Reasonable safeguards, demonstrable.
India’s Digital Personal Data Protection Act, 2023 turns familiar privacy duties — safeguards, purpose limitation, breach readiness — into legal obligations with real penalties. cloakit turns each duty into vault policy and audit evidence. Coverage below describes platform direction.
What DPDPA actually demands.
The Act applies to digital personal data in India — and to processing outside India when it serves goods or services to people in India. If you hold Indian user data, these duties are yours whether your servers are in Mumbai or Virginia.
Notice + consent (Sec 6)
Collect only after clear notice and free, informed consent — or under a recognized legitimate use. Every purpose needs a basis you can show.
Reasonable safeguards (Sec 8)
Protect personal data with appropriate technical and organizational measures — encryption, access control, and logging are the expected core.
Breach notification (Sec 8)
Notify the Data Protection Board and affected principals when a breach occurs. Rules prescribe timelines and content — readiness beats scrambling.
Children’s data (Sec 9)
Processing children’s data needs verifiable parental consent, with no behavioral tracking or targeted ads. The strictest duties carry the worst headlines.
Principal rights
Access, correction, erasure, grievance redressal, and nomination. Rights requests must be fulfillable — repeatedly, not as one-off tickets.
Penalties (Sec 33)
Fines scale per contravention up to ₹250 crore. The Board can also direct remediation. Prevention is priced in rupees; evidence is your discount.
Retention limits
Keep data only as long as needed for its purpose or legal duty. Indefinite “just in case” storage is itself non-compliance.
Cross-border transfers
Transfers are permitted except to restricted territories the government may blacklist. Know where every copy lives — including backups and logs.
How each duty lands in the vault.
Safeguards → encryption + isolation
Per-field encryption, isolated vaults with key separation, and per-column token maps. Raw personal data exists in exactly one governed place.
Purpose → policy checks
Every detokenization declares a purpose; access outside it is denied by default. Consent scope becomes an enforceable rule, not a document.
Breach → blast-radius control
Downstream systems hold tokens, so a compromised warehouse or log bucket leaks references, not identities. The audit log gives you actor, purpose, and region per event for notifications.
Rights → lifecycle operations
Lookup plus token-lifecycle deletion fulfills access and erasure requests across every downstream copy at once — because copies hold tokens.
From zero to demonstrable.
Map the data
Inventory every system touching personal data — production, analytics, logs, support tools, vendors. Most teams find 3–5 shadow stores in week one.
Vault the originals
Post personal data SDK-to-vault at capture; replace downstream copies with tokens. Residency pinned to India where required.
Govern the uses
Attach purposes, age-aware rules for minors’ data, and retention windows. Every access becomes an auditable event.
Prove it
Export control mappings, audit trails, and the data map as your compliance kit — ready for the Board, buyers, and auditors alike.
Asked by teams facing DPDPA.
What counts as “reasonable security safeguards”?
The Act doesn’t publish a checklist — regulators look for appropriateness: encryption of personal data, strict access control, logging, and organizational discipline. cloakit’s vault architecture (encryption, key separation, per-field policies, full audit trails) is built to be the demonstrable technical core.
How fast must we notify breaches?
The Act requires notifying the Board and affected principals; draft rules prescribe short timelines and specific content. The teams that survive this are the ones with an audit log and a tokenized blast radius — notification becomes a query, not an investigation.
Do we need consent for everything?
No — the Act recognizes legitimate uses alongside consent. Either way, cloakit enforces the declared basis per access: consent-scoped or legitimate-use purposes are checked at detokenization time, not trusted.
What about existing data collected before the Act?
Backfill it: run historical columns through the vault once and replace downstream copies with tokens. One migration pass brings legacy stores under the same policy as new data.
We serve children. What changes?
Everything gets stricter: verifiable parental consent workflows, no behavioral tracking exposure, minimization by default, and review-ready trails. cloakit applies dedicated minor policies automatically once records are flagged.
Four weeks, four moves.
The 30-day path from data map to demonstrable safeguards — each week ends with an artifact an auditor can read.
Get the DPDPA walkthrough.
Bring your data map — or let us build it with you. Thirty minutes, engineer-led.