Compliance and Data Privacy (DPDP, GDPR, PCI-DSS, Data Localisation)
Collect, store, protect and delete users' personal and payment data as the law requires, and keep proof (audit).
62.1 Why is it used?
- India's DPDP Act 2023 demands consent, purpose limitation and breach reporting for personal data; the penalty can go up to Rs 250 crore.
- GDPR (for EU users): a fine of 20 million euro or 4% of global annual turnover, whichever is higher.
- If you handle card data, PCI-DSS compliance is a must, otherwise card networks/banks can stop payments.
- RBI's 2018 rule: payment system data must be stored only in India. A direct impact on architecture.
- In a data breach both trust and brand are lost; compliance reduces the impact of a breach.
62.2 How it works
- 1.1. Consent screen: phone/email for delivery; marketing = a separate checkbox
- 2.2. The user pays by card: card details go straight to the Payment Gateway (Razorpay / PayU) page/SDK, card -> network token (RBI card-on-file tokenisation)
- 3.3. The app backend gets only a token (tok_8f3a): CVV / PAN is never stored. PCI-DSS scope ends here
- 4.Payments DB: India region ap-south-1 Mumbai, encrypted at-rest (KMS key), TLS 1.2+ in-transit, secrets in HashiCorp Vault
- 5.4. Mask: phone 98XXXXXX21 in logs/analytics, customer_id tokenised (no real name); only a masked copy in non-prod
- 6.5. Audit: every support agent access goes to CloudTrail -> S3 Object Lock (WORM), tamper-proof; AWS Macie / Purview find hidden PII
- 7.Delete my account: erase PII from primary + replicas + backups + data lake; keep only tax/legal records
Always 5 points: encrypt at rest + in transit, tokenise PII, least privilege, audit logs, data residency
- 1.DPDP Act 2023 (India): consent, purpose limit, erasure right; penalty up to Rs 250 crore
- 2.GDPR (EU users): right to be forgotten; report a breach within 72 hours; fine 20M euro / 4%
- 3.PCI-DSS (cards): never store the CVV; mask the PAN to the last 4; segmentation, scans
- 4.RBI 2018 localisation: a full copy of payment data on servers in India
- DPDP Act 2023: Data Principal (user), Data Fiduciary (company); clear consent, use only for the stated purpose, the user's right to access/correction/erasure, breach report to the Data Protection Board.
- GDPR: lawful basis, right to access/erasure (right to be forgotten), data portability, report a breach to the authority within 72 hours.
- PCI-DSS: never store the CVV, encrypt/mask the card number (PAN) (show only the last 4), network segmentation, regular scans and audits.
- Data Localisation (RBI 2018 circular): a full copy of payment data on servers in India; even if processing happens cross-border, the data has to be brought back to India.
- Tokenisation: store a random token instead of the real card/Aadhaar/PAN; the real value sits in a secure vault. RBI has made card-on-file tokenisation mandatory.
- PII Masking: mask phone/email/card in logs, analytics and non-prod environments (98XXXXXX21).
- Encryption: at-rest (KMS keys) and in-transit (TLS 1.2+); key rotation and access control.
- Audit Logs: who viewed/changed which data and when. In immutable (WORM) storage, tamper-proof and with a retention policy.
- Extra: the DPDP Rules are being implemented in phases, so verify compliance timelines from the official notification.
62.3 Tools you can use
| Tool | Type | How it is used |
|---|---|---|
| HashiCorp Vault | Secrets & encryption service | Secrets store, dynamic DB credentials and encryption-as-a-service through the Transit engine; tokenisation/FPE in the enterprise edition too. |
| AWS Macie | PII discovery (S3) | Scans S3 buckets to find PII like card numbers, emails and PAN, and alerts on public/unencrypted buckets. |
| Microsoft Purview (Azure Purview) | Data governance & catalog | Scans the whole data estate, classifies it (sensitivity labels) and shows data lineage. |
| AWS KMS / Azure Key Vault | Key management | Central management of encryption keys, rotation and an audit of every key use (CloudTrail). |
| Card network / PG tokenisation (Visa, Mastercard, Razorpay, PayU) | Tokenisation service | The merchant never holds the real card number, only a token; PCI scope shrinks a lot. |
| AWS CloudTrail / Azure Monitor + S3 Object Lock | Audit logging | Keep API and data access logs in immutable storage and give proof to auditors. |
62.4 Comparison: HashiCorp Vault vs AWS Macie vs Microsoft Purview
| Point | HashiCorp Vault | AWS Macie | Microsoft Purview |
|---|---|---|---|
| Main job | Secrets, encryption, tokenisation | Finding PII in S3 | Data catalog, classification, lineage |
| Protects or discovers data | Protects (encrypt/tokenise) | Discovers + alerts | Discovers + governs |
| Cloud | Multi-cloud / on-prem | AWS only (S3) | Azure + multi-cloud + on-prem sources |
| Setup | Run it yourself (or HCP managed), HA setup | Enable it, managed | Managed, scanners have to be configured |
| Cost | OSS free, enterprise features paid | Per GB scanned + per bucket | Per scan/asset based |
| Best for | App-level encryption and secrets | Catching hidden PII in an S3 data lake | Enterprise-wide data governance |
62.5 When to choose which
- Vault: apps need secrets and an encryption/tokenisation API, and you are multi-cloud or on-prem as well.
- AWS Macie: you have a lot of data in S3 and do not know where the PII sits.
- Purview: a big enterprise, Azure-heavy, needing an organisation-wide data catalog and classification.
- Payment gateway tokenisation: never keep card data in your own system. The smallest PCI scope.
- India payments: region ap-south-1 (Mumbai)/ap-south-2 (Hyderabad) or Azure Central India, follow data localisation.
62.6 Real-world example
Scenario: payment and PII flow of an Indian e-commerce app.
- A clear consent screen at signup: 'phone/email will be used for order delivery and offers'. Marketing consent is a separate checkbox.
- The user pays by card; card details go straight to the payment gateway's page/SDK, and the app only gets a token.
- For a saved card, RBI tokenisation: the card network's token is stored, not the real card number.
- All payment transaction data is in a DB in the Mumbai region, following the India data localisation rule.
- Phone and address are masked in logs; the analytics team gets a tokenised customer ID, not the real name.
- Every support agent's access to customer data is in the CloudTrail/audit log, tamper-proof with S3 Object Lock.
- The user clicks 'delete my account': personal data is erased, and only the records required by tax/legal law are kept.
62.7 Interview tips
- The CVV or a full card number getting printed in logs: a direct PCI-DSS violation.
- Copying real production data into test/dev environments without masking.
- Forgetting backups and replicas: a delete request removed it from the primary but the data is still in the backup/data lake.
- Interview tip: always say these 5 points: 'encrypt at rest + in transit, tokenise PII, least privilege, audit logs, data residency'. Quote the numbers too: GDPR breach report within 72 hours, DPDP penalty up to Rs 250 crore.