What is the DPDPA?
The Digital Personal Data Protection Act 2023 is India's primary data protection legislation, now in force. It governs how personal data of Indian citizens is collected, processed, stored, and transferred. Violations can result in fines up to Rs.250 crore per incident, making cloud compliance a board-level concern.
Key DPDPA Requirements for Cloud Workloads
- Data Principal consent: Obtain clear, informed consent before collecting personal data
- Purpose limitation: Data can only be used for the purpose for which it was collected
- Data minimisation: Collect only what you need for the stated purpose
- Storage limitation: Delete personal data when it is no longer needed
- Data localisation: Certain sensitive categories may require storage within India
- Breach notification: Notify the Data Protection Board within prescribed timeframes
Azure and DPDPA: Microsoft's Compliance Tools
- India data residency: Azure India regions (Pune + Chennai) for data localisation requirements
- Microsoft Purview: Data governance, classification, and protection across M365 and Azure
- Azure Policy: Enforce data handling policies at the infrastructure level, prevent non-compliant deployments
- Customer Lockbox: Prevents Microsoft support staff from accessing your data without explicit approval
- Compliance Manager: Built-in DPDPA assessment templates in the Microsoft 365 Compliance Centre
AWS and DPDPA Compliance
- AWS Mumbai and Hyderabad regions for India data residency
- AWS Macie for automated PII discovery in S3 buckets
- AWS CloudTrail for complete audit logging of all API activity
- AWS Config for compliance rule enforcement and drift detection
- AWS Audit Manager for DPDPA evidence collection and reporting
DPDPA Cloud Compliance Checklist
- Map all personal data flows, what data, where stored, who accesses it, for what purpose
- Enable data residency controls, ensure Indian citizen data is stored in Indian cloud regions
- Implement consent management, track, record, and honour consent withdrawals
- Configure data retention policies, automated deletion when retention period expires
- Set up breach detection workflows and notification procedures
- Review your Data Processing Agreement with your cloud provider
- Train all staff who handle personal data on DPDPA obligations
- Appoint a Data Protection Officer if required for your organisation size and industry
How JSN Techmark Helps
We assist Pune and Maharashtra businesses with DPDPA-aligned cloud architecture. Our cloud assessment includes a DPDPA readiness review, mapping your current Azure or AWS configuration against the Act's requirements and identifying specific gaps to address.
Many businesses discover their current cloud setup already meets most DPDPA requirements, it simply needs to be properly documented and a few controls activated. Our review identifies exactly which ones.
Ready to Save on IT Costs?
Book a free IT & SAM audit. Our engineers will find your savings, at no cost.