DPDP Act Compliance: What Your IT Infrastructure Must Do

The 72-hour window is not a policy problem

A mid-sized logistics company in Whitefield lost a laptop with 14,000 customer records in December 2025. They had a DPDP policy on paper. They had no disk encryption, no remote wipe, and no central inventory of what that laptop contained. The breach notification to the Data Protection Board was drafted but never sent because nobody could confirm what data was actually on the device. The company spent ₹18 lakh on legal counsel and forensic consultants over the next four months, and the incident still hangs over their renewal with two enterprise clients.

The DPDP Act is not a paperwork exercise. The Digital Personal Data Protection Act, 2023, puts obligations on every entity that processes personal data. Those obligations land on your infrastructure: where data sits, how fast you can detect a breach, what logs you keep, and whether you can prove consent when asked. The Act passed in August 2023, and while the full rules are still being finalised, the core requirements are clear. If you are an IT manager or business owner in India with 20–500 staff, this is what you need to change.

What the DPDP Act actually demands from your infrastructure

The Act is built around five pillars that have direct infrastructure consequences. Let's go through each with the technical realities.

1. Data localisation: where your data physically lives

The DPDP Act requires that personal data be stored on servers located in India. The rules for significant data fiduciaries are stricter, but even for a 50-person company, the direction is unambiguous. The government has also signalled that cross-border transfers will only be allowed to countries notified as adequate — and those notifications have been slow. The practical question is not "are we compliant?" but "do we know where every piece of personal data is stored right now?"

The cloud conundrum

If you use Microsoft 365, your data resides in Indian regions only if you have selected the correct data residency option. The default for many Indian tenants is still Asia Pacific or even the United States. A tenant migration between regions is possible but painful. For a 50-user organisation, migrating mailboxes and OneDrive data between regions takes 2–3 weeks of careful planning and usually costs ₹1.5–₹3 lakh in third-party migration tools or partner fees.

Google Workspace is similar. You can set data residency for your primary region, but this only applies to core services. YouTube, Ads, and some ancillary services may still store data elsewhere. If your business uses Google Workspace for email and Drive, check your data region settings under Admin Console > Account > Data regions.

The local server option

Many Bangalore companies, especially those in manufacturing, healthcare, and legal services, keep a substantial amount of personal data on on-premises servers. The DPDP Act does not force you to move to the cloud. A Dell PowerEdge T550 or an HPE ProLiant DL380 Gen11 can be fully compliant as long as the data stays in India and your security controls meet the standard. The cost of a 50-user on-premises setup is ₹400,000–₹700,000 for the server, storage, backup, and a basic firewall — not trivial, but a one-time cost compared with ongoing cloud fees.

Do not assume that on-premises is automatically compliant. Your backup tapes or external drives also count as data storage. If your backup drive is taken home by an employee or left in an unlocked drawer, that is a breach risk.

2. The 72-hour breach notification window

Section 8(6) of the DPDP Act mandates that a data fiduciary must inform the Data Protection Board and affected individuals of a breach within 72 hours. Almost every business in India cannot do this today. Not because they lack intent, but because their infrastructure does not expose the necessary signals.

The 72-hour clock starts when you become aware of the breach, not when it happens. This subtle difference means that if you have no detection capability, you will likely exceed the window. To comply, you need:

• Central logging and monitoring. A SIEM or at least a centralised log management platform. The free tier of Wazuh, a straightforward deployment of Elastic Stack, or a managed SIEM like LogRhythm or IBM QRadar — each has different costs and complexities. For a 50-user office, Wazuh on a modest server (₹2,500–₹4,000 per month on a cloud VM, or ₹80,000–₹120,000 for an on-prem server) is a realistic start.
• An incident response runbook. This is not a document to be filed. It is a checklist that your IT team can execute from memory. Who is the incident commander? Who contacts the DPDP officer? What screenshots do you capture? How do you isolate the affected server without losing evidence? Run an internal drill quarterly — it costs you half a day of downtime and saves you from chaos when a real incident hits.
• Log retention that matches the law. The DPDP Act does not specify a retention period for logs, but the rules being drafted are likely to require at least 12 months. Keep authentication logs, firewall logs, and backup logs for at least one year. A 50-user office generates about 1 GB of logs per day. That is 365 GB per year — manageable but still needs a plan.

