Encryption guidance for Indian businesses: what to encrypt, key management, data localisation under the DPDP Act 2023, and the cost of getting it wrong.
Encrypt what would damage you if it leaked, and manage the keys as carefully as the data. For an Indian business the priority order is personal and financial data, then authentication material, then intellectual property and internal communications. Under the Digital Personal Data Protection Act, 2023, personal data is protected wherever it is processed, so encryption at rest and in transit is the cheapest risk reduction available. A workable baseline is AES-256 for data at rest, TLS 1.2 or above in transit, keys held outside the application, and rotation and access logs on every key operation.
Start with the data whose loss ends the business: identity documents, bank account and KYC records, customer medical and financial records, credentials and API keys, and the intellectual property that competitors would pay for. Then the data whose loss ends careers: unredacted HR files and payroll. Then everything in transit. What you can skip is bulk low-value data such as public marketing pages, and internal working data that is regenerated faster than it is stolen, as long as you have decided that consciously. A useful test is the disclosure test: would this file, read by a stranger, end a customer relationship, trigger a DPDP notification, or cost you a case in court? If yes, it is encrypted.
Outside the application, always. A key stored in the application configuration, in a repository, or in an environment file is a key the next attacker reads first, and it turns a single application compromise into total data exposure. For a small team the realistic options are a cloud KMS with enforced key policies and rotation, a hardware security module for the high-value keys, or a secrets manager such as Vault with short-lived credentials. The second decision is who holds the key. If one person can both extract data and read the key, encryption is a control against theft, not against insider misuse, and in a 50-person firm it is often more practical to split those two duties than to buy a large platform.
The Act obliges a data fiduciary to implement appropriate technical and organisational safeguards, and encryption of personal data at rest and in transit is the standard way to demonstrate that. Reporting obligations under DPDP Rule 7 commence from May 2027, which means the evidence trail that matters for a notification decision should be in place well before that date. 83% of Indian organisations have not begun comprehensive DPDP implementation, and the compliance gap is exactly where an independent technical assessment earns its keep. The cost of fixing an encryption and logging gap in year one is a fraction of the cost of rebuilding a key hierarchy and an access trail under audit in 2027.
Test it the way an attacker would: request the raw data from the application, the database, a backup and a log sink, and see what comes back in clear. Check that the database, not just the disk, is encrypted, that the transport is TLS 1.2 or above, that the key service is not reachable from the application role, and that a backup restore still yields ciphertext. A configuration review of a small cloud estate at AAVETech is a fixed-price engagement at roughly Rs 12,000 to Rs 30,000 per tester-day plus 18% GST, delivered in 5 to 10 working days with a retest included and a written remediation plan.
| Data class | Recommended control | Key management |
|---|---|---|
| KYC and identity documents | Field-level AES-256 | KMS, separate key per tenant |
| Credentials and API secrets | Vault or HSM | Automatic rotation, break-glass log |
| Medical and financial records | Column or file encryption | KMS with access logging |
| Data in transit | TLS 1.2+ everywhere | Certificate automation |
| Backups and snapshots | Encrypted at rest plus immutable | Separate credential set |
| Employee laptops | Full-disk plus remote wipe | Device-bound key escrow |
Encrypt what would damage you if it leaked, and manage the keys as carefully as the data. For an Indian business the priority order is personal and financial data, then authentication material, then intellectual property and internal communications. Under the Digital Personal Data Protection Act, 2023, personal data is protected wherever it is processed, so encryption at rest and in transit is the cheapest risk reduction available. A workable baseline is AES-256 for data at rest, TLS 1.2 or above in transit, keys held outside the application, and rotation and access logs on every key operation.
The Act requires appropriate technical and organisational safeguards for personal data, and encryption of personal data at rest and in transit is the recognised way to demonstrate that. DPDP Rule 7 notification obligations commence from May 2027, so the evidence trail should be in place well before then.
No. It protects a powered-off or stolen device, but data copied to a compromised machine leaves in clear. Combine full-disk encryption with endpoint management, remote wipe, screen-lock enforcement, and a policy that blocks unknown executables from user profile directories.
Outside the application, in a cloud KMS, a hardware security module or a secrets manager, with rotation and access logs on every key operation. A key in application configuration or an environment file is the first thing an attacker reads.
At AAVETech a cloud and application encryption configuration review is fixed-price at roughly Rs 12,000 to Rs 30,000 per tester-day plus 18% GST, with a 5 to 10 working day turnaround and the retest included. The output is a written list of unprotected data stores and a prioritised remediation plan.
Partly. Encryption stops data being read from a stolen disk or an intercepted backup, but it does not stop an authorised person using a live application session. That is why key access should be logged and reviewed, and why privileged access should be separated from data access.
Read the full guide on AAVETech: What Should an Indian Business Encrypt, and How?.
Send us your data inventory and we will return a fixed-price encryption and key-management review with a prioritised remediation plan.
Talk to an analyst about this.