How do I secure my startup's customer data in India?

As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.

How do I know what customer data I am actually holding?

Start with an inventory, because most startups do not know the answer. Pull the schema of every production database, list every field with a name, email, phone, address, government identifier, payment token or health reference, and mark each one with why you collect it, where it lives, and who can read it. Then find the copies: exports to Google Sheets, a data warehouse, a customer support tool like Zendesk or Freshdesk, an analytics platform, a marketing email tool, an engineer laptop, and a staging database that was never wiped. The copies are where the risk is, because each one usually has looser access than the primary database. A typical ten-person startup finds 3 to 7 shadow copies of customer data in the first hour of doing this properly.

How do I protect it once you know where it is?

Four layers, in order of value. Encrypt in transit with TLS 1.2 or above everywhere, including internal service-to-service calls, because flat internal networks are how lateral movement starts. Encrypt at rest, ideally with managed KMS keys and rotation, and never put a customer database on a volume that also holds general logs. Control access: enforce MFA, use role-based permissions, give every human a named individual account rather than a shared login, and review the access list every quarter. And keep the keys and the data in different places, because encryption with the key next to the data is only obfuscation. Where you must log a request, redact before it reaches the log store, since application logs are a frequent place where full customer records end up.

What does the DPDP Act 2023 require for a startup?

The practical requirements are: a clear notice about what you collect and why, a record of the consent you obtained, a stated purpose for each piece of data, a retention period, and a process to delete data when it is no longer needed or when a request is made. The Act also requires breach notification to the affected Data Protection Board and to the individuals, with timelines being notified in stages through the rules. For a startup, the near-term work is a privacy notice, a consent record for sign-up and marketing, a data inventory, and a data deletion request process that a human can actually execute. Do not treat this as a reason to collect less consent, because consent alone is not a substitute for minimisation.

What should I do about backups and deletion?

Backups need three properties to be useful against ransomware: they are off the production account, they are immutable or append-only so a compromised admin cannot silently overwrite them, and they are restore-tested. A daily snapshot copied to a separate cloud account with versioning locked is a reasonable start, and an offline copy for the most sensitive data is better. Test the restore quarterly by restoring a sample into a clean environment and checking row counts and hashes, because an untested backup fails exactly when you need it. On deletion, set retention periods so customer records actually expire, and keep a deletion log, since being able to prove deletion is part of what a regulator or a large customer will ask for.

What are the frequently asked questions?