Design tools and personal data: how the DPDP Act applies
Reviewed by Confidential Dispatch Editorial Team · Updated 31 Oct 2026 · 7 min read
Usually very little. Designs, layouts and brand assets aren’t personal data, and in normal use the only personal details a design tool holds are your own team’s names and emails. That’s a clean no, as long as it stays that way. Personal data slips in when real customer details go into a design: photos of customers, names merged into certificates or ID cards, or screenshots of a live app. Once it’s in, your DPDP duties follow it, and Figma or Canva keeps it until you delete it.
Educational resource only. These are our findings from each company’s public documentation as of the “Last updated” date at the end of this page. Vendors change their products and terms, so check the current version before you rely on it. We don’t assess or certify any company’s compliance. This explains how India’s Digital Personal Data Protection Act, 2023 (DPDP Act) applies to your use of these tools; it is not formal legal advice.
The situation
You’ve started going through your tools one by one to see which hold customer data. Your CRM and inbox obviously do. Figma and Canva feel like they shouldn’t: they hold logos, social posts, app mockups and presentations. In most cases that’s right. But a design file can carry a customer’s photo, a list of attendee names or a screenshot from your live app as easily as a logo, so the real check is what has gone into your files, not what the tool is for.
Is a design file personal data?
No. A layout, a logo or a mockup is not information about a person, so the DPDP Act doesn’t reach it
The Act covers data about an identifiable individual. Your brand colours, templates and screen designs describe your product and your marketing, not your customers. Even a design for a form that will collect customer data holds none of that data itself. This is what makes design tools different from a CRM, an inbox or a payroll system, where personal data is the point of the product.
What personal data does a design tool routinely hold?
Your team’s names, email addresses and activity, and that’s it
Figma and Canva record who has an account, who edited or commented on a file and when. That is personal data, but it’s your employees’ and collaborators’, and keeping it is part of ordinary work. The DPDP Act lets an employer process employee data for employment purposes without separate consent (Section 7(i)). Your account and billing details are a separate matter, handled by the vendor as part of your account.
Where personal data slips in
Almost always through real content used where placeholder content would do
- Customer photos: event pictures, testimonials with faces, or before-and-after shots used in social posts.
- Bulk-filled designs: certificates, ID cards, badges or invitations filled from a spreadsheet of real names, phone numbers or employee IDs.
- Screenshots of live systems: app mockups and case-study slides built from screenshots that show real customer names, orders or account details.
- User research: interview notes, survey answers and recordings pasted into a whiteboard or design file.
- Client and attendee lists: names and contact details dropped into a deck or a planning board.
- Uploaded documents: an ID card or a form uploaded as a reference image and never removed.
What DPDP duties follow it?
Once customer data is in a design file, it’s held like any other customer data, and your duties as Data Fiduciary follow it
- A reason to use it. A customer who gave you their photo or name for one purpose didn’t agree to it appearing in your marketing. Using a face or a testimonial in a public design needs their consent.
- Security. Who can open a file, whether it’s shared by public link, and whether former staff or freelancers still have access all decide who can see the data.
- Deletion on time. A file of certificates made for one event is done once the event is over. Delete the data, and empty the trash, when its purpose ends (Section 8).
- Breaches. A file containing customer data that was shared publicly, or opened by people who shouldn’t see it, can be a personal data breach. You must inform the Data Protection Board of India and the affected people.
Where does each tool store your files?
Figma offers India hosting on its Enterprise plan; Canva’s region setting offers the US or the EU
The DPDP Act allows personal data to go abroad except to countries the government restricts (Section 16), so a design file stored overseas is not a problem in itself. It does mean any customer data that slips into it is held overseas too.
| Tool | India data centre? | How the region is set |
|---|---|---|
| Figma | Yes, on the Enterprise plan | Set by an organisation admin through Figma’s data residency option |
| Canva | No (stored in the US; the region setting offers the US or the EU, on Enterprise, Campus and District plans) | Set by an organisation admin in Canva’s data residency setting |
Figma
Figma can host your design files in India, but only on its Enterprise plan, and not every part of a file is covered
Its data residency option lets organisation admins on the Enterprise plan host Figma data locally, in regions that include the EU, Australia, India and Brazil. It covers file content such as shapes, text, sticky notes, frames, components, images and videos. Comments, file names, preview thumbnails, plugins and AI chats aren’t localised, and Figma says new file edits may be stored in the US for up to 30 days after creation. Its page doesn’t name a default location for accounts without the option.
Deleted files stay in Figma’s trash until someone restores them or deletes them permanently, which needs edit access to both the file and its folder. A file you’ve deleted but not removed from the trash is still held.
Canva
Canva lets Enterprise, Campus and District organisations choose the US or the EU for their data, with no India option
Organisation admins can set data residency to no preference, the United States or the European Union. Canva’s privacy page says it stores your data in the United States.
Deleted designs stay in Canva’s trash for 30 days before they’re permanently deleted. Images and videos still used in another design aren’t fully deleted until that design is removed too, so check where an uploaded photo is used before you count it as gone.
Habits that keep your design files clean
A few standing rules keep your design tools in the “clean no” column
- Use placeholder data in mockupsMake up names, numbers and addresses, or blur real ones, before a screenshot goes into a design.
- Get consent before you use a face or a name in marketingKeep a record of who agreed and for what.
- Delete bulk-filled designs when they’re doneRemove the certificates or badges and the spreadsheet behind them once they’re printed or sent, and empty the trash.
- Keep research notes out of design filesStore interview notes and recordings where you can control access and deletion, and keep only anonymised findings in the design.
- Share by invitation, not by public linkReview who has access when freelancers or staff leave.
- Check your plan’s region optionIf customer data has to be in a design tool, know where that tool stores it. As the DPDP Act’s 13 May 2027 deadline approaches, you can expect most large Indian platforms, and those that operate in India, to launch features in line with the Act. Keep an eye on your design tool’s privacy settings, release notes and announcements to see what has changed.
FAQ
Does the DPDP Act apply to my Figma or Canva files?
Only to the personal data in them. Designs, layouts and brand assets aren’t personal data. Your team’s account details are, but they’re covered by ordinary employment use. Customer data that goes into a design brings your full duties with it.
Is a customer’s photo in a social post personal data?
Yes. A photo identifies a person. Use it only with their consent for that purpose, and remove it when they withdraw consent.
Can I make certificates from a spreadsheet of names?
Yes, for the purpose the names were given for, such as an event or a course. Delete the designs and the spreadsheet once they’ve been sent, and don’t reuse the list for anything else.
Does Figma or Canva store data in India?
Figma offers India hosting for file content on its Enterprise plan. Canva stores data in the US, and its data residency setting offers the US or the EU, not India.
Will my design tool add DPDP features?
As the DPDP Act’s 13 May 2027 deadline approaches, you can expect most large Indian platforms, and those that operate in India, to launch features in line with the Act. Keep an eye on your design tool’s privacy settings, release notes and announcements to see what has changed.
Every article is checked against the current law and the judgments it cites before it is published.
Updated 31 October 2026 · Not legal advice.
