DPDP Rules 2027: What Businesses Need to Know About Their Email

Introduction

India is making a major change to how every business must handle personal data. The main duties of the Digital Personal Data Protection (DPDP) Rules, 2025 come into force on 13 May 2027, and from that date the penalties apply too: up to ₹250 crore for a single failure.

Most businesses are preparing their CRM, website forms and billing systems. Almost nobody is looking at the inbox. Yet that's where years of résumés, Aadhaar copies, salary slips, vendor bank details and customer complaints quietly pile up, forwarded, downloaded and synced to phones.

This guide explains, in plain language, what the DPDP Rules mean for your business email, what you need to change, and a checklist you can finish well before the deadline.

Key takeaways

• Deadline: The main DPDP duties and penalties start on 13 May 2027.
• Email is in scope: Résumés, KYC copies, salary slips and customer complaints in inboxes are all personal data.
• Biggest risk: Failing to take reasonable security safeguards can cost up to ₹250 crore. Failing to report a breach can cost up to ₹200 crore.
• Logs: Keep sign-in, traffic and processing logs for at least one year.
• Hosting: DPDP does not require all email to be hosted in India, but RBI rules for banks and government rules can.

In this article

1. What is changing, and when?
2. Why is email a DPDP risk?
3. What do the DPDP Rules require from your email?
4. Does business email have to be hosted in India?
5. What should businesses do before 13 May 2027?
6. What should you ask your email provider?
7. How XgenPlus helps
8. Frequently asked questions
9. Conclusion

1. What is changing, and when?

The Ministry of Electronics and IT (MeitY) notified the Digital Personal Data Protection Rules, 2025 on 13 November 2025 (Gazette notification G.S.R. 846(E)). The Rules apply in three phases:

As of October 2026, no amendment to shorten this timeline has been notified, so 13 May 2027 remains the legal date.

2. Why is email a DPDP risk?

When companies plan for DPDP, they look at their CRM, website forms and customer database. Email often holds more personal data than all three:

• HR inboxes: résumés from every candidate you never hired, medical certificates, salary slips
• Accounts inboxes: vendor bank details, PAN and GST documents
• Support and sales inboxes: customer phone numbers, addresses, order histories, complaints
• Everyone's inbox: Aadhaar and KYC copies sent "just for verification"

The same data is then copied into forwards, attachments, mobile phones and the mailboxes of employees who left years ago. If you can't say where personal data lives in your email, you can't protect it, erase it, or answer a request about it.

3. What do the DPDP Rules require from your email?

Reasonable security safeguards (Rule 6)

The Rules expect access controls, encryption, logging and backups. For email, that means:

• Two-factor authentication for every user, not only administrators
• Sign-in limited to known office IP addresses or chosen countries where possible
• Encryption, such as S/MIME email encryption, for sensitive messages
• Data loss prevention (DLP) to stop personal data leaving by mistake

Penalty: up to ₹250 crore for failing to take reasonable security safeguards to prevent a breach.