Unsecured Physical Records Create New Contingent Liabilities Under DPDP Rules 2025

What happened

According to OpenPR, Indian enterprises including banks and hospitals are procuring access-controlled physical storage systems to secure paper records in response to the Digital Personal Data Protection Act, 2023.

Vendors like Myriad Storage System LLP report over 500 installations of mobile compactor storage across organisations such as SBI, Tata, and ISRO. The procurement trend shows financial institutions recognising that physical files containing signed forms, ID copies, and legal documents require strict access controls.

Does the DPDP Act apply here?

Section 3(a)(ii) of the Act covers digital personal data collected in non-digital form and digitised subsequently. Banks and NBFCs routinely collect physical KYC documents and loan applications before scanning them into core banking systems.

Once this digitisation occurs, the data falls squarely under the Act. The legislation covers data about an individual who is identifiable, excluding anonymised data or generic corporate intellectual property. Mishandling the original physical copies leaves the organisation exposed to regulatory scrutiny regarding how that personal data is handled and eventually erased.

Legal implications under DPDP

Data Fiduciaries must implement reasonable security safeguards to prevent a personal data breach under Section 8 of the Act. The DPDP Rules, 2025 require reporting any breach to the Data Protection Board of India within 72 hours, alongside intimation to affected Data Principals without delay. This tight window applies equally to physical breaches, such as a stolen briefcase or forced entry into a branch record room.

A compromised physical loan file constitutes a reportable data breach if the information it contains is digitised and covered by the Act. Consent is the primary basis for processing, except where Section 7 legitimate uses apply. Retaining physical records in unsecured cabinets without access controls violates the obligation to protect Data Principal information.

Could this happen to you

BFSI operations typically span hundreds of branch locations containing legacy paper files. An unsecured record room in a regional branch presents a massive contingent liability for the CFO. If an unauthorised person accesses physical KYC files, the resulting regulatory failure carries a penalty ceiling of up to 250 crore rupees per breach.

Maintaining disjointed storage solutions across different states inflates compliance budgeting and obscures visibility. Cyber insurance underwriters increasingly demand proof of documented physical access controls. Failing an audit on physical document security will drive up premiums, trigger higher audit fees, and directly impact your EBITDA.

What companies should do in the next 30 days

1. The Chief Compliance Officer must inventory physical record storage across all branches to locate unprotected KYC and financial data.

2. The CFO should evaluate vendor consolidation for physical storage, calculating the total cost of ownership for standardised compactors against the risk of scattered archiving.

3. Legal teams need to match physical document disposal workflows to the data retention timelines specified in the DPDP Rules, 2025.

4. Procurement leaders must verify that any physical storage vendors maintain appropriate certifications, such as ISO 9001:2015, to support compliance provisioning.

What to watch

The Data Protection Board of India will likely scrutinise physical document management during early enforcement actions involving hybrid data environments. Insurance providers will start requesting evidence of physical access controls during policy renewals next quarter, tying premium rates to demonstrable safeguard implementation.

246 days remain until the DPDP hard compliance deadline of 13 May 2027. To calculate your organisation's breach exposure and evaluate your current safeguards, use the assessment tool at freescan.complydp.com.