Is a Google Drive or Dropbox upload link DPDP-compliant for collecting documents?

At a glance

A shared Google Drive or Dropbox upload link is a storage convenience, not a compliance solution. Under India’s DPDP Act the duties are yours: an upload link, on its own, carries no notice of purpose, captures no specific consent, and gives weak control over who can reach the files and how long they sit there. You can use cloud storage as part of a compliant flow, but a bare “upload your documents here” link skips the notice, consent, and control the Act expects — so it doesn’t make document collection compliant by itself.

Educational resource only. This explains how the DPDP Act applies when you collect documents via cloud upload links under India’s Digital Personal Data Protection Act, 2023 (DPDP Act); it is not formal legal advice, and DPDP compliance is an organisation-wide obligation broader than any single channel.

The situation

It’s an easy pattern: create a shared folder, turn on “anyone with the link can upload,” and send it to clients to drop their documents in. It works, and it feels tidier than email. But a link that anyone can use, feeding a folder that keeps everything forever, has several DPDP gaps hiding in the convenience.

What an upload link does — and doesn’t — do

It moves files into your storage; it does nothing about notice, consent, or purpose. A Drive or Dropbox upload link solves transport and storage — the document gets to you and sits in the cloud. What it doesn’t do is any of the DPDP-specific work: it doesn’t tell the person why you need the document (Section 5), it doesn’t capture a specific consent for that purpose (Section 6), and it doesn’t bind the file to a purpose or a retention limit. Those remain entirely your job, and a bare link quietly skips them.

Where the compliance gaps are

The link’s strengths — open, easy, permanent — are exactly its compliance weaknesses. The recurring gaps:

• No notice at collection. The person uploads without being told the purpose or how to withdraw.
• No specific consent. Dropping a file in a folder isn’t a recorded, purpose-bound opt-in.
• Weak access control. “Anyone with the link” is a broad door; links get forwarded, and you may not control who can view or re-share what’s inside.
• No retention discipline. Uploaded documents accumulate in the folder indefinitely, long past the purpose.
• No consent record. You can’t easily show what the person was told and agreed to when they uploaded.

The access-control trap

The most common failure isn’t the upload — it’s who can see the folder afterwards. A shared upload link often sits on a folder that team members, and sometimes anyone with the link, can browse. That turns a collection of clients’ Aadhaar, PAN and bank documents into a widely-reachable pile — precisely the kind of loose access the security duty is meant to prevent. Even where uploads are one-way, the destination folder’s permissions, sharing settings, and link sprawl decide your real exposure. If you can’t say exactly who can open that folder, that’s the first thing to fix.

How to collect documents more compliantly

Keep cloud storage if you like it — but wrap the notice, consent and control around the upload. Practically:

1. Present a notice before the upload — what document, why, how long you’ll keep it, how to withdraw.
2. Capture a specific consent for that purpose, and record it — not just the file landing in a folder.
3. Lock down access — restrict the destination folder to named people; avoid “anyone with the link” for sensitive documents; use upload-only (not browse) where possible.
4. Minimise and mask — ask only for what’s needed, and accept masked documents (e.g. masked Aadhaar) where the full version isn’t required.
5. Set retention — move or delete documents once the purpose is done; don’t let the folder become a permanent archive.

FAQ