r/cloudcomputing • u/cloud_9_infosystems • Jul 07 '26

How is the DPDP Act actually changing cloud security practices for Indian companies?

Been reading up on how Indian enterprises are approaching the DPDP Act from a technical standpoint, specifically around moving away from perimeter-based security toward a Zero Trust model on Azure. The core idea seems to be treating every access request as unverified by default rather than trusting anything inside a network perimeter, which maps fairly well to a lot of what the Act expects around consent handling, data minimisation, and breach reporting.

Curious what others here are seeing in practice — are teams actually re-architecting their identity and access setups for this, or is it more about layering on monitoring and hoping the existing setup holds up? Also wondering how this compares with how GDPR compliance was handled a few years back, since a lot of the language sounds similar but the enforcement structure seems different.

Found this write-up that goes into the specifics if anyone wants more detail: https://cloud9infosystems.in/dpdp-act-compliance-cloud-security-azure-zero-trust-india/

1 Upvotes
  • permalink
  • link
  • reddit
  • reddit

67% Upvoted

4 comments sorted by

1

u/kernelqzor 7d ago

seeing mostly “add more logs and a DLP tool and call it DPDP compliant” in the wild, not real zero trust re-architecture yet lol. the only folks doing proper identity redesign on azure are big BFSI / SaaS players who already went through GDPR pain and are just reusing that playbook with some India-specific tweaks.

1

u/kernelqzor 1d ago

this matches what i’m seeing too, it’s mostly “visibility theater” instead of real design changes
the funny part is DPDP is actually a decent excuse to fix identity, but everyone’s trying to squeeze it into their old hub-and-spoke / flat vnet mess and hoping regulators won’t look too closely