REGULATORY NOTICE
The Digital Personal Data Protection Rules 2025 are in force. If your business holds personal data of Indian citizens on a Linux server, compliance obligations apply to you now.
DPDP Compliance for Linux Server Owners in India
The DPDP Act 2023 and Rules 2025 place documented obligations on every organisation that stores personal data of Indian citizens. Most of that data sits on Linux servers. Here is what the law actually says, what it means for your infrastructure, and how a managed retainer satisfies it.
The sections of the Act that directly apply to server operators
The DPDP Act uses the term Data Fiduciary for any entity that determines the purpose and means of processing personal data. If you run a business in India and store customer, employee, or patient data on your servers, you are a Data Fiduciary. Two sections matter most.
Section 8 — Obligations of Data Fiduciaries
Section 8 requires Data Fiduciaries to implement “reasonable security safeguards” to prevent personal data breaches. The Rules clarify this includes: access controls, encryption where appropriate, and a documented breach response capability.
On a Linux server, this translates to: SSH key management and disabling password auth, kernel and package patching on a documented schedule, firewall rules limiting access to personal data stores, and log retention for audit purposes. These are not optional best practices — they are the technical implementation of a statutory obligation.
Section 9 — Additional obligations for significant Data Fiduciaries
Section 9 applies to businesses the government designates as Significant Data Fiduciaries based on volume or sensitivity of data processed. These organisations face a higher bar: mandatory Data Protection Impact Assessments (DPIAs), periodic audits, and appointment of a Data Protection Officer.
Whether or not you reach the threshold for Section 9, the technical controls it requires — documented audits, access reviews, impact assessments — are the same controls that satisfy Section 8 for smaller businesses. Building them now costs less than retrofitting them after a notice from the Data Protection Board.
What personal data on a Linux server actually means
Most Indian SMEs underestimate where personal data lives in their infrastructure. Personal data exists across multiple layers of a Linux server.
ERPNext / Odoo / SAP on Linux
Employee records (name, Aadhaar-linked payroll data, bank account numbers, attendance), supplier and customer master data, purchase and sales history. In ERPNext, this is in a MariaDB database at /var/lib/mysql/ on the application server. Backups of this database are personal data too.
Customer data in MySQL / PostgreSQL
E-commerce order tables, CRM contact records, lead management databases. A WooCommerce or Magento backend on Linux stores names, delivery addresses, phone numbers, and payment references — all personal data under the Act. The database user accounts and their permissions are part of your access control obligation.
Access logs and auth logs
Linux system logs (/var/log/auth.log, /var/log/syslog, Apache and Nginx access logs) contain IP addresses, usernames, and session data. IP addresses tied to identifiable individuals are personal data. Most businesses running Linux servers have no defined log retention or access policy for these files.
Email servers and backup storage
A self-hosted Postfix / Dovecot mail server stores correspondence containing personal data — employee communications, customer order confirmations, invoice attachments. Backup directories (rsync targets, NFS mounts, off-site copies) replicate all of this. DPDP obligations apply to the backups, not just live data.
5-point DPDP technical checklist for Linux servers
These 5 controls map directly to the obligations in Sections 8 and 9. They are verifiable, documentable, and auditable — which is exactly what the Data Protection Board will want to see.
Access control audit — every 90 days
List every SSH key authorised on the server, every sudo-capable account, and every database user with SELECT privileges on personal data tables. Document who approved each one. Revoke anything without a current business justification. A written quarterly report is your evidence under Section 8.
Documented patch schedule with records
Apply security patches within 7 days of release. Document the before/after kernel version and retain those records for a minimum of 2 years. An unpatched server is not a reasonable safeguard under Section 8 — the Board can subpoena patch history.
Encryption at rest for personal data stores
Database files containing personal data should be on encrypted volumes (LUKS on block devices, or tablespace-level encryption in MySQL 8+ / MariaDB 10.4+). Backup tarballs must be GPG-encrypted before transfer off-server. If a drive is physically removed from an encrypted server, the data is unreadable. That is what “reasonable safeguard” means in practice.
Continuous monitoring with breach detection capability
You cannot notify a breach you did not detect. Minimum viable monitoring: fail2ban for brute-force detection, auditd for file access on personal data directories, log shipping to a location the attacker cannot modify, and Prometheus/Grafana for infrastructure-level anomaly visibility. An alert that fires is documentation that the system was watching.
Data location inventory and retention policy
You cannot respond to a data principal erasure request if you do not know where their data is. Maintain a written inventory: which databases contain personal data, which tables, which backup destinations, how long each is retained, and a deletion procedure for data past its retention window. Most Indian SMEs have never written this down. That document is the difference between responding to a Board inquiry in 3 days or 3 weeks.
What the law requires from you
Reasonable security safeguards
Documented patch management, access controls, and breach detection. An unpatched kernel or an active ex-employee SSH key is not a reasonable safeguard — it is a documented compliance failure.
Breach notification capability
You cannot notify the Data Protection Board of a breach you did not detect. Continuous monitoring is the technical foundation of this obligation. A server with no monitoring is a server where breaches develop undetected.
Data principal rights
Indian citizens can request access to, correction of, or erasure of their data. You need to know where personal data lives on your server to respond. Most Indian SMEs do not have this documented.
Documentation trail
If the Data Protection Board investigates, they will ask for evidence — not assurances. Patch records, access audit logs, incident reports. “We thought the server was secure” is not documentation.
Which server types are in scope
Any Linux server that stores or processes personal data of Indian citizens is in scope. In practice, that means:
- ERP servers — ERPNext, SAP, Tally Prime Server. Employee records, supplier data, customer billing history.
- E-commerce and D2C servers — customer names, addresses, order histories, payment references.
- Healthcare application servers — patient records, appointment data, clinical notes. Higher sensitivity under the Act.
- CRM and lead management servers — prospect and customer contact data.
- HR and payroll servers — employee personal data, salary records, Aadhaar-linked information.
Free Download
DPDP Linux Compliance Checklist
The 5-point checklist above as a PDF — with CLI commands, legal references, and the compliance table. Enter your name and email to download.
How a managed retainer satisfies DPDP obligations
The documentation DPDP requires is a byproduct of proper Linux server management. AV Services retainer clients receive this as standard output every month.
| DPDP obligation | What AV Services produces |
|---|---|
| Reasonable security safeguards (S.8) | Monthly patch records, SSH access audits, fail2ban logs, firewall review |
| Breach detection (S.8) | 24/7 monitoring via Prometheus, Grafana, Observium and Nagios, auth log review, anomaly alerting |
| Access control documentation (S.8) | Quarterly user account and SSH key audit with written report |
| Incident documentation (S.8) | Written root-cause analysis and resolution report within 24 hours of any incident |
| Data location inventory (S.8 / S.9) | Written inventory of personal data stores, tables, and backup locations — updated on change |
| Offboarding and access revocation (S.8) | Written confirmation of credential removal within 5 business days of engagement end |
Start with a free infrastructure audit
The audit covers the 3 compliance pillars the DPDP Rules require evidence for: patch status, access control gaps, and monitoring state. Written report within 5 business days. No write access needed. No commitment.
Mumbai-based Linux infrastructure management since 1999 · GSTIN: 27ACAPV2614B1Z0
Book Free Audit Compliance Retainer Add-onRelated: DPDP Act 2025 and Your Linux Server · Linux Security Hardening · SEBI CSCRF Linux Compliance · AV Services Privacy & Data Processing Policy