Workspace and email tools and personal data: how the DPDP Act applies
Reviewed by Confidential Dispatch Editorial Team · Updated 31 Oct 2026 · 11 min read
Your email and shared drives hold customer personal data every day: enquiries, signatures, ID copies sent as attachments, spreadsheets of client details. Under India’s DPDP Act, your business is the Data Fiduciary and Google, Microsoft or Zoho is your Data Processor, so notice, security, deletion and breach reporting stay with you. Microsoft 365 and Zoho Mail can store an Indian account’s mail in India; Google Workspace offers the US or Europe. Mail stays until someone deletes it, so deletion is the duty most businesses miss.
Educational resource only. These are our findings from each company’s public documentation as of the “Last updated” date at the end of this page. Vendors change their products and terms, so check the current version before you rely on it. We don’t assess or certify any company’s compliance. This explains how India’s Digital Personal Data Protection Act, 2023 (DPDP Act) applies to your use of these tools; it is not formal legal advice.
The situation
A client emails you a scan of their PAN card. A colleague saves a spreadsheet of customer phone numbers to a shared drive. Your sales team sends calendar invites to prospects every day. None of this feels like “collecting personal data”, but all of it is, and it all sits in your email and workspace account. With the DPDP Act’s full obligations applying from 13 May 2027, the question is what that means for how your business uses Gmail, Outlook or Zoho Mail, and whether the provider you picked changes anything.
Is any email service “DPDP-compliant”?
No email service makes you compliant: the DPDP Act puts the duties on your business, not on the software
You decide why customer emails and files are kept and how they’re used, which makes you the Data Fiduciary. Google, Microsoft or Zoho stores and processes that data on your instructions, which makes it your Data Processor. The Act requires you to have a valid contract with any processor you use (Section 8), and you stay answerable for what happens to the data either way.
What matters is whether your use of the account delivers what the Act requires: a notice when you ask people for their data, use limited to the stated purpose, security, deletion on time, and a way to handle requests and breaches. The provider differences below are about how much help the tools give you and where your data sits.
What personal data flows through your email and drives?
Almost every kind of personal data your business handles passes through it at some point, much of it unplanned
In a typical business account you’ll find:
- Customer emails: enquiries, complaints and replies, each carrying a name, an email address and often a phone number and address in the signature.
- Attachments: Aadhaar, PAN, passport or driving licence copies, bank statements, signed forms and invoices that customers and staff send by email. These are the most sensitive items in most accounts, and the hardest to find later.
- Shared drive files: spreadsheets of customer details, exported reports and scanned documents saved to Google Drive, OneDrive, SharePoint or Zoho WorkDrive.
- Calendars and contacts: meeting invites with prospects’ names and emails, and address books synced from every employee’s phone.
- Chat messages: Google Chat, Microsoft Teams or Zoho Cliq conversations where staff discuss customers by name.
- Your employees’ own data: every staff mailbox, plus HR emails about salaries, leave and appraisals. The Act lets you process employee data for employment purposes without separate consent (Section 7(i)), but your other duties, such as security and deletion, still apply.
What DPDP duties do your email and drives create?
Each part of how you use the account maps to a specific duty
- Notice when you ask for data. An email asking a customer to send their documents is a point of collection. It needs to say what you’re collecting and why (Section 5). Collecting ID copies by email is one of the commonest gaps, and why email document collection breaks the DPDP Act sets out what to do instead.
- Purpose limits. A PAN copy sent for a tax filing is for that filing. Forwarding it to another team or reusing it for a different service needs its own basis.
- Deletion on time. Email is kept until someone deletes it, so most business mailboxes hold years of customer attachments that no longer serve any purpose. Once the purpose is over, the data has to be erased (Section 8), and that includes copies in sent mail, shared drives and every recipient’s inbox in your organisation.
- Security. Two-step verification, who can open shared folders, files shared through “anyone with the link”, and mailboxes of people who have left are all part of your duty to protect the data.
- Rights requests. When a customer asks what you hold about them or asks you to delete it, the answer is spread across many mailboxes and folders. You need a way to search all of them at once.
- Breaches. A compromised mailbox, a spreadsheet emailed to the wrong person or a customer folder shared publicly can each be a personal data breach. You must inform the Data Protection Board of India and the affected people.
Where does each provider store your data?
Microsoft 365 and Zoho Mail can keep an Indian account’s mail and files in India; Google Workspace offers the US or Europe
The DPDP Act doesn’t require Indian data to stay in India: it allows transfers abroad except to countries the government restricts (Section 16), though some sector regulators set their own rules. You should still know where your data is, because it decides which country’s servers hold your customers’ records.
| Provider | India data centre? | How the region is set |
|---|---|---|
| Google Workspace | No (the US or Europe, on eligible plans) | A data regions policy in the Admin console |
| Microsoft 365 | Yes, for mailboxes, SharePoint, OneDrive and Teams chats | By the country your account was set up in; shown under Data location in the admin center |
| Zoho Mail | Yes (Mumbai, with Chennai as backup) | By your location when you sign up |
Google Workspace
Google Workspace has no India data region: its data regions setting offers the United States or Europe
Business Standard, Business Plus, the Enterprise plans and some Education plans include a version of data regions at no extra cost, set from the Admin console. Users on plans without it aren’t covered by a data regions policy at all. Google’s local data storage feature, for Enterprise Plus customers with the Assured Controls add-on, exports your organisation’s data to a Google Cloud Storage bucket in a location you choose. It’s an export, and it doesn’t change where Gmail and Drive keep your data.
