A company could encrypt every database and still fail India’s Digital Personal Data Protection (DPDP) security requirements.
Rule 6 requires reasonable security safeguards covering several areas, including:
- Encryption, masking, obfuscation or tokenisation.
- Access controls.
- Logging, monitoring and review.
- Backup and continuity arrangements.
- Prescribed retention of personal data and logs.
- Security obligations in Data Processor contracts.
- Appropriate technical and organisational measures.
Consider a fully encrypted customer database.
If every employee has unrestricted access to it, the organisation may still have a serious security weakness.
The takeaway: Security compliance needs multiple safeguards working together.
Encryption is important, but access governance, monitoring, incident detection and recovery matter too.
This article is general information, not legal advice.