconceptions is that using AWS, Azure, or Google Cloud automatically makes an organization compliant.

Cloud providers offer infrastructure and security capabilities.

But your organization still decides:

• What data is collected
• Where data is stored
• Who receives access
• How applications process data
• How long information is retained
• How cloud services are configured

The cloud provider provides the platform. Your organization remains responsible for how personal data is handled within the services it uses.

This is why DPDP compliance requires collaboration between legal, security, compliance, application, and cloud infrastructure teams.

A Practical 5-Step DPDP Cloud Readiness Assessment

Step 1: Discover Personal Data

Identify where digital personal data exists across your cloud environment.

Create a data inventory that connects data stores with applications and business owners.

Step 2: Review Infrastructure Exposure

Check for:

• Public storage
• Public databases
• Excessive network exposure
• Missing encryption
• Weak identity controls

Prioritize findings based on the sensitivity and exposure of the data.

Step 3: Audit Access

Review who has access to systems processing personal data.

Remove unnecessary permissions and regularly review privileged access.

Step 4: Validate Logging and Incident Response

Confirm that your teams can detect, investigate, and respond to unauthorized access and potential breaches.

Test the process.

Step 5: Establish Continuous Monitoring

Cloud environments change constantly.

New resources, identities, applications, and configurations can introduce new risks.

A one-time compliance assessment is therefore not enough.

Continuous monitoring helps organizations identify configuration drift and new exposure before they become larger compliance problems.

The Biggest DPDP Risk Is Often Lack of Visibility

For many B2B companies, the biggest challenge is not understanding that data must be protected.

It is understanding where the risks currently exist.

An organization may have security policies, compliance documents, and cloud security tools but still lack answers to basic questions:

• Which databases contain personal data?
• Which storage locations are publicly accessible?
• Who has administrative access?
• Are sensitive workloads continuously monitored?
• Can we identify the systems affected by a breach?
• Can we produce evidence that controls are working?

These are infrastructure questions.

And without clear answers, compliance becomes difficult to demonstrate.

Frequently Asked Questions

Does the DPDP Act apply to cloud infrastructure?

The Act applies to the processing of digital personal data within its scope. Cloud infrastructure becomes relevant when it stores, processes, transmits, or supports systems handling that personal data.

Does using AWS, Azure, or Google Cloud make a company DPDP compliant?

No. Cloud providers provide security capabilities and infrastructure, but compliance depends on how the organization processes, secures, accesses, retains, and manages personal data within its environment.

What cloud security controls support DPDP compliance?

Important controls include access management, encryption, network security, logging, monitoring, backup and recovery, incident response, and continuous configuration monitoring. The exact requirements should be assessed against the organization’s processing activities and legal obligations.

Can a cloud misconfiguration create a DPDP compliance risk?

Yes. A publicly exposed database, excessive permissions, disabled logging, or other security weaknesses can increase the risk of unauthorized access to personal data.

Is DPDP compliance a one-time assessment?

No. Cloud environments change continuously. Organizations should continuously review security controls, access, configurations, and data exposure.

Final Answer: Is Your Cloud Infrastructure DPDP Compliant?

Your cloud infrastructure is DPDP-ready only when you have clear control and visibility over the personal data it processes.

That means knowing where the data exists, controlling access, securing infrastructure, monitoring for unauthorized activity, maintaining recovery capabilities, managing third-party processors, and being prepared to respond to a breach.

For Indian B2B companies, the practical starting point is not a compliance certificate.

It is a cloud infrastructure assessment.

Start by asking one question: Can we identify where personal data exists and demonstrate how it is protected?

If the answer is unclear, that is where your DPDP readiness assessment should begin.