3. Consent records: the forgotten data store

The Act requires that you obtain consent before processing personal data, and that you maintain a record of that consent. Most companies have a consent checkbox on their website or a form. Almost none of them store the evidence in a way that can be produced on demand.

Your consent infrastructure needs to capture:

• The exact text the user agreed to, including version number and date.
• The timestamp of the consent action, with timezone.
• The user's identifier (email, phone, or customer ID).
• The IP address and user agent from which consent was given.
• The method of consent (form, checkbox, verbal, WhatsApp).

If you rely on a CRM like HubSpot or Salesforce, the native consent fields are insufficient. You need a dedicated consent management platform. The open-source solution is a simple MySQL or PostgreSQL database with a JSON document storing the consent facts and a web form that records everything server-side. That'll cost you a developer's time — about ₹60,000–₹100,000 for a freelancer to build and integrate.

Alternatively, a paid consent management platform such as Transcend, OneTrust, or Seers (an Indian vendor) costs between ₹2.5 lakh and ₹6 lakh per year for a 50-user company. That is a significant line item, but it replaces the custom build and includes data subject request processing workflows.

4. Data minimisation and retention: you probably store too much

Section 5 of the Act says you can only collect data that is necessary for the purpose you have stated. And you must delete the data when the purpose is over. This has a direct impact on your storage and backup policies.

Take a typical CRM or ERP. A company with 100 staff might have customer records that are ten years old, including copies in three different backup sets, an old server that was decommissioned but not wiped, and a spreadsheets folder on a shared drive. None of this is compliant. You need a data map that explains where personal data lives, a retention schedule for each category, and automated deletion mechanisms.

Here is a concrete example. A boutique consulting firm in Indiranagar used a Synology DS923+ NAS (₹85,000 with two 4TB Seagate IronWolf drives) for shared file storage. They had no folder-level permissions, and every employee had read/write access to the entire volume. Under DPDP, that is a breach waiting to happen because you cannot demonstrate that access is limited to those who need it. The fix was not a new NAS; it was restructuring shares, applying access control lists, and enabling the Synology's built-in log centre to report on access and modification events.

Deletion is harder than it sounds. Backups are the usual culprit. If you have a 30-day backup rotation, deleted data will still exist in backups for a month or longer. That is acceptable, provided your retention policy says backups are kept for 30 days and you have a reason for that. But if an auditor asks why you still have a backup from 2019, you must be able to justify it.

5. Audit-ready controls: you need to prove everything

Under the DPDP Act, you are accountable. You must be able to demonstrate that you have implemented reasonable security safeguards. This is where your infrastructure needs to show its work.

For an Indian SME, the minimum viable audit trail includes:

• Access logs for all systems that hold personal data: the CRM, ERP, file servers, databases, and email.
• Change management records — who changed firewall rules, who added a user account, who modified a server configuration.
• Backup logs — when backups ran, whether they succeeded, and where they are stored.
• Security incidents log — every phishing email reported, every failed login, every malware detection.

A vulnerability scan once a year is not enough. You need a vulnerability management programme that runs at least quarterly. The free tool Nexpose Community Edition or the open-source OpenVAS can do this for a 50-user network, but you must actually read the reports and act on the findings.

The DPDP Board will not prescribe specific tools, but you need to show that you have a process. For most companies, the easiest way to achieve this is to write a Security Operations Manual that documents your toolset, your review cadence, and your escalation paths. You also need an external audit at least annually. A qualified auditor in Bangalore will charge ₹60,000–₹120,000 for a SME-level audit. The audit will produce a findings report that often includes immediate fixes — do those fixes within 30 days.

Real costs of DPDP compliance for a 50-user company (2026 pricing)

Let's be specific. The following table shows the typical costs for a 50-user company in Bangalore to achieve a reasonable baseline. Prices are from Q1 2026.

Total for a first-year compliance programme: ₹12.5–₹20.5 lakh. That is not trivial, but it is less than the cost of a single breach lawsuit, which can easily exceed ₹50 lakh in penalties and legal fees.

