The Digital Personal Data Protection Act 2023 — India's landmark privacy law — places obligations on every organisation that processes personal data of Indian residents. With full enforcement from May 2027 and sector regulators already mandating in-India data residency, the window to deploy sovereign communications infrastructure is now.
Unlike the GDPR's six lawful bases, the DPDPA uses two: consent and legitimate uses. The architecture is simpler — but the penalties are not. And with sector regulators already enforcing data localisation, compliance is not a future obligation.
Signed into law on 11 August 2023 and operationalised through the Digital Personal Data Protection Rules 2025 (notified 13 November 2025), the DPDPA is India's first comprehensive digital personal data protection statute. It applies to any processing of digital personal data that occurs within Indian territory, or that relates to offering goods or services to individuals located in India. The Act is grounded in the Supreme Court's landmark Puttaswamy judgment (2017), which recognised the right to privacy as a fundamental right under Article 21 of the Constitution of India.
Authority: Data Protection Board of India (DPB) — established November 2025. Functions as adjudicator, not regulator. Appeals go to Telecom Disputes Settlement and Appellate Tribunal, then to the Supreme Court.
Lawful bases: Only two — consent (free, specific, informed, unconditional) and legitimate uses (Sec. 7: government functions, employment, medical emergencies, debt recovery, M&A, court orders). No equivalents to GDPR's legitimate interest or contractual necessity bases.
Data Fiduciary obligations: Notice before consent, data minimisation, accuracy, security safeguards, data deletion when purpose ends, grievance redressal mechanism, and processor contracts (Sec. 8).
Cross-border transfers (Sec. 16): Permitted to all countries unless the Central Government issues a blacklist order. As of May 2026, no countries have been blacklisted — but sector-specific localisation mandates from RBI, SEBI, and IRDAI already restrict financial data movement.
Data Principal rights: Right to access (Sec. 11), correction and erasure (Sec. 12), grievance redressal (Sec. 13), and nomination — designating a representative upon death or incapacity (Sec. 14).
Children's data (Sec. 9): Verifiable parental consent required for data principals under 18. Prohibition on tracking, behavioural monitoring, and targeted advertising directed at minors. No exceptions without Central Government approval.
Breach notification: All breaches — regardless of severity — must be notified to the DPB and affected Data Principals within 72 hours, including nature, extent, timing, location, and consequences of the breach.
Significant Data Fiduciaries (Sec. 10): Government-designated entities processing high-volume or sensitive data must appoint a DPO resident in India, conduct Data Protection Impact Assessments, maintain audit records, and undergo periodic audits.
The DPDP Rules 2025 notified on 13 November 2025 implement the DPDPA in three phases: Phase I (Nov 2025) — Data Protection Board constituted; Phase II (Nov 2026) — Consent Manager registration opens; registered intermediaries enable data principals to manage consent across multiple fiduciaries. Phase III (May 2027) — All core operational obligations become enforceable, including consent frameworks, security requirements, and grievance mechanisms. Organisations that begin sovereign deployment now complete their technical and architectural compliance before enforcement begins.
India's compliance challenge is unique globally: a single sovereign communications deployment must satisfy the DPDPA and three major sector regulators simultaneously. One architecture satisfies all four.
Applies to all sectors processing digital personal data. Consent, security safeguards, breach notification, children's data protection, and Data Principal rights — enforced by the Data Protection Board from May 2027. Penalties up to ₹250 crore per violation.
Payment System Data Storage directive (2018, enforced 2019): all payment system data — including full end-to-end transaction data — must be stored exclusively in India. Applies to banks, NBFCs, payment aggregators, card networks, and all RBI-regulated entities. No exceptions.
Critical financial market data — credit risk data, market trading data, client data, and audit records — must remain on systems located in India. Applies to exchanges, brokers, custodians, and all SEBI-regulated market infrastructure institutions. Data sovereignty is already enforced.
Policy data, claim records, and customer personal data for India's 500 million+ insurance customers must be stored on India-based systems. Applies to all insurers and intermediaries. Cross-border transfer of policyholder data requires regulatory approval.
Every obligation that touches communications infrastructure is addressed at the platform level — architecture first, documentation second.
The Central Government designates Significant Data Fiduciaries based on processing volume, sensitivity, national security risk, and impact on Data Principal rights. SDFs face obligations beyond standard Data Fiduciaries — and the platform is designed to be their compliance backbone.
Indian IT/BPO firms processing global client data, financial institutions handling millions of transactions, healthcare platforms managing patient records, and government-linked digital platforms are all candidates for SDF designation. SDFs face four obligations beyond standard compliance:
DPO must be resident in India, appointed by the Board of Directors, and serve as point of contact for both Data Principals and the Data Protection Board.
