DPDP Rules 2027: What Businesses Need to Know About Their Email

If any answer is vague, that's your first compliance risk. If you're comparing providers, see how XgenPlus compares with Google Workspace, Microsoft 365 and Zoho Mail.

7. How XgenPlus helps

XgenPlus is business email built and hosted in India by Data Xgen Technologies, Jaipur. An on-premise edition installs on your own servers when your sector or a tender requires it. Features that map to the DPDP duties above:

Tools support compliance; they don't replace your processes. Use the checklist above whichever provider you choose.

Frequently asked questions

Does the DPDP Act apply to my business email?

Yes. If your mailboxes contain names, phone numbers, addresses, résumés, ID documents or any other information about identifiable people, that is personal data under the DPDP Act. The main duties for protecting it apply from 13 May 2027.

When does DPDP compliance become mandatory?

The main obligations, including security safeguards, breach reporting, retention, erasure and data principal rights, apply from 13 May 2027. That is 18 months after the DPDP Rules were notified on 13 November 2025. Penalties apply from the same date.

Does DPDP apply to small businesses and startups?

Yes. The DPDP Act has no general exemption based on company size. The government can notify narrow exemptions for certain startups, but most small businesses should plan as if every duty applies to them.

Is Google Workspace, Microsoft 365 or Zoho Mail DPDP compliant?

No email product is DPDP compliant by itself. Compliance is your business's responsibility as the data fiduciary. A provider can supply the controls you need, such as security settings, log retention, retention policies and a processing agreement, but you must configure and use them.

Is a hacked email account a data breach under DPDP?

Yes, if the mailbox contained personal data and someone accessed it without authorisation. You must inform affected people and the Data Protection Board, with full details to the Board within 72 hours.

How long should a business keep emails under DPDP?

Keep sign-in, traffic and processing logs for at least one year. Keep other personal data only as long as its purpose requires, or longer if another law such as tax law requires it. Then erase it.

Does DPDP require email to be hosted in India?

Not in general. Transfers abroad are allowed except to countries the government restricts. However, RBI-regulated entities, government departments and PSUs often face stricter sector rules that require India-hosted or on-premise email.

What is the penalty for not complying with DPDP?

Up to ₹250 crore for failing to take reasonable security safeguards, and up to ₹200 crore for failing to report a breach. Other violations carry lower maximum penalties. The Data Protection Board decides the amount in each case.

What should we do first?

Turn on two-factor authentication for all users, check how long your provider keeps logs, and write a retention policy for HR and support mailboxes. These three steps reduce most of your risk and can be done within a week.