The week-by-week plan to get compliant in 90 days

Week 1–2: Data discovery and mapping

You cannot fix what you do not know. Use a spreadsheet — that is fine — and list every system that stores personal data: CRM, ERP, email server, file shares, cloud drives, backup systems, laptops, mobile devices, and any paper records.

For each system, note:

• The volume of data (number of records, approximate size in GB)
• The location (server room, AWS region, Google datacenter)
• The responsible owner (a person, not a team)
• The retention schedule (if any)

A free tool like Netwrix Data Classification can help scan file shares for personal data patterns. For cloud, use Microsoft Purview or Google's DLP. Run these scans for one week and produce a report.

Week 3–4: Fix the biggest exposure

Take the top three findings from your data map and fix them. Usually, this means moving a cloud tenant to India, enabling encryption on all laptops, and restricting access to a file share.

For laptop encryption, deploy BitLocker (on Windows 10/11 Pro) or FileVault (on macOS). This is a push of 30 minutes per laptop via Group Policy or MDM. Use Microsoft Intune or JAMF if you have them; otherwise, configure with local scripts.

Week 5–8: Build consent and breach capabilities

Set up your consent database. If you have no developer, use a third-party tool like Seers. If you have a small dev team, build a simple API that records consent events in a database and exposes an endpoint for verification.

Implement your SIEM and connect your key systems. For Wazuh, install the agent on all servers and endpoint computers. Configure alerts for failed logins (more than 5 in 10 minutes), admin account changes, and high-risk file access.

Week 9–12: Test and document

Run tabletop incident response exercises. Simulate a phishing email that leads to credential theft, then walk through your detection and notification process. Fix what breaks.

Document everything. Write the Security Operations Manual, the incident response plan, and the data retention schedule. Get them reviewed by a DPDP consultant (₹40,000–₹70,000 for a day of training and document review).

The Bangalore-specific realities that shape your timeline

Two factors specific to Bangalore will affect your compliance project: power and internet. The city has frequent, sometimes unpredictable power cuts, especially during electrical storms in May and June. If your on-premises servers are not on a proper UPS and generator, a power outage during a critical backup window can silently corrupt backups or cause data loss. That is a DPDP failure because your data integrity is compromised.

For a company in a commercial building in Whitefield or Electronic City, you can pay ₹35,000–₹60,000 for a UPS that provides 20–30 minutes of runtime for a server room. For longer outages, a 10 kVA generator costs ₹2.5–₹4 lakh. This is not compliance overhead; it is basic infrastructure.

Internet is less of an issue, but the lead time for a new leased line in Bangalore is 7–10 business days. If you need to move a cloud tenant or set up a VPN for remote staff, start your ISP order early. Additionally, the 2025 monsoon led to a flood in a low-lying area of Manyata Tech Park that cut connectivity for two days for some companies. Consider a backup internet link — a 4G/5G failover router like the TP-Link Omada or Peplink can cost ₹12,000–₹20,000 and will save your compliance monitoring during an outage.

Where SynergyScape's managed services fit

This article exists because SynergyScape Technologies helps companies like yours implement these controls. We have been in Bangalore since 2001 and have done this work for 1,200+ organisations. Our managed services team can handle the heavy lifting: deploying Wazuh, configuring Veeam backups, moving your Microsoft 365 tenant to India, and preparing you for a DPDP audit. If you are evaluating whether to do this internally or outsource, the trade-off is simple: an internal IT team of one or two people cannot also own DPDP compliance and manage your daily tickets. The compliance work is a separate project.

We are honest when our approach is not the right fit. If you have a skilled internal IT team of three or more and only need a few hours of consulting, we will tell you to hire a consultant and use our docs. If you are a startup with fewer than 20 users, the full compliance programme may be overkill; start with the basics of encryption and consent records.

For those who need it, our managed services page has details on the exact deliverables and SLAs. And if you want to talk through your situation, use the contact page to set up a call. We answer within one business day.

