DPDP Act: Why Data Protection Is Now a Boardroom Topic
For years, data protection was a task we handed to the IT department. With India's Digital Personal Data Protection regime now phasing in, it belongs on the board agenda. Customer trust, legal exposure and business continuity all depend on how an organisation treats the personal data it holds.
The dates to know
Commentary on the DPDP Rules, notified on 13 November 2025, describes a phased rollout, with a consent-manager framework around 13 November 2026 and wider obligations from about 13 May 2027. Please verify the dates with MeitY before you plan your programme.
What the technical team should start with
- Create a data map: the systems, fields, flows and vendors that touch personal data.
- Add consent capture with purpose, timestamp and version, and a simple way to withdraw it.
- Apply role-based access, logging and encryption in transit and at rest.
- Set retention and deletion jobs for data you no longer need.
- Prepare a breach detection and response runbook with named owners.
- Review third-party SDKs, analytics tools and cloud regions.
The gaps we see most often
- Personal data sitting in spreadsheets and chat tools.
- Old backups with no deletion plan.
- Marketing lists without proof of consent.
The board's role
Directors do not need to read code. They need a named owner, a budget, a timeline and a report every quarter. A company that can answer 'where is our customers' data and who can see it?' in one sentence is ahead of most.
The Chairman's takeaway
Start with the data map. You cannot protect what you cannot find. Small, steady steps now are far cheaper than a rushed project before the deadline.
Frequently asked questions
Does the DPDP Act apply to small businesses?
Obligations depend on whether you process digital personal data and in what role. Check the Act and Rules or take legal advice; some classes of data fiduciary may have different duties.
Is a spreadsheet of customer phone numbers personal data?
Yes, if the numbers can identify individuals. Treat such lists with the same care as any customer database.
Sources
This article is general information and a leadership perspective. It is not legal, financial, tax or investment advice. Please consult a qualified professional for your situation. Facts and figures are taken from the public sources listed above and may change.
Ashok Godara
Founder, Chairman & Managing Director, ATTPL HOLDCO / ATTPL GROUP, Jaipur, Rajasthan, India.
More from Ashok Godara
Digital Public Infrastructure and Rural India: Where Founders Should Build
How India's digital public infrastructure — Aadhaar, UPI, DigiLocker, ONDC and more — opens opportunities for founders to build services for rural India.
Read the articleAI Adoption for Indian Enterprises: A Practical Checklist for 2026
After India's AI Impact Summit in February 2026, how should a mid-size enterprise start with AI? Use cases, data, skills and governance, by Ashok Godara.
Read the article