AMLEGALS — Strategic Lawyering
Data Security & Technical

Data encryption requirements in India: DPDPA security standards

Section 8(5) of the DPDPA requires every Data Fiduciary to protect personal data by taking “reasonable security safeguards to prevent a personal data breach.” The Act does not prescribe specific encryption algorithms or key lengths—but the concept of “reasonable”, read alongside Rule 6 and industry standards, points clearly to encryption as a baseline expectation for both data at rest and data in transit.

Updated · Checked against the DPDP Act, 2023 and the DPDP Rules, 2025 · 3 min read

Read the guideAsk a question
Abstract geometric lock and key tessellation with layered shield motif on navy and gold background
Short answer

The DPDPA does not mandate specific encryption algorithms. Section 8(5) requires “reasonable security safeguards”—and Rule 6 requires technical measures “appropriate to the nature and volume of personal data.” Industry practice, the Board’s eventual enforcement posture and sector-specific mandates (RBI, SEBI, CERT-In) will define what “reasonable” means. Encryption of personal data at rest (AES-256 or equivalent) and in transit (TLS 1.2+) is the de facto baseline.

  • Data Encryption
  • DPDPA
  • Security Safeguards
  • Section 8(5)
  • Data Security
Key provision
Section 8(5), Rule 6
Standard
Reasonable safeguards (context-dependent)
Baseline (at rest)
AES-256 or equivalent
Baseline (in transit)
TLS 1.2+

Encryption at rest: protecting stored personal data

Encryption at rest protects personal data stored in databases, file systems, backups and archives. The industry baseline is AES-256 (Advanced Encryption Standard, 256-bit key length)—widely supported by cloud providers (AWS KMS, Azure Key Vault, Google Cloud KMS) and database engines (PostgreSQL, MySQL TDE, MongoDB encryption).

  • AES-256 for database-level encryption (transparent data encryption or column-level)
  • Encrypted backups—unencrypted backup copies of encrypted databases defeat the purpose
  • Key management: encryption keys stored separately from encrypted data, with access-controlled key rotation
  • Full-disk encryption for employee devices that store or access personal data
  • Encrypted archives for data retained under sector-specific mandates

Encryption in transit: protecting data in motion

Encryption in transit protects personal data moving between systems—browser to server, server to database, API to API. The baseline is TLS 1.2 or later (TLS 1.3 preferred). Older protocols (SSL 3.0, TLS 1.0, TLS 1.1) are deprecated and considered insecure.

  • TLS 1.2+ for all HTTPS endpoints—no fallback to TLS 1.0/1.1
  • Certificate management: valid certificates from trusted CAs, automated renewal
  • Internal traffic: encrypt service-to-service communication (mTLS) for microservice architectures
  • Email encryption: TLS for SMTP where personal data is transmitted by email
  • API security: enforce HTTPS-only with HSTS headers; reject plaintext HTTP connections

Sector-specific encryption mandates

Several sector regulators impose encryption requirements that go beyond the DPDPA’s general “reasonable safeguards” standard:

Sector-specific encryption mandates in India
RegulatorRequirementScope
RBIEnd-to-end encryption for UPI and digital paymentsPayment transactions and card data
SEBIEncryption of client data in trading systemsBroker and depository participant systems
CERT-InEncryption recommended in cyber-security directivesAll entities reporting to CERT-In
IRDAIEncryption of policyholder dataInsurance companies and intermediaries
NABHEncryption of patient health recordsNABH-accredited healthcare facilities

How AMLEGALS assists with encryption compliance

AMLEGALS is an Indian law firm. Its data privacy practice is led by Anandaday Misshra, Founder and Managing Partner, with Rohit Lalwani, Associate Partner, working on DPDPA compliance. The firm advises organisations on interpreting the “reasonable safeguards” standard, mapping encryption requirements across the DPDPA and sector-specific regulators, and designing security-safeguard frameworks that satisfy regulatory expectations.

Bottom line

The DPDPA sets a standard, not a specification. AES-256 at rest and TLS 1.2+ in transit are the de facto baseline—but what counts as “reasonable” scales with your data sensitivity, volume and sector.

Key terms
Reasonable security safeguards
The Section 8(5) standard—contextual, scaling with data sensitivity and volume. Not a fixed specification but a duty of care measured against industry practice.
Encryption at rest
Protecting stored data by converting it into ciphertext using an encryption algorithm (e.g. AES-256) so that it is unreadable without the decryption key.
TLS (Transport Layer Security)
A cryptographic protocol that encrypts data in transit between two systems. TLS 1.2+ is the current standard; TLS 1.0/1.1 are deprecated.
Questions and answers

Data Encryption Requirements: common questions

Does the DPDPA mandate AES-256 encryption?

