Encryption-in-Use

In the context of the Digital Personal Data Protection Act, 2023 (DPDP Act), encryption-in-use refers to techniques that protect personal data while it is being processed by applications, systems, or computing environments. Unlike encryption at rest, which protects stored data, and encryption in transit, which protects data while it moves between systems, encryption-in-use focuses on protecting data during active processing when it would traditionally need to be available in readable form.

Organizations process personal data across analytics platforms, artificial intelligence systems, cloud environments, databases, and business applications. During processing, data may be exposed to administrators, applications, infrastructure providers, or unauthorized actors if appropriate controls are not implemented. Encryption-in-use technologies, such as confidential computing and secure processing environments, aim to minimize this exposure by allowing organizations to perform operations on protected data while reducing access to the underlying information.

The DPDP Act does not specifically require encryption-in-use or prescribe any particular encryption technology. However, it requires Data Fiduciaries to implement reasonable security safeguards to protect personal data from Personal Data Breaches. For organizations processing high-risk personal data or using advanced technologies such as artificial intelligence, encryption-in-use may be considered as part of a broader privacy and security strategy to strengthen protection during data processing.

In practice, gaps emerge when:

• Personal data is encrypted during storage and transmission but remains exposed during processing.
• Organizations use cloud processing environments without understanding data access risks.
• AI and analytics systems process personal data without adequate privacy safeguards.
• Sensitive personal data is shared with third-party processors without appropriate controls.
• Security measures focus only on databases and networks while ignoring processing environments.

Organizations address these risks by adopting privacy-enhancing technologies, implementing secure processing environments, applying strict access controls, and evaluating protection measures throughout the personal data lifecycle. Within Privy, capabilities such as automated data discovery, data classification, data mapping, governance workflows, privacy assessments, and audit-ready reporting help organizations understand where personal data is processed and identify appropriate safeguards based on privacy risks.