TL;DR: India’s DPDP Rules turn the DPDPA from a high-level privacy law into an operational compliance programme, according to Osano, with prescriptive notice, consent, retention, vendor and rights-handling obligations due across 2025 to 2027. The real risk is not policy wording but whether organisations can map data flows, manage consent and prove deletion on time.
At a glance
What this is: Osano breaks down how India’s DPDPA shifts from law-on-paper to operational privacy controls, with the hardest work centred on notices, consent, data mapping and deletion.
Why it matters: Privacy, IAM and governance teams need to treat consent records, data inventory and third-party disclosure as operational controls, not just legal text, because DPDPA compliance depends on provable execution.
Context
India’s DPDPA is a consent-first privacy regime, and that design choice puts operational discipline ahead of legal interpretation. The article shows that the main challenge is not understanding the law in the abstract, but translating notice, consent, retention and rights handling into systems, records and workflows that can withstand audit.
For IAM and privacy practitioners, the intersection matters where consent management, data subject requests and third-party disclosure depend on reliable identity verification, data lineage and control ownership. The article’s message is that privacy compliance now depends on governance across people, processes and systems, not on policy language alone.
Key questions
Q: What breaks when consent withdrawal is not connected to deletion workflows?
A: When withdrawal is handled only as a front-end preference change, the organisation keeps processing or retaining data that should have been suppressed. That creates direct DPDPA exposure because the obligation is to stop processing and delete, unless another law requires retention. The control failure is lifecycle linkage, not policy wording.
Q: Why does the DPDPA make data mapping a privacy requirement?
A: Because access, correction, erasure, and transfer decisions all depend on knowing where personal data lives and how it moves. Without data mapping, teams cannot reliably fulfil rights requests, stop processing where required, or prove that notices and consent terms match actual data use.
Q: What are the biggest operational mistakes organisations make with DPDPA notices?
A: The most common mistake is treating the notice as a legal template instead of a living control. If the notice does not reflect current data types, sharing partners, contact details and rights mechanisms, it becomes inaccurate the moment a process changes. Privacy, legal and security teams need one maintained source of truth.
Q: How should organisations handle consent requests submitted by authorised agents?
A: They should authenticate the requester, verify the authority of the agent and then route the request through the same rights workflow used for direct submissions. The key is to preserve evidence of who acted, on whose behalf and which records were affected, because the DPDPA makes agent handling part of the compliance process.
Technical breakdown
Why DPDPA notice requirements force stronger data mapping
The DPDPA requires itemised notices that name the specific data collected, the parties it is shared with, and the purpose for which it is used. That is a materially different operational burden from laws that allow categories-level disclosure. To comply, organisations need a current map of personal data types, processing purposes, recipients and retention points, otherwise the notice cannot stay accurate as systems change.
Practical implication: Build and maintain a living data map that links collection points, sharing paths and retention rules to each privacy notice entry.
Consent withdrawal turns retention into an automation problem
Under the DPDPA, withdrawal of consent is not just a stop-processing event. Unless another Indian law requires retention, the organisation must also delete the data, which means consent status must be tied directly to downstream storage and processing systems. Manual fulfilment will fail at scale because the obligation is triggered by a rights event, not by a periodic cleanup cycle.
Practical implication: Connect consent state changes to deletion workflows so withdrawal automatically propagates to systems that store or process the affected data.
The consent manager model separates legal fiduciary duties from tooling
The article distinguishes between a standard consent management platform and a registered consent manager, which is a regulated legal entity with broader duties and immutable record-keeping. That distinction matters because most businesses will not become consent managers, but they still remain responsible for their own consent logs, rights handling and compliance evidence. The tool does not absorb the legal duty.
Practical implication: Treat CMPs as evidence and workflow systems, not as substitutes for fiduciary accountability or records management.
Threat narrative
Attacker objective: The practical objective is regulatory and operational failure through poor privacy governance, not technical intrusion.
- Entry occurs when an organisation lacks reliable visibility into where personal data is collected, shared and retained across websites, apps and processors.
- Escalation happens when stale notices, incomplete vendor records or weak consent linkage prevent the business from honouring withdrawal and deletion obligations consistently.
- Impact emerges as non-compliance, exposed business relationships and penalty exposure when the organisation cannot prove lawful processing or timely rights fulfilment.
Breaches seen in the wild
- iOS apps leaking hard-coded secrets: Cybernews found 71% of 156,080 iOS apps leak hard-coded secrets, with open cloud storage and Firebase databases exposing user data.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
DPDPA compliance is fundamentally a data governance problem, not a notice-writing exercise. The article makes clear that itemised disclosure, purpose limitation and deletion obligations depend on accurate data mapping. Without a current view of what data is collected, where it flows and who receives it, privacy teams will produce policies that are legally elegant but operationally false. The practitioner conclusion is straightforward: privacy governance now lives or dies on control accuracy.
Consent management is becoming an identity-adjacent control surface. The right to withdraw consent, the use of authorised agents and the requirement to authenticate requesters all create a governance intersection with identity verification and access workflows. That means privacy operations cannot sit apart from IAM, because the organisation needs to know who is exercising a right, on whose behalf and against which records. The practitioner conclusion is that privacy rights handling must be tied to identity assurance and request traceability.
