Encryption as a DPDPA Requirement
The Digital Personal Data Protection Act requires organizations to implement "reasonable security safeguards" to protect personal data. While the Act does not prescribe specific technical measures, encryption is universally recognized as a baseline safeguard -- and the 2025 implementation rules make clear that organizations will be judged on the adequacy of their technical protections.
This guide covers practical encryption strategies for cloud environments that satisfy DPDPA requirements.
Encryption at Rest
Database Encryption
All databases storing personal data must be encrypted:
Managed database services (RDS, Azure SQL, Cloud SQL): Enable encryption at the instance level. This is typically a one-click setting that uses cloud-native KMS keys. Every new database should have encryption enabled by default.
Self-managed databases: Use Transparent Data Encryption (TDE) for SQL Server and Oracle, or filesystem-level encryption for PostgreSQL and MySQL. Mount encrypted EBS volumes or managed disks.
Key consideration: Database encryption protects against physical disk theft and unauthorized snapshot access. It does NOT protect against authorized database users accessing data they should not see. You need application-level controls for that.
Object Storage Encryption
S3 buckets, Azure Blob containers, and GCS buckets storing personal data: - Enable server-side encryption with KMS-managed keys (SSE-KMS) - Use bucket policies to deny unencrypted uploads - For highly sensitive data, use client-side encryption before upload - Enable versioning with encryption to protect historical data
Block Storage and Volumes
EBS volumes, Azure Managed Disks, and Persistent Disks: - Enable encryption by default for all new volumes (set this as an organizational policy) - Encrypt existing unencrypted volumes by creating encrypted snapshots and restoring from them - Use KMS keys with automatic rotation enabled
Encryption in Transit
TLS Configuration
All network communication carrying personal data must use TLS: - Minimum version: TLS 1.2 (TLS 1.3 preferred where supported) - Certificate management: Use ACM (AWS), Azure Key Vault, or cert-manager for automated certificate provisioning and rotation - Internal traffic: Do not assume internal network traffic is safe. Encrypt service-to-service communication using mTLS or service mesh encryption
API Encryption
- Enforce HTTPS-only for all API endpoints (redirect or reject HTTP requests)
- Use HSTS headers to prevent protocol downgrade attacks
- Configure strong cipher suites (disable RC4, 3DES, and other weak ciphers)
- Implement certificate pinning for mobile applications accessing your APIs
Database Connection Encryption
- Require SSL/TLS for all database connections (reject unencrypted connections)
- Use IAM-based authentication where supported (eliminates password transmission)
- Rotate database credentials regularly using automated secret rotation
Application-Level Encryption
Field-Level Encryption
For highly sensitive personal data (Aadhaar numbers, financial account numbers, health records), encrypt individual fields before storing them in the database:
Benefits: - Protection even if the database is compromised - Granular access control (different keys for different sensitivity levels) - Compliance with data minimization (encrypted fields cannot be queried or analyzed without decryption)
Implementation: - Use envelope encryption: generate a data encryption key (DEK) per record, encrypt the DEK with a KMS master key - Store the encrypted DEK alongside the encrypted data - Decrypt only when explicitly needed, and only for authorized users
Tokenization
For data that needs to be referenced but not read (payment card numbers, Aadhaar): - Replace sensitive values with non-reversible tokens - Store the mapping in a secure token vault - Use format-preserving tokenization to maintain data format for downstream systems
Key Management
Cloud KMS Best Practices
- Use cloud-native KMS (AWS KMS, Azure Key Vault, GCP Cloud KMS) for key management
- Enable automatic key rotation (annual rotation at minimum)
- Use separate keys for different data classifications
- Restrict key access using IAM policies (principle of least privilege)
- Enable KMS audit logging to track key usage
Key Hierarchy
Implement a key hierarchy for scalable encryption: 1. Master key (CMK): Stored in KMS, never leaves the service, used to encrypt data keys 2. Data encryption key (DEK): Generated per object/record, encrypted by the master key 3. Key encryption key (KEK): Optional intermediate layer for multi-tenant isolation
Multi-Region Key Replication
If your data is replicated across regions for disaster recovery: - Use multi-region KMS keys or replicate keys across regions - Ensure DR procedures include key availability verification - Test that encrypted data in the DR region can be decrypted using replicated keys
Compliance Monitoring
Automated Encryption Checks
Continuously verify encryption compliance: - AWS Config rules checking for unencrypted RDS instances, S3 buckets, and EBS volumes - Azure Policy checking for encryption at rest and in transit - Custom checks for application-level encryption compliance
Audit Trail
Maintain an audit trail for all encryption-related operations: - KMS key creation, rotation, and deletion events - Encryption and decryption API calls (CloudTrail, Azure Activity Log) - Access to encrypted data by user and role - Exceptions or failures in encryption operations
Getting Started Checklist
- Inventory personal data: Identify all storage locations containing personal data
- Enable encryption at rest: Turn on encryption for all databases, object stores, and volumes
- Enforce TLS: Require encrypted connections for all APIs and database connections
- Implement field-level encryption: For highly sensitive personal data (Aadhaar, financial data)
- Configure KMS: Set up key hierarchy with automatic rotation
- Automate compliance checks: Deploy Config rules or Policy definitions
- Audit regularly: Review encryption coverage and key access patterns quarterly
At Optivulnix, encryption architecture is a core component of our DPDPA compliance practice. We help organizations implement comprehensive encryption strategies that meet regulatory requirements without adding operational complexity. Contact us for a free encryption posture assessment.
