The real test of DPDP compliance will not be whether an organization has a privacy policy on paper. It will be whether its people, processes and security controls work when personal data is accessed, shared, altered, lost or exposed. As businesses take steps to comply with the Digital Personal Data Protection Rules, 2025, one important question that comes to the fore is whether their security controls are actually capable of safeguarding personal data when a personal data breach occurs.
The DPDP Rules were laid down in November 2025 by the Ministry of Electronics and Information Technology (MeitY) and the law will come into effect in phases. Important compliance deadlines for various provisions fall in May 2027. However, for CISOs and compliance leaders, waiting until the applicable deadlines to begin implementation could leave organizations with significant work compressed into a short period. The difficulty lies in the fact that DPDP compliance cannot be treated as either a privacy issue or a legal checklist. Compliance requirements go much deeper into the security infrastructure of an organisation starting from identity and access management through encryption, monitoring and incident response, and continuing with vulnerability management and third-party risk assessment.
A less apparent challenge is that data sharing doesn’t always start with what appears to be an exploited account. However, what if an employee may have legitimate access to customer information? But what happens if that account suddenly downloads an unusually large volume of personal data, accesses it from an unusual location, or transfers it to an unauthorized external destination? The credentials may be valid, but the behaviour may still indicate risk. The credentials may be perfectly fine, although such actions are suspicious. It is here that the DPDP preparedness comes into the picture, thus making it clear that organizations should understand not only who is authorized to access personal data, but also whether that access is being used appropriately. Role-based access, least privilege, privileged-access controls, multi-factor authentication and appropriate controls over Data Processors should operate alongside logging, monitoring and periodic access reviews.
Another challenge may also be of a simpler nature: Companies should know what personal data they hold, where it resides, why it is being processed, who has access to it, which Data Processors handle it, how long it is retained, what controls protect it, and how it is ultimately deleted. It is essential to consider initial data discovery and mapping process, identifying processors, evaluating present controls, identifying high-risk processing operations, and assigning accountability to the program as part of the first stage of preparing for DPDP.
The Rules are structured on a phased basis. The first provisions entered into force in November 2025. Provisions of Rule 4, primarily related to consent managers, will enter into force in November 2026. Provisions of Rules 3, 5-16, 22, 23 will enter into force in May 2027.
While an 18-month period looks quite comfortable in theory, in practice organizations may have to work on various elements of data mapping simultaneously, including privacy notices, consent processing, technical controls, vendor assessment, contracts, retention and deletion, incident handling, staff education, and training. Therefore, the challenge is not a single compliance requirement; it is the coordinated change required across processes, systems, vendors and teams. An organization’s privacy and security framework is ultimately tested when an incident occurs. Security departments will need to identify what took place and why, which systems were affected, and whether any personal data suffered any consequences of the incident.
According to the DPDP Rules, Data Fiduciaries must inform affected Data Principals without delay and share specific information with the Board through the established procedures. This process entails identifying, examining, assessing the consequences, limiting damages, recovering and issuing notices.
The financial risks associated with the transition are important. The DPDP Act provides for penalties of up to ₹250 crore for failure to take reasonable security safeguards to prevent personal data breaches, and up to ₹200 crore for failure to notify the Board and affected Data Principals of a personal data breach. The abovementioned penalties are maximum legal ones and do not imply automatic fines for any failure of compliance, but they emphasize a clear message: security must not be treated as an afterthought.
The best DPDP programs will not only work on the question, "Do we have the framework in place?” They will confront a more challenging one: "Can we demonstrate that our controls are implemented and operating effectively when required?" By May 2027, the goal should not be to start becoming compliant. It should be to arrive with security controls already implemented, tested and operational.
