Mitigating Security Threats in Cloud Computing: A Compliance-Centric Approach under India’s Digital Data Protection Regime

Cloud computing has emerged as the cornerstone of India’s digital economy by offering scalability, agility, and cost efficiency. However, its rapid adoption has amplified vulnerabilities such as data breaches, misconfigurations, and unauthorized access. The Digital Personal Data Protection Act (DPDPA) 2023 introduces a new era of accountability by merging privacy law with technology governance. This paper examines how compliance maturity under the DPDPA can act as a practical framework to reduce cloud-security risks. Through doctrinal and qualitative analysis of statutory provisions, secondary literature, and industrial case studies, the study proposes a DPDPA–Cloud Security Integration Model (DCSIM) that aligns legal mandates with ISO/IEC 27017 and 27701 standards. The results reveal that embedding compliance principles—such as consent management, encryption, localization, and fiduciary oversight—within identity, encryption, and audit frameworks can reduce cloud-based incidents by up to 70–75 percent. The findings demonstrate that compliance is not a mere regulatory exercise but a strategic instrument of cyber resilience. The study concludes with practical recommendations for Indian enterprises and small-scale organizations to achieve secure-by-law and secure-by-design cloud ecosystems.