DPDP Act Readiness: What Indian Businesses Should Do Now

Sudharshan B·November 13, 2026

DPDP Act Readiness: What Indian Businesses Should Do Now

I. THE COMPLIANCE ILLUSION

An organization, a Healthcare Insurer, is preparing for its first Digital Personal Data Protection (DPDP) Act readiness assessment. Its privacy policy is published, employees are trained, and IT confirms that essential security tools and configurations are in place. Management therefore believes compliance is largely under control.

Then comes a simple question: Can the organization demonstrate where customer personal data resides, who accesses it, why it is retained, and whether it can be deleted, including upon consent withdrawal? What about personal data held in laptop hard drives, documents, emails and collaboration platforms (unstructured data)?

Suddenly, confidence fades. DPDP readiness depends on accountability and effective privacy controls across the entire personal data lifecycle. Policies and certificates alone do not demonstrate it.

II. WHY IT MATTERS NOW

"The Regulatory Clock Is Ticking"

India’s Digital Personal Data Protection (DPDP) Rules, 2025, notified on November 13, 2025, introduce a phased compliance roadmap extending to May 2027.

Key milestones:

November 13, 2025: Establishment of the Data Protection Board and commencement of foundational provisions, including security obligations.

November 13, 2026: Operationalization of Consent Managers and additional requirements, including appointment of India-based Data Protection Officers (DPOs) and independent data auditors by Significant Data Fiduciaries (SDFs).

May 13, 2027: Implementation of obligations covering notices, consent, data principal rights, grievance redressal, retention, erasure and breach reporting.

CERT-In handled 2,944,248 cybersecurity incidents during 2025. The figure shows the scale of potential exposure, although not every incident involved a personal data breach.

Accountability rests with the Data Fiduciary. DPDP readiness is therefore a priority for governance, customer trust and operational resilience.

III. WHAT MOST TEAMS GET WRONG

"Compliance Without Operational Control"

A recurring weakness in privacy readiness programs is the assumption that existing information security controls automatically establish DPDP compliance. Another misconception is treating compliance as a one-time exercise, which overlooks changes in business operations, technology and regulatory requirements.

Consider a mid-sized healthcare insurer with outsourced application support, cloud-hosted patient records and multiple service providers. Despite ISO 27001-aligned policies and security controls, an assessment may reveal patient information exported into spreadsheets, former employees retaining application access, inadequate vendor agreements, confidential data shared through personal email accounts and uncontrolled transfers to Third-Party Administrators (TPAs) for claims processing.

The gap in cases like this is often the absence of end-to-end personal data governance covering identification, access, sharing, storage, retention and secure destruction, even where cybersecurity controls are adequate.

Similar gaps exist across sectors: financial institutions struggle with data flows across service providers; healthcare organizations have patient records scattered across applications and emails; manufacturers maintain disconnected employee and biometric records; retailers lack consistent consent and withdrawal mechanisms; and IT service providers face accountability challenges across cloud platforms and subcontractors.

An even bigger blind spot is unstructured data. Personal information, including Aadhaar and PAN details, ABHA IDs, KYC records, financial records and employee information, may reside in emails, spreadsheets, PDFs, scanned documents, SharePoint, OneDrive, shared drives and employee devices, often without consistent ownership, classification, access or retention controls.

Traditional database-centric assessments cannot provide complete organization-wide visibility of data at rest, in transit and in use. Finally, assigning DPDP implementation exclusively to Legal or IT overlooks its enterprise-wide nature.

Organizations cannot demonstrate effective privacy governance if they understand their databases but cannot account for personal data circulating across their unstructured information landscape.

IV. WHAT TO DO INSTEAD

"A Practical DPDP Readiness Roadmap"

Indian businesses should adopt a risk-based, evidence-driven approach that integrates privacy into existing governance, cybersecurity and business processes. Compliance should be continuously monitored to address evolving statutory, regulatory and contractual obligations.

Step 1: Establish Privacy Program Ownership and Assess Readiness

Appoint an accountable program owner and establish a cross-functional working group involving Legal, IT, Information Security, HR, Marketing, Procurement and business operations.

Assess applicable DPDP Act and Rules requirements, identify relevant exemptions and distinguish obligations already in force from those scheduled for future commencement.

