Physical Record Security Under DPDP: Lessons From Myriad Storage Installations

What happened

OpenPR reports that the implementation of the Digital Personal Data Protection Act, 2023 is driving organisations to overhaul the secure storage of physical personal records. Physical storage manufacturer Myriad Storage System LLP noted a surge in demand from banks, hospitals, and government offices for auditable, access-controlled filing systems. Founded in 2018, the Maharashtra-based company has completed over 500 installations for entities like SBI, Tata, L&T, and ISRO to handle documents such as ID copies and medical files. This market activity signals a shift in how enterprises manage offline data.

Does the DPDP Act apply here?

Section 3 of the DPDP Act states the law applies to personal data collected in non-digital form and digitised subsequently. For a fintech enterprise, this covers physical KYC documents, signed paper mandates, and loan agreements that field agents scan into digital onboarding systems. Rapid product cycles often focus on shipping compliant digital onboarding flows while ignoring backend physical archiving. Once digitised, the physical source document remains subject to the law until it is legally destroyed.

Legal implications under DPDP

Data Fiduciaries must implement reasonable security safeguards to prevent personal data breaches. Compliance teams typically focus on firewalls and API encryption, but a breach of physical records carries the exact same regulatory weight. The DPDP Rules, 2025 require intimation to affected Data Principals without delay following a breach. You must also submit a detailed report to the Data Protection Board within 72 hours. Loss or unauthorised access to a warehouse full of physical ID copies triggers these exact notification timelines.

Could this happen to you

Fintech compliance heads often rely on third-party vendors or legacy bank partners to store physical loan documents. If an outsourced facility lacks access controls, a rogue worker could photograph customer IDs or financial statements. The Data Protection Board of India will ask the Data Fiduciary for the vendor physical security audit trail and evidence of control ownership. A failure to produce this regulator-ready evidence pack exposes the company to penalties of up to 250 crore rupees for failing to secure the data.

What companies should do in the next 30 days

1. Map all physical records across your organisation. The Head of Compliance should add physical KYC forms and mandate documents to the Record of Processing Activities.

2. Audit physical vendors immediately. Request facility access logs and security certifications from your physical archiving service to establish an evidence trail.

3. Update vendor contracts for breach response. Ensure third-party physical storage agreements require breach intimation to your team within 24 hours, so you can meet the 72-hour regulatory deadline.

4. Define specific retention limits. Match physical document destruction schedules with your digital data retention policies to minimise exposure.

What to watch

Regulators like the RBI may begin harmonising their existing digital lending physical record guidelines with the new DPDP requirements. The Data Protection Board of India will also begin enforcing specific formats for breach notification under the Rules, 2025. Exactly 247 days remain until the DPDP hard compliance deadline of 13 May 2027. You can evaluate your current physical and digital security posture across all vendor workflows at freescan.complydp.com.