DPDP Rules 2027: What Businesses Need to Know About Their Email

Breach reporting (Rule 7)

If personal data is breached, you must:

• inform each affected person promptly and in plain language
• inform the Data Protection Board without delay
• send the Board full details within 72 hours, or a longer period it allows

A single hacked mailbox containing customer data can be a reportable breach. To report accurately, you need sign-in and access logs that show what was opened, from where, and when.

Penalty: up to ₹200 crore for failing to notify the Board or affected people.

Log retention (Rule 8)

Personal data, traffic data and processing logs must be kept for at least one year. Many email services keep sign-in and delivery logs for only 30 to 90 days. Check yours.

Erasing data you no longer need (Rule 8)

Once the purpose for collecting personal data is served, you must erase it, unless another law requires you to keep it longer. Tax and labour laws, for example, require you to keep certain records.

Rejected candidates' résumés sitting in an HR inbox for five years are exactly what this rule targets.

The Third Schedule adds a specific duty for large e-commerce, online gaming and social media platforms. They must erase the data of users who have been inactive for the period it sets, and warn those users 48 hours before erasure.

A contract with your email provider (Section 8)

Under DPDP, your business is the data fiduciary and your email provider is a data processor. The legal responsibility stays with you. You need a written data processing agreement covering:

• security standards
• how and when the provider tells you about a breach
• deletion of your data when you leave

Rights requests and grievances (Rule 14)

People can ask what data you hold about them, ask for corrections, or ask for erasure. You must publish how long you take to respond to grievances, and that period cannot exceed 90 days.

In practice, someone in your team must be able to search every mailbox for one person's data. That requires admin-level search and domain administration or eDiscovery.

4. Does business email have to be hosted in India?

Not under DPDP in general. Rule 15 on cross-border transfers comes into force on 13 May 2027. The Act allows transfers abroad except to countries the government restricts by notification.

Sector rules can be stricter. RBI-regulated banks and NBFCs, central and state government departments, PSUs and defence suppliers often have data-localisation or on-premise email requirements. For them, where email is hosted can decide whether a provider is allowed at all.

5. What should businesses do before 13 May 2027?

1. Map the mailboxes that hold the most personal data: HR, accounts, support, sales.
2. Enforce two-factor authentication for every user. Lock down accounts in 5 minutes.
3. Confirm your provider keeps sign-in and mail logs for at least 12 months.
4. Write an email retention policy: what to keep, for how long, and under which law.
5. Automate deletion or archiving for recruitment and support folders.
6. Stop collecting Aadhaar and KYC copies by email; use a secure online form or portal instead.
7. Sign a data processing agreement with your email provider.
8. Prepare a breach response plan: who decides, who informs the Board, who emails affected people.
9. Name a person for data requests and test a search across all mailboxes.
10. Offboard properly: when an employee leaves, secure, transfer or delete their mailbox.

6. What should you ask your email provider?

1. Where exactly is my mail stored, including backups?
2. How long do you keep sign-in and delivery logs?
3. Will you sign a data processing agreement?
4. How quickly will you tell me about a breach on your side?
5. Can I enforce two-factor authentication for all users?
6. Can I set retention and auto-delete rules per mailbox or folder?
7. Can an administrator search all mailboxes for one person's data?
8. When I leave, how do I export my data, and how do you confirm deletion?