India’s DPDP Act 2023 imposes five key obligations on file storage: Section 8(3) — delete personal data when its purpose is fulfilled; Section 8(5) — implement security safeguards; Section 8(6) — notify the Board of any breach; Section 12 — erase on request; Section 11 — provide access summary on request. Gavety meets all five: files on your hardware, deleted immediately, logged locally, encrypted in transit, zero files on Gavety’s servers.
Why the DPDP Act Matters for File Storage Now
India’s Digital Personal Data Protection Act received Presidential assent on 11 August 2023 and marks the country’s first comprehensive data protection legislation. Unlike earlier sector-specific rules, the DPDP Act creates a horizontal framework that applies to any entity — individual, sole trader, partnership, company, or non-profit — that processes the personal data of Indian citizens, either within India or in connection with profiling Indian residents.
File storage is where the DPDP Act becomes practical and immediate. When a freelance designer stores a client’s name, email, and phone number in a project folder; when a doctor stores patient intake forms; when an accountant retains financial documents containing personal data — each of them is a data fiduciary under the Act, with binding obligations on how that data is stored, protected, and erased.
The penalty schedule under the Act’s First Schedule is material. Failure to implement adequate security safeguards (Section 8(5)) can attract penalties up to ₹250 crore (approximately $30 million USD). Failure to notify the Data Protection Board of India of a breach carries penalties up to ₹200 crore. These penalties apply to small fiduciaries as well as large ones — the Board’s adjudication process does not have a small-business exemption equivalent to GDPR’s proportionality principle.
DPDP Act Sections Mapped to Gavety Capabilities
The table below maps the key DPDP Act sections for file storage to the specific capabilities Gavety provides. This is the same framework used in enterprise compliance reviews — applied to a personal and small-team self-hosted setup on a Raspberry Pi or any Linux device.
| DPDP Section | Obligation (plain language) | How Gavety meets it |
|---|---|---|
| Section 8(1) Accuracy |
Personal data must be accurate and complete, especially where decisions affecting the data principal will be made. | Files are stored on your filesystem exactly as you save them — no provider-side transformation, compression artefacts, or processing that could alter accuracy. You control the data at source. ✓ Meets |
| Section 8(3) Storage limitation |
Personal data must be erased as soon as the purpose for which it was collected is no longer being served, or upon withdrawal of consent. | Files deleted from Gavety are deleted immediately from your filesystem. No provider-side retention period, no cloud trash bin, no backup copy held by Gavety. You define the schedule; deletion is complete. ✓ Meets |
| Section 8(5) Security safeguards |
Data fiduciaries must implement reasonable security safeguards to prevent personal data breaches. | AES-256 encrypted outbound tunnel — zero inbound ports exposed. Per-folder access control. Optional LUKS full-disk encryption at rest. No inbound network attack surface for scanner-based intrusion. ✓ Meets |
| Section 8(6) Breach notification |
Data fiduciaries must notify the Data Protection Board of India and affected data principals in the event of a personal data breach. | Files never pass through Gavety’s servers in readable form. A breach of Gavety’s infrastructure does not expose your file contents. Your files’ breach surface = your physical device. LUKS encryption makes physical theft non-notifiable in practice. △ Partial — add LUKS |
| Section 11 Right of access |
Data principals have the right to a summary of their personal data being processed and the processing activities undertaken. | Gavety generates local access logs: who accessed which file, when, from which IP. Exportable for compliance documentation and for responding to data principal access requests. ✓ Meets |
| Section 12 Correction & erasure |
Data principals can request correction of inaccurate data and erasure of personal data that is no longer necessary or where consent is withdrawn. | Deletion from Gavety removes the file immediately from your filesystem. No 30-day trash, no provider-side backup copy. Erasure is immediate and complete — verifiable via access log deletion event. ✓ Meets |
| Section 13 Grievance redressal |
Data fiduciaries must provide an accessible mechanism for data principals to raise grievances, with a response obligation. | For file content, you are the data fiduciary — you respond directly to data principals. Gavety handles account-level data (email, billing) under its own DPA. See data protection page. ✓ Meets |
| Section 16 Children’s data |
Processing children’s (under 18) personal data requires verifiable parental consent and prohibits tracking or behavioural monitoring. | Gavety does not process or track file contents — no behavioural monitoring. Verifiable parental consent for storing a child’s data is your responsibility as the data fiduciary, not Gavety’s. △ Your obligation |
What Is the Compliance Difference Between Cloud and Self-Hosted?
Both cloud storage and self-hosted storage can be configured to meet the DPDP Act’s requirements. But the path to compliance sits in architecturally different places, and the compliance risks are different in nature.
Under the DPDP Act, cross-border data transfers are permitted subject to conditions notified by the Central Government. Data stored on cloud providers’ servers outside India may become subject to restrictions as these conditions are published. Self-hosted Gavety stores your data on a device physically located in India — there is no cross-border transfer question for file contents. Remote access via Gavety’s outbound tunnel does not constitute a cross-border transfer of file content: only an encrypted connection passes through Gavety’s relay, not the file data itself.
How Does Gavety Meet Each DPDP Act Section?
