What Should an Indian Business Encrypt, and How?

As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.

What is the minimum an Indian business should encrypt?

Start with the data whose loss ends the business: identity documents, bank account and KYC records, customer medical and financial records, credentials and API keys, and the intellectual property that competitors would pay for. Then the data whose loss ends careers: unredacted HR files and payroll. Then everything in transit. What you can skip is bulk low-value data such as public marketing pages, and internal working data that is regenerated faster than it is stolen, as long as you have decided that consciously. A useful test is the disclosure test: would this file, read by a stranger, end a customer relationship, trigger a DPDP notification, or cost you a case in court? If yes, it is encrypted.

Where should encryption keys live in a small Indian setup?

Outside the application, always. A key stored in the application configuration, in a repository, or in an environment file is a key the next attacker reads first, and it turns a single application compromise into total data exposure. For a small team the realistic options are a cloud KMS with enforced key policies and rotation, a hardware security module for the high-value keys, or a secrets manager such as Vault with short-lived credentials. The second decision is who holds the key. If one person can both extract data and read the key, encryption is a control against theft, not against insider misuse, and in a 50-person firm it is often more practical to split those two duties than to buy a large platform.

Does the DPDP Act 2023 require encryption, and what are the timelines?

The Act obliges a data fiduciary to implement appropriate technical and organisational safeguards, and encryption of personal data at rest and in transit is the standard way to demonstrate that. Reporting obligations under DPDP Rule 7 commence from May 2027, which means the evidence trail that matters for a notification decision should be in place well before that date. 83% of Indian organisations have not begun comprehensive DPDP implementation, and the compliance gap is exactly where an independent technical assessment earns its keep. The cost of fixing an encryption and logging gap in year one is a fraction of the cost of rebuilding a key hierarchy and an access trail under audit in 2027.

How do you test that encryption is actually working?

Test it the way an attacker would: request the raw data from the application, the database, a backup and a log sink, and see what comes back in clear. Check that the database, not just the disk, is encrypted, that the transport is TLS 1.2 or above, that the key service is not reachable from the application role, and that a backup restore still yields ciphertext. A configuration review of a small cloud estate at AAVETech is a fixed-price engagement at roughly Rs 12,000 to Rs 30,000 per tester-day plus 18% GST, delivered in 5 to 10 working days with a retest included and a written remediation plan.

What are the common questions about E?