ComplyDP4 mins
Myriad Publishes Compactor Layouts as DPDPA Drives Physical Record Security
Organizations are upgrading physical document storage to meet DPDPA security mandates. We analyze how offline records digitised subsequently expose General Counsel to regulatory liability and breach notification rules.
Last updated:
What Happened
On 09 August 2026, Myriad Storage System LLP published layouts for secure file compactor storage. OpenPR reported the release as a response to organizations upgrading physical document security. Banks, hospitals, and government offices retain massive volumes of physical records. These include signed forms, ID copies, medical files, and legal documents. Entities with heavy offline workflows are deploying access-controlled and auditable storage compactors to align with the security trends prompted by the Digital Personal Data Protection Act, 2023.
Does The DPDP Act Apply Here?
Section 3(a)(ii) restricts the Act to personal data in digital form or non-digital data digitised subsequently. A purely offline paper archive never entered into a computer falls outside the statute. Enterprise operations rarely maintain complete separation between offline and online systems. EdTech platforms collect physical verifiable parental consent forms or parent ID copies during offline enrolment drives. The moment a staff member scans that form or enters its details into a database, the physical paper becomes the source material for a regulated digital record. Losing the paper copy exposes the exact personal data governed by the Act.
Legal Implications Under DPDP
General Counsel must evaluate liability allocation across hybrid workflows. Section 8(4) requires a Data Fiduciary to implement reasonable security safeguards to prevent a personal data breach. The DPDP Rules, 2025 operationalize this duty with strict timelines. If an unauthorized individual accesses a storage room containing scanned parent ID copies, the organization suffers a breach. The Rules mandate notifying the Data Protection Board of India (DPBI) within 72 hours alongside an immediate intimation to affected Data Principals. An auditor will not differentiate between a compromised cloud database and a breached physical filing cabinet if both contain the same personal data.
Could This Happen To You
Legal heads evaluating defensibility often overlook physical archives. Your contracts specify strict digital access controls for SaaS vendors. Meanwhile, physical ID copies or signed enrolment forms sit in unsecured office cabinets. If an employee steals physical records containing digitized data, your liability triggers instantly. The DPBI will demand access logs, breach workflows, and vendor oversight records. If you rely on third-party physical storage, outside counsel will review the indemnities covering unauthorized access. You need documented evidence that physical storage is as auditable as your digital infrastructure.
What Companies Should Do In The Next 30 Days
1. Map the physical document lifecycle. Assign the Legal team to trace how parental consent forms or employee IDs are stored after they are scanned into your systems.
2. Review vendor contracts for off-site archiving. Update limitation of liability clauses to heavily penalize physical access control failures by third-party storage providers.
3. Implement access logs for on-site physical storage rooms. Facility managers must retain records of who enters archiving areas to maintain defensibility during a regulatory audit.
What To Watch
Regulator engagement will test how companies interpret reasonable security safeguards across physical and digital domains. The DPBI is expected to scrutinize hybrid data processing environments where physical records feed digital platforms. Exactly 212 days remain until the DPDP hard compliance deadline of 13 May 2027. Legal teams must finalize physical and digital compliance workflows before this date. Find out what an auditor will ask your team with a free gap assessment at https://www.complydp.com/audit-preview.
Sources
Frequently asked questions
Does the DPDP Act cover physical paper documents?
The DPDP Act covers physical records only if they are digitised subsequently, per Section 3(a)(ii). Purely offline records never entered into a digital system are exempt. Once scanned or entered into a database, the original physical documents require security safeguards to prevent data breaches.
What is the penalty for failing to secure physical documents containing digitised data?
Failing to implement reasonable security safeguards under Section 8(4) can result in penalties up to INR 250 crore. The Data Protection Board determines the exact penalty based on the severity and scale of the breach. Organizations must secure both the digital database and the physical source files.
Are we required to notify the DPBI if a physical file cabinet is broken into?
Yes, if the physical files contain personal data that is part of a digital workflow. The DPDP Rules, 2025 require Data Fiduciaries to notify the DPBI within 72 hours of a personal data breach. You must also notify affected Data Principals without delay.
Is consent required before we scan physical ID copies?
Consent is the primary basis for processing digital personal data, which includes scanning physical documents. Organizations can only bypass consent if the processing qualifies under specific Section 7 legitimate uses, such as employment purposes or responding to medical emergencies.
How do physical records impact verifiable parental consent in EdTech?
EdTech companies often collect offline parental consent forms or physical ID tokens. Under Rule 10, the process of verifying parentage generates personal data. The physical forms must be stored securely and audited to prove compliance with children's data processing restrictions.