Section 8(3) — Storage limitation: delete when the purpose is fulfilled
The DPDP Act’s storage limitation principle mirrors the GDPR’s but is stated more directly: personal data must be erased “as soon as it is reasonable to assume that the specified purpose is no longer being served.” For a freelancer, this means client contact data should be deleted when the engagement ends and the limitation period for any disputes has passed. For a doctor, patient records must be erased within retention periods set by applicable health regulations.
With Gavety, when you delete a file from your filesystem, it is gone immediately. There is no cloud-side copy that Gavety holds, no index on Gavety’s servers that preserves a reference to the deleted data. Your device’s filesystem is the complete and sole location of the data — so deletion from it is deletion from everywhere the data exists in your control.
What Gavety does not provide is automatic deletion scheduling. You must define your own retention periods and implement a review process — a quarterly calendar reminder to audit each folder against your retention schedule is the minimum practical control.
Section 8(5) — Security safeguards: reasonable technical measures
The Act requires “reasonable security safeguards to prevent personal data breach.” While the Act does not prescribe specific technical standards (leaving this to the Data Protection Board’s future rules), the internationally accepted standard for file storage security — encryption at rest and in transit, access control, minimal attack surface — is the practical benchmark.
- In transit: Gavety’s outbound tunnel uses AES-256 encryption. File contents travel encrypted between your device and your browser — Gavety’s relay cannot read them.
- Attack surface: Gavety opens zero inbound ports. Traditional self-hosting tools (Nextcloud with port forwarding, FTP servers) that work on Jio Fiber or BSNL require open inbound ports that are actively scanned by attackers. Gavety’s outbound-only tunnel eliminates this exposure entirely.
- At rest: Adding LUKS full-disk encryption to your storage device provides AES-256 at-rest encryption — the same standard recommended by CERT-In (India’s Computer Emergency Response Team) for protecting sensitive data. Without LUKS, physical theft of the device means the drive contents are readable — a clear breach under Section 8(6).
- Access control: Per-folder read/write permissions and time-limited token links mean that a compromised account or shared link cannot access the full dataset.
If your Gavety device is lost or stolen without LUKS encryption, the drive is readable and you likely have a Section 8(6) breach notification obligation. With LUKS enabled, the drive is unreadable without the decryption key. The Data Protection Board’s forthcoming breach notification rules are expected to recognise encryption as a factor reducing or eliminating notification requirements for physical theft — consistent with international practice. Enable LUKS before storing any personal data you would be obligated to report.
Sections 11 & 12 — Data principal rights: access, correction, erasure
Data principals (the individuals whose data you hold) have rights under the DPDP Act to request a summary of what personal data you process about them, request correction of inaccurate data, and request erasure when the data is no longer necessary or consent is withdrawn. You must be able to respond to these requests.
With self-hosted Gavety, fulfilling an erasure request is straightforward: you know exactly where the data is (it is on your device), you can identify the relevant files, and deletion from your filesystem is the complete action — there are no provider-side copies to coordinate. Gavety’s local access logs record every deletion event with a timestamp, giving you documentary evidence that erasure occurred if a data principal or the Board ever requests proof.
What Does Gavety Not Cover Under the DPDP Act (and What Does)?
Being direct about what Gavety provides and what remains your obligation as a data fiduciary.
| DPDP Obligation | Gavety provides | What else is needed |
|---|---|---|
| Storage limitation | Immediate, complete filesystem deletion | You must define retention periods per data category and run a periodic deletion review. Gavety does not auto-delete on schedule. |
| At-rest encryption | AES-256 in transit only | Add LUKS full-disk encryption to your storage device. Without it, physical theft of the device is a reportable breach under Section 8(6). |
| Access logs (Section 11) | Local access logs on your device | You must retain and organise logs alongside a record of what personal data categories you store, for what purpose, and for how long. |
| Consent management | Not applicable | Lawful basis for processing (consent or legitimate use) is a legal obligation. If relying on consent, you must obtain, record, and manage consent withdrawals. Gavety is not involved in this process. |
| Grievance officer appointment | Not applicable | Data fiduciaries must designate a grievance officer and publish contact details. This is a legal/organisational requirement, not a technical one. |
| Privacy notice | Not applicable | You must provide data principals with a notice explaining what personal data you collect, why, and how they can exercise their rights. This is a legal document Gavety cannot provide. |
Gavety covers the technical architecture side of DPDP Act compliance for file storage: encryption in transit, zero inbound attack surface, immediate deletion, per-folder access control, and local audit logs. It does not cover the legal framework: consent management, privacy notices, grievance officer designation, or the detailed records-of-processing documentation. For individuals and small teams storing client files, Gavety handles the technical controls reliably; the legal obligations are yours to manage, ideally with input from a data protection practitioner familiar with India’s DPDP rules as they are notified.
Common Questions About DPDP Act File Storage Compliance
The DPDP Act exempts personal or domestic processing — data processed by an individual “for personal or domestic purposes.” If you store only your own personal files, family photos, or personal documents, you are likely in the personal use exemption. However, the moment you store personal data of others in a professional capacity — client contact details, employee records, patient information, student data — you are a data fiduciary under the Act, even if you are a sole trader working from home.