The failure story: what happens when you ignore the infrastructure

Let me tell you about a manufacturing client we picked up in 2025. They had 80 employees, a Tally ERP on a local server, and a website with a contact form. Their DPDP compliance had been "handled" by their CA, who wrote a privacy policy and added a checkbox to the form. No one considered the server.

One Monday morning, their Tally server was found to be infected with a ransomware strain. The attacker had exploited a vulnerable version of RDP that was exposed to the internet. The server was encrypted, and the company had no offline backups — their only backup was a USB drive that was connected to the same server and also got encrypted. The forensic investigation revealed that the attacker had been in the system for 22 days, and had exfiltrated thousands of customer records including names, phone numbers, and purchase histories.

The company had to notify the affected individuals, and they did — but only after a 6-day delay because they did not have a breach detection system. They estimated the total cost of the incident at ₹32 lakh. That included:

• ₹6 lakh for the ransomware decryption attempt (it failed, so the data was lost)
• ₹15 lakh for data reconstruction from paper records and customer calls
• ₹8 lakh for legal fees and breach notifications
• ₹3 lakh in lost productivity and downtime

The company eventually became a SynergyScape client. We rebuilt their infrastructure with a FortiGate 60F firewall (₹55,000), a properly configured backup server with Veeam v12 (₹1.2 lakh hardware plus software), and a Wazuh SIEM. Their annual compliance budget is now under ₹8 lakh, and they have passed a DPDP audit without any major findings.

The lesson is not that ransomware is inevitable. It is that DPDP compliance is fundamentally about knowing where your personal data is, protecting it with encryption and access controls, and detecting breaches early. If you cannot do those three things, you are not compliant, regardless of what your policy document says.

The trade-offs you need to accept

Trade-off 1: On-premises gives you control but requires security expertise

A local server keeps your data in India and avoids cloud tenant issues, but it too must be protected. You cannot just buy a server and declare compliance. You need a firewall, a good patching schedule, encryption for storage, and monitoring. If your IT team lacks security skills, cloud may actually be safer because the provider handles security at the platform level.

Trade-off 2: Free tools cost in time and skill

Wazuh is free, but configuring it properly takes a week of work for a knowledgeable engineer. If you hire a consultant, that week costs ₹40,000–₹70,000. Compare that to a paid SIEM like Splunk or Microsoft Sentinel, which costs ₹20,000–₹50,000 per month for a 50-user company but includes support and easier setup.

Trade-off 3: Compliance is a project, not a one-time cost

The figures above are for the first year. In subsequent years, you will need to maintain the tooling (licenses, subscriptions, audits, and staff time) and adjust as the law evolves. Budget at least 20% of the first-year cost annually for ongoing compliance.

FAQ

Q: Does the DPDP Act require data to be stored in India?

A: The Act does not have a blanket localisation requirement for all data. It says that the government may notify certain categories of personal data that must be stored in India. However, the rules being drafted lean towards stricter localisation. For practical risk management, it is safer to host personal data in India, and many Indian companies are doing so as a precaution.

Q: What is the penalty for non-compliance with the DPDP Act?

A: Penalties can be up to ₹250 crore per breach. For an SME, a more likely fine is ₹10–₹50 lakh for violations of consent or security obligations. The exact amount depends on the nature and duration of the breach.

Q: How quickly must we notify a data breach?

A: Within 72 hours of becoming aware of the breach. This requires a detection system so that you become aware early.

Q: Do we need to have a Data Protection Officer (DPO)?

A: The Act requires a DPO for significant data fiduciaries. For smaller companies, it is advisable to appoint a person responsible for compliance, even if the title is internal.

Q: Can we use free tools for DPDP compliance?

A: Yes. Encryption, logging, and vulnerability scanning can be done with open-source tools. But you need the expertise to configure and maintain them.

Your next step: Start with the data map

Do not buy software yet. Do not hire a big consultancy. This weekend, open a spreadsheet and list every system that holds personal data. That is the single most important step towards DPDP compliance. It costs you an hour and gives you the foundation for every other decision.

If that task feels overwhelming, that is exactly what we help with. SynergyScape's managed services team can run the data discovery for you and present a clear plan. Talk to us on the contact page or read more about our services. The act does not wait.