Code hosting and personal data: how the DPDP Act applies
Reviewed by Confidential Dispatch Editorial Team · Updated 31 Oct 2026 · 9 min read
Usually very little. Source code isn’t personal data, and in normal use the only personal detail a repository carries is each commit author’s name and email: your own team’s, not your customers’. That is a clean no, as long as it stays that way. The exposure comes from what slips in by accident: a database dump, test data copied from production, a log file or a customer screenshot in an issue. Once committed, it stays in the repository’s history on GitHub, GitLab or Bitbucket until you remove it properly.
Educational resource only. These are our findings from each company’s public documentation as of the “Last updated” date at the end of this page. Vendors change their products and terms, so check the current version before you rely on it. We don’t assess or certify any company’s compliance. This explains how India’s Digital Personal Data Protection Act, 2023 (DPDP Act) applies to your use of these tools; it is not formal legal advice.
The situation
Your developers push code every day, and you’ve started going through your tools one by one to see which hold customer data. Your CRM obviously does. Your code repository feels like it shouldn’t, and in most cases it doesn’t. But a repository keeps everything anyone has ever committed to it, so the real check is not what it holds today, but what has ever been pushed.
Is code personal data?
No. Code is instructions, not information about a person, so the DPDP Act doesn’t reach it
The Act covers data about an identifiable individual. Your application’s logic, configuration and documentation describe how your product works, not who your customers are. Even code that processes customer data, such as a signup form or a payments module, holds none of that data itself. This is what makes a code host different from a CRM, an inbox or an accounting tool, where personal data is the point of the product.
What personal data does a repository routinely carry?
Your team’s names and email addresses, attached to every commit
Git records an author name and email on each commit, and on a public repository anyone can read them. That is personal data, but it is your employees’ and contributors’, and keeping it is part of ordinary work. The DPDP Act lets an employer process employee data for employment purposes without separate consent (Section 7(i)), and a commit record is exactly that.
Your developers can keep their personal addresses out of public view anyway. GitHub, for example, offers a noreply address for commits, and a setting that blocks a push when the latest commit’s author email is one you’ve marked private. Your user accounts and billing details are a separate matter: the host handles those as part of your account, not as data inside your repositories.
Where personal data slips in
Almost always by accident, and almost always in one of a handful of ways
- Database dumps and exports committed to “keep a backup” or to share with a colleague.
- Test data copied from production: a fixtures file with real customer names, phone numbers or PAN numbers instead of made-up ones.
- Log files that recorded user emails, IP addresses or request bodies, committed along with the code.
- Configuration files like
.envthat hold credentials to the database where your customer data lives. The file isn’t personal data, but it’s the key to it. - Issues and pull requests where someone pasted a customer’s screenshot, email thread or error report to explain a bug.
- Spreadsheets and documents dropped into the repository because it was the easiest shared folder.
Each one turns your repository into a store of customer personal data, and your duties as a Data Fiduciary follow it there: keeping it secure, keeping it only as long as needed, and reporting a breach if it’s exposed. The host then holds that data for you as your Data Processor.
Where does each host store your repositories?
None of the three offers India hosting on its standard cloud service; GitLab can run a dedicated instance in Mumbai, and GitLab and Bitbucket can both run on your own servers
The DPDP Act allows personal data to go abroad except to countries the government restricts (Section 16), so a repository hosted overseas is not a problem in itself. It does mean that any customer data that slips into it is held overseas too.
| Host | India data centre? | How the region is set |
|---|---|---|
| GitHub | No (GitHub.com is in the US; data residency on Enterprise Cloud offers the EU, Australia, the US and Japan) | Chosen for an Enterprise Cloud account with data residency |
| GitLab | Not for GitLab.com, which runs mainly in Google Cloud’s us-east1 region in the US; GitLab Dedicated can run in Asia Pacific (Mumbai) | Chosen for a GitLab Dedicated instance, or by where you host GitLab yourself |
| Bitbucket | Not for Bitbucket Cloud, which isn’t among Atlassian’s data residency products and whose region we couldn’t independently verify; Bitbucket Data Center runs on your own servers | By where you host Bitbucket Data Center |
GitHub
GitHub stores GitHub.com data in the United States, and its data residency option doesn’t include India
GitHub says that by default it stores data for GitHub.com in the USA. GitHub Enterprise Cloud with data residency lets a company choose where its code and data are stored, in the EU, Australia, the US or Japan.