The practical boundary: a home Raspberry Pi storing your own documents is personal use. The same Pi storing a client’s GST number, name, and project files as part of a freelance engagement is professional processing, and the DPDP Act applies. The full text of the DPDP Act via MeitY covers these distinctions in Sections 3 and 17.
It can, subject to conditions. The DPDP Act permits cross-border data transfers to countries notified by the Central Government. Until those notifications are published, the existing IT (Reasonable Security Practices and Procedures) Rules and sector-specific regulations continue to apply. Google Drive and Dropbox both publish Data Processing Agreements for their business users; personal/consumer accounts operate under standard terms.
The practical concerns for cloud storage under DPDP are: (1) file contents are processed by the provider’s systems for service operations; (2) deletion is subject to the provider’s trash retention schedule, not your control; (3) cross-border transfer rules are still being finalised and may impose conditions retroactively. Self-hosted Gavety sidesteps all three by keeping files on hardware physically located in India under your direct control.
The DPDP Act creates an additional category — Significant Data Fiduciary (Section 10) — for entities the Central Government designates based on volume of personal data processed, sensitivity, risk to data principals, potential impact on sovereignty, or security. Significant Data Fiduciaries face additional obligations including a Data Protection Officer, Data Protection Impact Assessments (DPIAs), and periodic audits.
For most freelancers and small Indian businesses storing client files on a Raspberry Pi running Gavety, Significant Data Fiduciary designation is unlikely — the criteria point to large-scale processors of sensitive data. Core obligations under Sections 8, 11, 12, and 13 apply to all data fiduciaries regardless of size. Small teams should focus on these core sections rather than the Significant Data Fiduciary requirements.
Frequently Asked Questions
When does the DPDP Act come into full force for small fiduciaries?
The DPDP Act received Presidential assent on 11 August 2023. The Press Information Bureau covers the Act’s progress and Board constitution updates. Different sections are being brought into force in stages via Central Government notifications. The Data Protection Board of India is being constituted, and detailed rules under the Act are being published over 2024–2026. Core obligations (Sections 8, 11–13) are expected to apply to all data fiduciaries once enforcement begins.
The practical recommendation: begin implementing the technical controls now — encryption, access logs, deletion schedule — rather than waiting for specific enforcement dates. LUKS encryption and Gavety’s access control can be set up on a Raspberry Pi in under an hour, and doing it before enforcement avoids the scramble when rules take effect.
Does Gavety qualify as a Data Processor under the DPDP Act?
Under the DPDP Act, a Data Processor is an entity that processes personal data on behalf of a data fiduciary. Gavety processes account-level data (your email address, login credentials, billing information) as a data processor, and provides a Data Processing Agreement covering this. For file contents, Gavety is not a data processor — your files never pass through Gavety’s infrastructure in readable form; only the encrypted connection routing passes through Gavety’s relay. You are the sole data fiduciary for your file contents. See the Gavety data protection page for the complete breakdown.
How does the DPDP Act’s right to erasure work for files stored with Gavety?
Under Section 12 of the DPDP Act, a data principal can request erasure of their personal data where it is no longer necessary for the specified purpose, or where they withdraw consent. You must comply with this request. With Gavety, the process is: identify the files containing the data principal’s personal data, delete them from your filesystem, and confirm deletion via the Gavety access log (which records the deletion event with timestamp). There are no Gavety-side copies to coordinate — your filesystem deletion is the complete action. You should then inform the data principal that erasure is complete, consistent with your grievance officer obligations.
Does Jio Fiber or BSNL affect DPDP Act compliance for self-hosted storage?
The ISP you use does not change your DPDP Act obligations as a data fiduciary. However, Jio Fiber and BSNL residential connections use CGNAT, which means traditional self-hosting via port forwarding (Nextcloud, ownCloud) cannot achieve remote access without complex workarounds. Gavety’s outbound tunnel bypasses CGNAT entirely — your files are accessible from any browser anywhere without inbound port exposure. This is directly relevant to Section 8(5) security: an outbound-only tunnel has no inbound attack surface, while port-forwarded self-hosting creates one. Gavety on Jio Fiber or BSNL is the more secure architecture for DPDP Act purposes.
What records should I keep to demonstrate DPDP Act compliance?
At minimum, maintain: (1) a register of personal data categories you store, for what purpose, and expected retention period; (2) exported Gavety access logs showing who accessed what and when; (3) a record of any data principal requests (access, correction, erasure) and your responses; (4) evidence of your security measures (LUKS setup, Gavety access control configuration). The Data Protection Board has not yet prescribed a specific format for these records — a well-organised folder of these documents is sufficient until formal guidance is issued. Review and update the register quarterly and whenever your data processing activities change.
DPDP Act compliance by architecture — not just a contract.
Gavety stores files on hardware you own in India, encrypts access in transit with AES-256, generates local audit logs, and deletes files permanently on your command. Works on Jio Fiber and BSNL CGNAT — no port forwarding, no router config.
Read the setup guide → Free for LAN use · $100 one-time licence · $20/user/year for remote access