Maintain a gap register identifying control owners, remediation priorities, target dates and evidence requirements. Evaluate whether additional obligations applicable to Significant Data Fiduciaries (SDFs) are relevant.

Step 2: Discover and Map Structured and Unstructured Personal Data

Identify where personal data enters the organization, how it is processed, where it resides, who accesses it and which external parties receive it. Consider all three states of data: at rest, in transit and in use.

Develop a personal data inventory covering:

Categories of personal data and Data Principals.
Processing purposes and applicable grounds for processing.
Applications, databases, file servers and cloud repositories.
Data Processors, third-party sharing and cross-border transfers.
Retention periods, deletion requirements and accountable owners.

Extend discovery beyond structured applications to emails, spreadsheets, PDFs, scanned records, collaboration platforms, shared drives and employee devices. Use automated discovery and classification tools to identify personal information, including government identifiers, financial records and health records.

Step 3: Operationalize Privacy Rights and Consent Management

Review privacy notices and establish mechanisms for obtaining, recording and managing consent wherever applicable.
Implement documented workflows to acknowledge, authenticate, track and fulfill consent withdrawals, correction, erasure and grievance requests within prescribed timelines. Ensure withdrawal instructions are communicated to relevant business functions and Data Processors, and that processing based on the withdrawn consent stops.
Introduce suppression mechanisms to prevent such personal data from being reused, shared or inadvertently reintroduced into downstream systems. Address children’s personal data through applicable verifiable parental consent requirements and exemptions.

Step 4: Strengthen Security and Third-Party Governance

Integrate privacy requirements into existing ISMS, cybersecurity and vendor management practices.
Prioritize identity and access governance, encryption, DLP, audit logging, secure data sharing and deletion.
Review Data Processor agreements for security obligations, breach escalation, cooperation, retention and deletion requirements.
Conduct breach-response simulations involving relevant stakeholders.

Step 5: Govern Retention, Backups, AI and Information Movement

Establish retention and disposal rules across structured and unstructured repositories. Implement encrypted, access-controlled and regularly tested backups, with defined retention, recovery and secure disposal procedures.
Ensure deleted or consent-withdrawn data is not inadvertently restored into active processing. Reapply deletion and suppression controls after recovery, subject to applicable retention obligations and exceptions.
Restrict unauthorized uploading of personal data to public generative AI platforms and establish approval and monitoring mechanisms for AI-based processing.

Step 6: Establish Continuous Assurance

Translate privacy obligations into measurable controls, assign ownership and maintain an evidence repository. Integrate privacy reviews into procurement, application changes, employee onboarding, vendor assessments and internal audits.
Use GRC platforms where practical. Smaller organizations can begin with controlled registers and documented manual workflows.

The objective is to ensure that privacy obligations, including statutory, regulatory and contractual ones, are consistently implemented, monitored and demonstrable throughout the personal data lifecycle, without adding complexity that slows the business down.

V. HOW TO TELL IT’S WORKING

"Measure Operational Readiness"

Measure a DPDP program through operational evidence. The number of approved policies says little about actual readiness. No statutory thresholds are prescribed for the indicators below, so organizations should set realistic, measurable internal management targets.

1. Personal Data Inventory and Discovery Coverage

Structured Data: Target 90 to 95% coverage of identified in-scope applications, databases and processing activities, with documented purpose, ownership, access and retention requirements.
Unstructured Data: Target 80 to 90% discovery coverage of identified repositories, including emails, documents, shared drives and employee devices, supported by risk-based sampling across departments and job families.

2. Privacy Request SLA Compliance

Target 95 to 100%. Measure the share of valid privacy requests, including consent withdrawals, completed within applicable statutory or approved internal timelines.
Also monitor unresolved high-risk findings, overdue remediation, excessive access privileges, backup recovery effectiveness and breach-response exercise outcomes.

VI. FROM COMPLIANCE TO CONFIDENCE

DPDP readiness comes down to knowing what personal data your organization holds, why it holds it, who controls it and whether it can demonstrate responsible processing, wherever that data resides, whether in a database, document, email or cloud repository.

Saint Fox can help organizations assess DPDP readiness, identify privacy and unstructured data governance gaps, and develop a practical implementation roadmap.

Start with a DPDP readiness assessment before a regulatory deadline or a personal data breach exposes the gaps. One incident is enough to expose weaknesses in security controls, especially where personal data is involved.