Formal DPIA required before beginning high-risk processing activities. Must cover risks to Data Principal rights and mitigation measures — similar to GDPR Art. 35 but India-specific in scope.
Independent audits of data processing activities, security measures, and compliance posture. The platform's open-source, auditable architecture makes audit preparation straightforward.
India's data protection landscape is uniquely multi-layered. The DPDPA's Sec. 16 cross-border transfer regime is still evolving — no blacklist has been issued — but the risk is already real: sector regulators have been enforcing localisation for years. The Reserve Bank of India's 2018 payment data directive, SEBI's financial data localisation requirements, and IRDAI's policyholder data rules are active, enforceable obligations today.
The core compliance problem is the same across all four frameworks: foreign-headquartered cloud platforms remain subject to foreign jurisdiction regardless of where their servers are located. A US-headquartered messaging platform operating servers in Mumbai is still subject to US law — meaning US authorities can compel production of data held in India. This creates cross-border transfer exposure that no contractual arrangement eliminates.
SCOVR resolves this at the architectural level. The platform is deployed on infrastructure entirely within India, under Indian law, with no foreign parent. Communications between Indian government ministries, regulated financial entities, IT companies, and healthcare providers never leave India. For communications with international counterparties — overseas clients, foreign governments, global partners — the federated architecture keeps Indian users' data on Indian servers, with only encrypted message transit crossing borders.
All data — messages, files, voice, call metadata, user records, audit logs — stored on servers physically inside India. No cross-border transfer occurs. RBI, SEBI, IRDAI, and DPDPA obligations satisfied simultaneously.
Whatever countries the Central Government eventually blacklists under Sec. 16, sovereign hosting means no personal data of Indian residents is transferred anywhere. Future regulatory changes have zero impact on compliant deployments.
US-headquartered cloud and messaging providers are subject to US legal orders regardless of server location. A self-hosted deployment with no US parent eliminates this exposure entirely — for government, regulated financial entities, and enterprise users equally.
Fully self-reliant communications infrastructure — hosted in India, operated under Indian law, independent of foreign platforms. Aligned with India's digital sovereignty priorities and Atmanirbhar Bharat vision for technology self-reliance.
India's IT sector communicates globally. The federated open-standard architecture allows Indian organisations to communicate with international counterparties while keeping Indian users' data on Indian servers. Each organisation runs its own server — encrypted transit only crosses borders.
Messaging, video conferencing, file sharing, and data hosting: four categories of personal data processing that trigger DPDPA and sector-regulator obligations, addressed by a single sovereign platform.
Every message is encrypted end-to-end before leaving the sender's device. No server operator — including the platform — can read message content. Personal data in messages: names, financial details, health information, government IDs — all protected within India's sovereign infrastructure.
Encrypted voice and video calls hosted on sovereign Indian infrastructure. Meeting content never stored on foreign servers. Communications between government ministries, banks, regulators, and regulated entities — all within India's digital borders, satisfying both DPDPA and sector mandates.
Financial reports, policy documents, patient records, and government files are shared within encrypted channels on sovereign servers. Role-based access ensures only authorised recipients retrieve files. No foreign platform operator processes or stores the data — satisfying IRDAI, RBI, and SEBI file storage requirements.
All data — messages, files, recordings, user profiles, audit logs — stored on Indian infrastructure under Indian law. DPDPA Sec. 16 compliance, RBI payment data residency, SEBI financial data localisation, and IRDAI policyholder storage — all satisfied by a single deployment architecture.
Architectural compliance is the foundation. Documentation, audit trails, and DPB-ready reporting complete the picture for every Data Fiduciary and Significant Data Fiduciary.
Pre-built notice templates in English and Eighth Schedule languages, consent management framework, data minimisation architecture evidence, grievance redressal mechanism setup, and processor contract templates aligned with DPDPA Sec. 8 requirements.
Full SDF compliance documentation: Data Protection Impact Assessment template, DPO appointment framework, security audit records, open-source codebase for independent audit verification, and ongoing compliance reporting dashboard for periodic DPB submissions.
Platform and operations certified to ISO/IEC 27001:2022 — providing internationally recognised evidence of the security safeguards required under DPDPA Sec. 8. Satisfies the technical standard for the ₹250 crore security safeguard penalty category and supports SEBI's cyber security framework requirements.
Specific answers to the Digital Personal Data Protection Act questions legal, compliance, and technology teams across India ask most often.
Book a private briefing with our India compliance team. We will design a deployment that satisfies DPDPA, RBI, SEBI, and IRDAI — architecturally sovereign and enforcement-ready — before May 2027.