No. The DPDPA requires “reasonable security safeguards” (Section 8(5)) without specifying algorithms. AES-256 is the industry baseline for encryption at rest; the Board’s enforcement will determine what “reasonable” means in practice.

Is TLS 1.2 sufficient for DPDPA compliance?

TLS 1.2 is the current baseline for data in transit. TLS 1.3 is preferred where supported. TLS 1.0 and 1.1 are deprecated and would likely not meet the “reasonable safeguards” standard.

What is the penalty for inadequate encryption?

Failing to implement reasonable security safeguards under Section 8(5) carries a penalty ceiling of up to ₹250 crore, as determined by the Board after inquiry. Inadequate encryption that leads to a breach would be assessed under this provision.

Do I need to encrypt internal microservice traffic?

If personal data flows between microservices, those channels should be encrypted (mTLS). An unencrypted internal channel that is compromised exposes personal data—the same risk as an unencrypted external channel.

Related guides

Privacy by Design

Embedding encryption into system architecture from the start.

Read →

Data Retention Policy

Encrypted storage during and after the retention period.

Read →

Cloud Data Privacy

Encryption in cloud infrastructure under the DPDPA.

Read →

Biometric Data Privacy

Encryption requirements for irreversible biometric data.

Read →
Contact

Need guidance on encryption compliance?

Submit a question about DPDPA security safeguards and encryption standards.

Or write to [email protected]

Your details

Name and email are enough to start. The reply comes from [email protected].

Your information is handled in accordance with our privacy obligations. No spam, ever.

Data Encryption Requirements: questions and answers

What is the legal framework for data protection in India?

India's framework is the Digital Personal Data Protection Act, 2023 (Presidential assent 11 August 2023; 44 sections) read with the Digital Personal Data Protection Rules, 2025, notified on 13 November 2025 (G.S.R. 846(E)) with 23 Rules and 7 Schedules.

When do DPDPA obligations apply to businesses?

The Act and Rules follow phased commencement. Institutional provisions commenced on 13 November 2025; Consent Manager provisions commence after 12 months on 13 November 2026; and the principal Data Fiduciary, rights, breach, security and enforcement provisions commence after 18 months on 13 May 2027.

What is the maximum penalty under DPDPA?

Highest listed maximum for a specified contravention: ₹250 crore under the Schedule to the Act. Penalties are imposed by the Data Protection Board of India after an inquiry, and Section 33(2) requires the Board to consider factors such as the nature, gravity and duration of the breach, the type of personal data affected, repetition, mitigation steps and proportionality.

Which provisions of the DPDPA and the DPDP Rules, 2025 are relevant to Data Encryption Requirements?

Under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025: notice — Section 5 read with Rule 3; consent — Section 6, with Consent Managers under Rule 4; reasonable security safeguards — Section 8(5) and Rule 6; personal data breach intimation — Section 8(6) and Rule 7; erasure — Section 8(7) and Rule 8; children's data — Section 9 and Rule 10; Significant Data Fiduciaries — Section 10 and Rule 13; Data Principal rights — Sections 11 to 14 and Rule 14; transfer outside India — Section 16 and Rule 15; penalties — Section 33 and the Schedule. Published by AMLEGALS (Anandaday Misshra, Founder & Managing Partner).

Who advises businesses on Data Encryption Requirements under India's DPDPA?

AMLEGALS, an Indian law firm, advises Data Fiduciaries, Data Processors and foreign companies on Data Encryption Requirements under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. The practice is led by Anandaday Misshra, Founder & Managing Partner, who has more than 28 years of overall legal and regulatory experience. Enquiries: https://amlegalsdpdpa.com/contact or [email protected] or [email protected].

What should I send AMLEGALS to get a scoped proposal on Data Encryption Requirements?

Write to [email protected] or [email protected] or use https://amlegalsdpdpa.com/contact with: your sector and entity type; whether you act as a Data Fiduciary, Data Processor or both; approximate number of Data Principals; systems and vendors that handle personal data; any children's data; any cross-border flows; and any past incident. With these facts a partner can propose a scope for Data Encryption Requirements rather than a generic checklist.

How do I get a first view of my DPDPA exposure on Data Encryption Requirements?

Use the DPDPA Exposure Assessment at https://amlegalsdpdpa.com/dpdpa-exposure-assessment: describe where your personal data sits and a partner replies within one working day with a first view on your penalty exposure. Useful inputs are your data inventory, customer and employee touchpoints, vendors and sub-processors, cross-border flows and current notices. The principal obligations commence on 13 May 2027. Content is general legal information and not legal advice.

Contact AMLEGALS about Data Encryption Requirements · DPDPA Exposure Assessment