India’s Leading Domain & Web Hosting Provider
Support
Domain & Login
Blog
Cloud Data Security: Discovery, Classification & Encryption Coverage
Cloud data security and encryption is the practice of finding where sensitive data actually lives across cloud storage and databases, labelling it, and enforcing encryption, access restrictions and loss prevention to match its class. NTSPL runs discovery scans, closes encryption gaps at rest and in transit, and puts preventive guardrails in place for Indian insurers, healthcare and pharma firms facing DPDP Act obligations.
Delivered on
In scope
Where Personal Data Hides in a Cloud Estate
Every data protection programme assumes an answer to one question: where is the personal data? In cloud estates the honest answer is usually 'more places than we thought'. Production exports are copied into UAT buckets for testing, claims documents are dumped into a 'temp' container by an integration job, old RDS snapshots predate encryption defaults, and internal load balancers still accept TLS 1.0. Under the DPDP Act 2023, a data fiduciary must protect personal data with reasonable security safeguards, and a failure there can draw a penalty of up to INR 250 crore.
NTSPL starts with automated discovery rather than interviews: Macie, Purview or Sensitive Data Protection scan storage and databases with India-specific identifiers such as PAN, Aadhaar, ABHA numbers and policy or patient IDs. Results drive a four-level classification applied as tags or labels. Encryption is then enforced by policy, not by request, legacy unencrypted stores are re-created encrypted, and preventive controls stop sensitive classes from landing in non-production or public locations again.
Signs Your Sensitive Data Map Is Out of Date
Signals you need Data Security & Encryption
- Nobody can say which of your 50 or more buckets, containers or datasets contain PAN, Aadhaar or health data
- Production data is regularly copied to development or UAT environments for testing
- Older databases, snapshots or volumes were created before encryption-by-default and remain unencrypted
- Internal endpoints still negotiate TLS 1.0 or 1.1, or certificates are managed by hand
- A DPDP readiness exercise or IRDAI cyber audit has asked for a data inventory with protection status
When to choose something else
- You need masking, tokenisation and row- or column-level security inside a warehouse or lakehouse for analysts: see Data Security & Privacy in the Data & Analytics family.
- Your gap is key hierarchy, rotation, BYOK or HSM design rather than coverage: that is Secrets & Key Management.
Discovery, Labelling, Encryption and Leak Prevention Workstreams
Sensitive data discovery
Scan object storage, file shares, managed databases and data warehouses with built-in and custom identifiers for PAN, Aadhaar, ABHA, UPI IDs, policy and patient numbers.
Classification and labelling
Apply a 4-level scheme (public, internal, confidential, restricted) as resource tags, Purview sensitivity labels or Dataplex aspects, owned by named data stewards.
Encryption at rest
Enforce provider or customer-managed key encryption on every store, and re-create unencrypted volumes, snapshots and databases.
Encryption in transit
Set TLS 1.2 minimum, preferring 1.3, on load balancers, databases, storage endpoints and internal services, with certificate lifecycle automated.
Leak prevention
Block public sharing at organisation level, deny restricted-class data in non-production, and add DLP alerts for bulk downloads and cross-tenant copies.
Scan, Classify, Enforce: The Data Protection Control Loop
Sensitive Data Discovery and Encryption Enforcement Loop
Discovery scanners sample every data store with India-specific identifiers and write findings to a classification register. Labels then drive preventive policies for encryption, location and sharing, while detective rules re-open findings when new sensitive data appears in the wrong place.
Select any component
Sensitive Data Discovery and Encryption Enforcement Loop: click any of its 7 components to see its role and the design choice NTSPL makes for it, or trace the 7-step primary path.
Macie, Purview and Sensitive Data Protection Side by Side
Macie automated sensitive data discovery samples every bucket daily at controlled cost; custom data identifiers handle Indian IDs it does not cover natively.
Purview scans Azure SQL, Blob and ADLS and can apply labels; Azure Policy enforces minimum TLS and infrastructure encryption per resource type.
Sensitive Data Protection discovery profiles BigQuery, Cloud SQL and Cloud Storage at org level; the resource-locations constraint keeps restricted data in Mumbai and Delhi.
Classification Levels, Key Ownership and Non-Production Data Rules
How many classification levels
Use four levels. Three merges personal and highly sensitive health or financial data; six or more confuses stewards and labels drift. Restricted should mean sensitive personal data such as health records, Aadhaar or account numbers, plus anything a regulator names; confidential covers other personal and business data. Map each level to fixed encryption, location and sharing rules.
Provider-managed or customer-managed keys
Provider-managed encryption satisfies most at-rest requirements. Use customer-managed keys for restricted data where you need key-level access policies, separation of duties or the ability to crypto-shred a dataset. Do not apply customer-managed keys everywhere by default: it multiplies key policies and operational risk without adding protection for internal-class data. Review the split yearly.
