1. Register your company outside of India. The US is an excellent option because of the solid legal framework.
2. Encrypt the data. Ask for access from your customers, even for your own support teams.
3. Use international companies for services whenever possible.
It would be great to have a regular process to delete old data if you don’t need it for business purposes, and this is hard to do because you could develop an innovative way to add customer value using the old data you don’t know of today.