Encryption
Scrambling data with a key so that only authorised people or systems can read it.
Encryption scrambles data using a mathematical key so that only someone with the right key can read it. If the scrambled data is stolen, it looks like gibberish.
Meaning of Encryption
Data can be encrypted while stored (at rest) and while moving across a network (in transit). Rule 6 lists encryption among the measures a fiduciary should use. Encryption helps most when keys are protected, so key management matters as much as the algorithm.
Encryption turns readable information, called plaintext, into unreadable ciphertext using an algorithm and a key. Decryption reverses the process for anyone holding the correct key. Modern, widely reviewed algorithms such as AES for stored data, and TLS for data crossing networks, make it computationally impractical to break the scrambling without the key.
The DPDP Rules 2025 mention encryption in Rule 6, as the first example of the data security measures that make up reasonable security safeguards under Section 8(5) of the Act. Rule 6 says "appropriate" measures, so it does not fix a standard or key length, and a fiduciary chooses a method suited to its risk. Regulators and auditors will generally look for recognised, current algorithms rather than home-made schemes.
There are three places to apply it. Encryption at rest protects databases, backups, laptops and phones. Encryption in transit protects data moving between apps, servers and browsers. Some systems also encrypt at the field level, so that a single column such as an Aadhaar-linked identifier remains protected even from administrators who can open the database.
Encrypted data is still personal data. Encryption reduces the chance of a breach and may limit its impact, but the Act continues to apply while the data can be decrypted. It is different from anonymisation, which cannot be reversed, and from masking, which hides part of a value on screen. The strength of the arrangement rests on key management: a strong lock is of little use if the key is kept in the same folder.
Examples of Encryption
A customer database is encrypted at rest, so a stolen disk drive reveals nothing without the key.
A booking site encrypts its customer database and sends all traffic over HTTPS. When a developer's laptop is stolen, the full-disk encryption and a remote wipe mean no passenger details are exposed.
A laboratory e-mails reports to patients as password-protected, encrypted files and stores results in an encrypted database. Because access to the decryption keys is limited to two administrators, a vendor technician cannot read any report.
A payroll start-up encrypts salary tables but stores the key in the same code repository as the application. A contractor with repository access can read everything, so the team moves keys to a managed vault and rotates them.
Why Encryption matters
Encryption is one of the most cost-effective defences against the heavy penalty for failing to take reasonable security safeguards, which can reach ₹250 crore. A stolen laptop or a misconfigured storage bucket is a breach for any fiduciary, but when the contents are encrypted with a well-protected key, the harm to individuals is far smaller and the story told to the Board is far better.
The flip side is that unencrypted personal data is hard to defend after an incident. For a start-up, enabling default encryption in cloud storage and enforcing HTTPS costs little. For a bank or hospital, it is expected, and sectoral regulators such as RBI already require strong cryptography for sensitive systems.
How it works in practice
- 1Inventory the places personal data lives, including databases, file shares, e-mail, backups, laptops and mobile devices, and mark which of them are encrypted.
- 2Turn on encryption at rest for databases, storage buckets, backups and employee devices, and enforce TLS for every website, API and internal connection that carries personal data.
- 3Store keys separately from the data, ideally in a key management service or hardware module, with limited access, rotation schedules and logged use.
- 4Use field-level encryption or tokens for the most sensitive fields, so that most staff and applications never see the clear value.
- 5Have a plan for lost keys and for the retirement of old algorithms, and test that encrypted backups can actually be restored.
- 6Include encryption requirements in contracts with cloud providers and processors, and ask for evidence.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Encrypting the database but leaving backups and exports in clear form: attackers go for the weakest copy, so every copy needs protection.
Keeping keys beside the data or sharing one key among many people: manage keys as carefully as the data they protect.
Believing encrypted data falls outside the Act: it remains personal data for anyone who can decrypt it, so all other obligations still apply.
Relying on outdated or self-invented algorithms: use current, widely reviewed standards and retire weak ones on a schedule.
Compliance tips
Ask every vendor whether data is encrypted at rest and in transit, and keep the answer on file.
Treat encryption as a default setting, and require an approved exception to switch it off.
Rotate keys and review who can use them every quarter, and log every key use.
Pair encryption with access control, because decrypted data in an application is only as safe as the permissions around it.
Common questions about Encryption
Does the DPDP Act make encryption mandatory?
Rule 6 lists encryption, obfuscation, masking or virtual tokens as examples of appropriate security measures. It does not name one tool as compulsory, but encryption is the most common and expected choice for stored and transmitted personal data.
Is encrypted data still personal data?
Yes. Encryption is reversible by anyone holding the key, so the data remains personal data and the Act continues to apply. Only properly anonymised data falls outside the definition.
What is the difference between encryption and masking?
Encryption scrambles the whole value and needs a key to restore it. Masking hides part of a value, such as showing only the last four digits, so staff see only what their task needs.
Do I need to encrypt data in transit as well as at rest?
Rule 6 expects appropriate protection, and data crossing networks is exposed to interception. Using HTTPS and TLS for connections, along with encryption of stored data, is the usual way to cover both.