Registered consent manager: the concept matters because it separates regulated fiduciary activity from ordinary consent tooling. The article sharpens a useful distinction: a CMP helps a company manage its own consent lifecycle, while a registered consent manager is itself a regulated entity with record-keeping duties. That distinction will shape procurement, architecture and accountability decisions. The practitioner conclusion is to avoid confusing software capability with legal status.
The DPDPA raises the cost of unknown data relationships. The requirement to disclose specific third parties and shared data types means weak vendor inventory is now a compliance risk, not just a procurement gap. Privacy, security and legal teams will need the same authoritative third-party records to answer rights requests and public notice obligations. The practitioner conclusion is to treat third-party mapping as a shared control across privacy and security.
Purpose limitation will expose organisations that rely on broad internal reuse of personal data. The article shows that DPDPA is closer to a consent-bound operating model than a flexible processing model. That creates pressure on product, analytics and marketing teams that have historically repurposed data after collection. The practitioner conclusion is to review downstream reuse paths before the compliance deadline hardens into an enforcement issue.
What this signals
DPDPA compliance will separate organisations with current data lineage from those relying on static policy documents. The article makes the operational gap plain: itemised notice, consent withdrawal and deletion all depend on knowing where personal data actually lives. Privacy teams that cannot trace collection and sharing paths will struggle to meet the law’s precision requirements.
Consent and rights handling now overlap with identity assurance. When authorised agents can act for children or people with disabilities, request workflows need authenticated identity, delegation proof and auditable fulfilment. That is a governance problem for privacy programmes and an integration problem for IAM teams, especially where support channels and self-service portals are involved.
For practitioners
- Map personal data to collection and sharing points Create a living inventory that records what data is collected, where it is stored, which teams touch it and which third parties receive it. Use that inventory to keep notices accurate and to identify where purpose limitation will block reuse.
- Automate consent withdrawal into deletion workflows Link consent status to downstream storage, analytics and support systems so a withdrawal request triggers suppression and deletion where retention is not legally required. Build exception handling for legal hold and mandatory retention cases.
- Separate CMP ownership from fiduciary accountability Document which controls belong to the company, which belong to the platform and which remain legal duties of the data fiduciary. Preserve auditable logs for consent, rights handling and complaint resolution even when a third-party tool manages the workflow.
- Review third-party disclosures before updating notices Validate the list of processors and other fiduciaries that receive personal data, then confirm the purposes and data categories disclosed to individuals. Treat undisclosed sharing relationships as a blocking issue for final notice approval.
Key takeaways
- DPDPA compliance is shifting from policy interpretation to operational control over data mapping, consent and deletion.
- The law’s itemised notice and withdrawal rules create a stronger governance burden than many teams are used to handling.
- Organisations that cannot prove accurate data lineage and rights execution will face both compliance risk and operational friction.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack surface, NIST SP 800-63, NIST CSF 2.0 and CIS Controls v8 set the technical controls, and GDPR defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| GDPR | Art.5 — Principles Relating to Processing of Personal Data | DPDPA notice, purpose limitation and deletion obligations closely mirror data processing principles. |
| Recommendation — Use Art.5 as a benchmark for purpose limitation, minimisation and retention discipline. | ||
| NIST SP 800-63 | SP 800-63A — Enrollment and Identity Proofing | Authenticated rights requests and authorised agents depend on proofing and requester validation. |
| Recommendation — Apply identity proofing controls before honouring sensitive data subject requests. | ||
| NIST CSF 2.0 | ID.AM-01 — Physical Devices and Systems Are Inventoried | DPDPA compliance depends on knowing where personal data is collected, stored and shared. |
| Recommendation — Inventory data systems and processing paths so notices and retention rules stay current. | ||
| CIS Controls v8 | CIS-5 — Account Management | Rights handling and delegated requests depend on accountable, traceable user and agent handling. |
| Recommendation — Enforce accountable workflow ownership for consent and subject-rights processing. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Deletion after consent withdrawal is a lifecycle-offboarding problem for personal data records. |
| Recommendation — Automate offboarding of personal data when retention is no longer legally required. | ||
Key terms
- Data Fiduciary: The organisation or person that decides why and how personal data is processed under the DPDPA. The concept is central because it carries accountability for lawful purpose, consent, rights handling, security safeguards, and downstream governance across processors and partners.
- Consent Management: The process of showing a user what an agent is allowed to do, for how long, and against which systems. In MCP environments, consent is not just a legal formality. It is a control that limits delegated access and creates accountability for agent actions.
- Purpose limitation: The rule that data should be used only for the specific business purpose allowed by policy and context. In AI environments, this means a dataset may be technically accessible but still inappropriate for a given model, assistant, or agent if the use case exceeds the approved scope.
- Data Subject Rights: Data subject rights are the legal rights individuals have over their personal data, such as access, correction, restriction, or deletion-related requests. Organisations need validated workflows, identity checks, and audit evidence so those rights can be fulfilled consistently across systems.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps practitioners connect identity controls to wider governance, risk and compliance responsibilities.
Published by the NHIMG editorial team on October 16, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org