Production data in non-production
Ban restricted-class data from non-production outright and enforce it with scans plus deny policies on cross-environment copies. For confidential data, allow masked or synthetic extracts generated by an approved pipeline. Where a defect truly needs production data, use a time-limited secure enclave account with production-grade controls rather than copying to UAT.
Scan depth versus cost
Run full scans once for the baseline on stores under 10 TB, then switch to sampling-based automated discovery. For multi-petabyte image or document archives, scan by prefix samples and metadata. Set per-account cost caps; a careless full Macie or DLP job on a 400 TB bucket can cost more than the entire engagement.
From First Discovery Scan to Enforced Encryption
Baseline discovery scan
Enable discovery across all accounts with custom Indian identifiers and profile priority databases.
Classification and steward sign-off
Agree class per store with data owners and write labels back to resources.
Encryption gap closure
Re-create unencrypted snapshots, volumes and databases encrypted and enforce TLS 1.2 minimum endpoint by endpoint.
Preventive guardrails
Deploy deny policies for public access, weak TLS, unencrypted resources and restricted data outside approved locations.
Leak monitoring and handover
Route DLP and discovery alerts to the SOC and hand over the steward review cycle.
What you receive
Coverage Measures for Discovery and Encryption
| KPI | Typical target |
|---|---|
| Data stores covered by automated discovery | 100% of production and non-production |
| Restricted-class stores encrypted with approved keys | 100% |
| Endpoints accepting TLS below 1.2 | Zero |
| Restricted data found in non-production | Zero open beyond 7 days |
Scan Cost Overruns, Re-Encryption Outages and Label Drift
| Risk | How NTSPL prevents it |
|---|---|
| Re-encrypting a large production database causes extended downtime | Use replica-based or snapshot-copy approaches with a timed cutover rehearsed in staging. |
| Discovery scans generate runaway charges on large archives | Sampling, prefix scoping and per-account budgets with alerts at 50% and 80%. |
| Labels drift as new stores appear unlabelled | Untagged stores default to restricted controls until a steward classifies them. |
Is encryption at rest enough for DPDP Act compliance?
No. Encryption at rest protects against stolen disks and some misdirected snapshots, but most cloud data leaks happen through valid access paths: a public bucket, an over-privileged role, a test copy of production or a bulk export by an insider. The DPDP Act expects reasonable security safeguards, which regulators and courts will read as knowing where personal data is, restricting who can reach it, preventing it leaking to the wrong place and being able to detect and report a breach. Treat encryption as the baseline, then spend most effort on discovery, access restriction, non-production rules and leak detection.
Key facts: Data Security & Encryption
Data Security & Encryption in Practice
2 Data Security & Encryption scenarios, from Health insurance (standalone health insurer) and Pharmaceuticals (clinical development), plus related platform case studies.
Health insurer finds 3.1 million unprotected records in test buckets and closes every gap
Clinical trials team puts every subject dataset under CMEK and India-only storage
Health-tech SaaS moves patient data behind KMS and Identity Center ahead of DPDP
Three directories become one: identity consolidation after two acquisitions
Data Security & Encryption: Frequently Asked Questions
How much does a data discovery and encryption programme cost?
For an estate with 100-300 data stores, NTSPL's engagement typically runs INR 10-20 lakh over ten weeks. Scanner charges are separate and depend on volume; with sampling-based discovery most mid-size Indian estates spend INR 25,000-1.5 lakh a month after the baseline scan.
Can discovery tools recognise Aadhaar and PAN numbers?
Built-in detectors vary by provider and some cover Indian identifiers, but coverage of policy numbers, ABHA numbers, UHIDs and internal customer IDs always needs custom identifiers. We build and test regex, checksum and keyword-proximity rules on sample data before full scans to keep false positives manageable.
What does the DPDP Act require for data security?
The DPDP Act 2023 requires data fiduciaries to take reasonable security safeguards to prevent personal data breaches and to notify the Data Protection Board and affected individuals of a breach. Failing to take those safeguards can attract a penalty of up to INR 250 crore.
Will enforcing TLS 1.2 break older clients?
Possibly, so we check first. Load balancer and endpoint logs show negotiated TLS versions per client for a few weeks; old Android devices, legacy partner integrations and embedded devices are the usual stragglers. They get a dated exception on a separate endpoint while partners upgrade.
Should we use customer-managed keys for everything?
No. Use them where they add control: restricted data, datasets you may need to crypto-shred, and stores requiring separation between key administrators and data administrators. Provider-managed keys are fine elsewhere. Key hierarchy and rotation design are covered under Secrets & Key Management.
How do you keep personal data out of test environments?
Discovery scans run on non-production accounts as well, deny policies block copying restricted-class resources across environment boundaries, and masked or synthetic datasets are generated by an approved pipeline. Any restricted finding in non-production opens a ticket with a 7-day closure target.