Google Workspace keeps your data in user accounts until a user or an administrator deletes it. Deleted Gmail messages stay in Trash for 30 days before they’re permanently deleted. Google Vault, included in Business Plus, the Enterprise plans and others, lets you set retention rules that keep or delete data after a set period, and search and export one person’s data across every account, which is what a rights request needs. Data loss prevention on the Enterprise, Frontline and Education plans includes ready-made detectors for Aadhaar, PAN and GST numbers.
Microsoft 365
Microsoft 365 stores an India-provisioned account’s mailboxes, SharePoint and OneDrive files and Teams chats in India
Microsoft commits to keeping that data at rest in India if your account was provisioned there. To confirm yours, go to Settings, then Org settings, then Organization profile in the Microsoft 365 admin center and check Data location. One exception to note: Microsoft’s Teams pages say India data residency for Teams applies to new accounts, and existing Indian accounts keep Teams data in the Asia Pacific region. The Data location page shows where yours is.
Microsoft’s privacy and compliance tools sit in Microsoft Purview. Retention policies can keep content, delete it after a period, or keep it and then delete it, across Exchange mailboxes, SharePoint, OneDrive and Teams. eDiscovery searches mailboxes, OneDrive, SharePoint and Teams in one go and exports the results. Its sensitive information types include Aadhaar, PAN, Voter ID, driving licence and GST numbers, for use in data loss prevention policies. When someone permanently deletes an email, Exchange Online keeps it in Recoverable Items for 14 days by default, adjustable up to 30. Retention policies for mailboxes, SharePoint and OneDrive, and data loss prevention for email and files, come with Business Premium and the E3 and E5 plans, not with Business Basic or Business Standard. Those two plans can still set retention policies for Teams chats.
Zoho Mail
Zoho stores Indian accounts in India, in Mumbai with Chennai as backup
Zoho assigns each account to a data centre based on your location at sign-up, detected from your internet address. An India-region account logs in at a zoho.in address. Moving to another data centre later means closing the account and signing up again, or asking Zoho’s migration team to move it.
Zoho Mail’s eDiscovery, on the Mail Premium and Workplace Professional plans, keeps emails, including deleted ones, for a period you set (365 days by default) and lets administrators search active and archived mail and export it. Its data loss prevention, on the same plans, includes ready-made identifiers for Aadhaar, PAN, passport, driving licence and Voter ID numbers; Zoho says it’s available in select regions and turned on by request, so ask Zoho Mail support whether your account can have it. Deleted emails stay in Trash for 5 to 180 days, depending on when they were received and your cleanup setting, then remain on Zoho’s servers for another 30 days before they’re purged.
How to set up any workspace for the DPDP Act
The steps are the same whichever provider you use; only the setting names change
- Find out where your data is storedUse the table above, then confirm in your own admin console.
- Secure every accountTurn on two-step verification for everyone, keep administrator access to a few people, and when someone leaves, transfer what the business needs and close their account promptly.
- Stop collecting ID documents by emailAn attachment lives in the sender’s sent mail, your inbox and every forward, with no expiry. Use a collection method that comes with a notice and a deletion date instead.
- Lock down sharingTurn off “anyone with the link” sharing for customer files, limit sharing outside your organisation, and review what’s already shared publicly.
- Set retention rules and act on themDecide how long customer emails and files stay, then use your provider’s retention tools to delete them on schedule. As the DPDP Act’s 13 May 2027 deadline approaches, you can expect most large Indian platforms, and those that operate in India, to launch features in line with the Act. Keep an eye on your workspace’s privacy settings, release notes and announcements to see what has changed.
- Know what “deleted” means in your accountTrash, recoverable items and retention rules can each keep a deleted email for days or months. When an erasure request has to be final, check that no rule or hold is still keeping a copy.
- Have a process for rights requestsKnow how to search every mailbox and drive for one person’s data, export it, and delete it, and who on your team does it.
FAQ
Is Google Workspace, Microsoft 365 or Zoho Mail DPDP-compliant?
None of them is “compliant” or “non-compliant” on its own. The DPDP Act’s duties fall on your business as the Data Fiduciary. What the provider changes is how much help it gives you, through retention, search and data loss prevention tools, and where your data is stored.
Which email providers store data in India?
Microsoft 365 stores an India-provisioned account’s mailboxes, SharePoint and OneDrive files and Teams chats in India. Zoho Mail stores Indian accounts in Mumbai and Chennai. Google Workspace offers data regions in the US or Europe, not India.
Is it illegal to use Gmail for business if the data is stored outside India?
No. The DPDP Act allows personal data to be transferred abroad except to countries the government restricts. Some sector regulators, such as RBI for payment data, set stricter rules of their own, so check those if they apply to you.
Do I need a contract with my email provider under the DPDP Act?
Yes. The Act requires a valid contract with any Data Processor that handles personal data for you. Check that your agreement with the provider covers processing on your behalf, and keep a copy with your compliance records.
Do employees’ mailboxes count as personal data?
Yes. Staff emails and HR correspondence are your employees’ personal data. You can process them for employment purposes without separate consent, but you still have to keep them secure and delete what you no longer need.
Will my email provider add DPDP features?
As the DPDP Act’s 13 May 2027 deadline approaches, you can expect most large Indian platforms, and those that operate in India, to launch features in line with the Act. Keep an eye on your workspace’s privacy settings, release notes and announcements to see what has changed.
Every article is checked against the current law and the judgments it cites before it is published.
Updated 31 October 2026 · Not legal advice.
