# Digital Personal Data Protection Act SE-001 — Encryption & Data Masking

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_dpdp_se001_946b56fb2c-digital-personal-data-protection-act-se-001-encryption-data-masking
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [DPDP Act (India)](https://support.icompaas.com/support/solutions/c_gen_dpdpa) › [Security](https://support.icompaas.com/support/solutions/folders/f_gen_cgendpdpa_security)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Digital Personal Data Protection Act · Control SE-001 · Priority: critical · Component: Security

### What this control covers

Encrypt all personal data at rest and in transit using industry-standard algorithms (AES-256 for rest, TLS 1.2+ for transit). Apply data masking or tokenisation for personal data in non-production environments and display contexts. Objective: Prevent unauthorised access to personal data through encryption, reducing breach impact and demonstrating reasonable security safeguards under Rule 6(1).

### Why it matters

Encryption and key management make data unreadable to attackers and unintelligible under data-breach safe-harbour clauses — a meaningful regulatory benefit.

### How to implement

#### AWS

Default to **SSE-KMS** with customer-managed keys for S3/EBS/RDS/Secrets Manager. Use **S3 Bucket Keys** and **S3 Block Public Access** at the account level, and turn on **S3 Object Lock** on backup buckets for ransomware resilience.

#### Azure

Store secrets in **Key Vault** (HSM-backed where required) with soft-delete + purge protection; use **customer-managed keys** for Storage, SQL, and Azure Disk Encryption. Tag PII data via **Microsoft Purview**.

#### GCP

Use **Cloud KMS** with customer-managed encryption keys (CMEK) for BigQuery, GCS, and Compute. **Sensitive Data Protection** (DLP API) inspects/de-identifies PII at scale.

#### Google Workspace

Enable **client-side encryption** for Drive/Docs and turn on **Drive Labels + DLP** rules to prevent external sharing of regulated data classes.

### Evidence to collect

-   `infra_scan` — See the iCompaas Evidence library for the canonical source for this evidence type.
-   `policy_document` — A signed, version-controlled policy stating leadership intent and the named owner.

Signed policies, procedures, and registers document the safeguard. Infrastructure posture tooling (AWS/Azure/GCP configuration, encryption, backup, logging) verifies technical enforcement. Focus: Encryption & Data Masking.

### Quick checklist

-   Encrypt — Encryption / Data Masking

### Related articles on this site

-   [Ensure EFS protects sensitive data with encryption at rest](https://support.icompaas.com/support/solutions/articles/62000229566-ensure-efs-protects-sensitive-data-with-encryption-at-rest)
-   [Ensure SQL server's Transparent Data Encryption (TDE) protector is encrypted with Customer managed key](https://support.icompaas.com/support/solutions/articles/62000229872-ensure-sql-server-s-transparent-data-encryption-tde-protector-is-encrypted-with-customer-managed-ke)
-   [Ensure that encryption at rest is enabled for Amazon Athena query results stored in Amazon S3 in order to secure data and meet compliance requirements for data-at-rest encryption.](https://support.icompaas.com/support/solutions/articles/62000233406-ensure-that-encryption-at-rest-is-enabled-for-amazon-athena-query-results-stored-in-amazon-s3-in-orde)
-   [Ensure Amazon EFS Protects Sensitive Data with Encryption at Rest](https://support.icompaas.com/support/solutions/articles/62000233573-ensure-amazon-efs-protects-sensitive-data-with-encryption-at-rest)

## Related compliance guidance

- [India's DPDP Act 2023: a practical compliance guide for cloud teams](https://support.icompaas.com/compliance/india-dpdp-act-2023): The DPDP Act and 2025 Rules explained as an implementation plan, including what is in force today.
- [GDPR compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/gdpr): A GDPR programme covers most DPDP obligations; the guide shows the overlap and the India-specific gaps.