For keeping personal details out of commits, GitHub offers a noreply address that becomes the default author email once you turn on email privacy, and a setting that blocks command-line pushes that would expose a private email. For data that has already been pushed, GitHub’s guide to removing sensitive data recommends git-filter-repo, warns that forks keep the data, and says GitHub Support can remove cached views and references in pull requests once you’ve done the rest.
GitLab
GitLab can run a dedicated instance in Mumbai, and can be installed on your own servers
GitLab Dedicated, its single-tenant offering, runs in a region you choose, and Asia Pacific (Mumbai) is on its list of primary regions. GitLab can also be self-managed, so it runs wherever you host it. GitLab.com itself, its shared cloud service, is hosted mainly in Google Cloud’s us-east1 region in the United States, according to GitLab’s handbook.
GitLab’s secret push protection blocks secrets such as keys and API (application programming interface) tokens from being pushed, on its Ultimate tier, across GitLab.com, self-managed and Dedicated. Its guide to removing a secret from commits says to revoke the secret immediately, then rewrite the commit history and force-push the corrected branch.
Bitbucket
Bitbucket Cloud isn’t among Atlassian’s data residency products, and Atlassian points customers with strict residency needs to Bitbucket Data Center, which you host yourself
Atlassian’s data residency page lists Jira, Jira Service Management, Jira Product Discovery, Loom and Confluence as the products that support it, with India among the locations; Bitbucket isn’t on the list. An Atlassian post recommended that customers with strict residency requirements use Bitbucket Data Center. We couldn’t independently verify from Atlassian’s pages which region Bitbucket Cloud uses today.
The same Git history rules apply on Bitbucket: anything committed stays in every earlier commit until the history is rewritten, and every existing clone still holds it.
What to do if customer data is in your history
Deleting the file in a new commit isn’t enough: the data is still in every earlier commit
- Rotate any exposed credentials firstIf a
.envfile or a database password was committed, change it immediately. That closes the door even before the history is cleaned. - Rewrite the history to remove the dataUse your host’s recommended method, such as
git-filter-repoon GitHub or an interactive rebase as GitLab’s guide describes. Every developer then has to replace their local copy, or the old history can be pushed back. - Deal with forks and copiesRewriting your repository doesn’t reach forks or anyone’s clone. Ask the owners of any forks to delete or clean them.
- Ask your host to clear what’s leftOld commits can stay reachable in cached views and pull requests. GitHub Support, for example, can remove those once you’ve cleaned everything else.
- Decide whether it was a breachIf the repository was public, or someone outside the people entitled to the data could see it, treat it as a personal data breach: the DPDP Act requires you to inform the Data Protection Board of India and the affected people (Section 8).
Habits that keep your repositories clean
A few standing rules keep your code host in the “clean no” column
- Never commit real customer data. Generate fake test data, or mask anything copied from production before it goes near a repository.
- Keep dumps, logs and
.envfiles out with a.gitignorethat every repository starts with. - Turn on secret scanning and push protection where your host and plan offer them, so credentials are caught before they land.
- Strip customer details from screenshots and error reports before pasting them into issues.
- Keep repositories private unless they need to be public, and review who has access when people leave.
- Watch your host’s settings. As the DPDP Act’s 13 May 2027 deadline approaches, you can expect most large Indian platforms, and those that operate in India, to launch features in line with the Act. Keep an eye on your code host’s privacy settings, release notes and announcements to see what has changed.
FAQ
Does the DPDP Act apply to my repositories?
Only to the personal data in them. Code itself isn’t personal data. Commit names and emails are, but they’re your team’s and covered by ordinary employment use. Customer data that has slipped in brings your full duties with it.
Are commit author emails personal data?
Yes. They identify a person. For your own employees, keeping them is part of employment and needs no separate consent. Developers can use a private address, such as GitHub’s noreply address, to keep their personal email out of public commits.
Is it a breach if customer data was in a private repository?
Not necessarily. If only people entitled to see that data had access, it may not count as a breach, though you should still remove it. If the repository was public, or outsiders had access, treat it as a breach and report it.
Does GitHub, GitLab or Bitbucket store data in India?
Not on their standard cloud services. GitHub.com and GitLab.com run in the US, and GitHub’s data residency regions are the EU, Australia, the US and Japan. GitLab Dedicated can run in Mumbai, and self-managed GitLab and Bitbucket Data Center can run on your own servers in India.
Will my code host add DPDP features?
As the DPDP Act’s 13 May 2027 deadline approaches, you can expect most large Indian platforms, and those that operate in India, to launch features in line with the Act. Keep an eye on your code host’s privacy settings, release notes and announcements to see what has changed.
Every article is checked against the current law and the judgments it cites before it is published.
Updated 31 October 2026 · Not legal advice.
