Topic starter
06/09/2026 3:45 pm
TL;DR: India’s DPDP Act turns privacy into an enforceable operating requirement, with Data Fiduciaries expected to prove how personal data is collected, shared, retained, and secured across live systems, according to LEVO. Static policies and periodic audits are no longer enough when breach exposure, third-party flows, and AI-driven processing can all create liability.
Editorial analysis by NHI Mgmt Group, based on content published by LEVO: “DPDP Act Compliance Checklist 2026: Step by Step Requirements for Indian Enterprises”.
By the numbers:
- The Data Protection Board can impose penalties that go up to INR 250 crore for certain classes of non-compliance.
Key questions
Q: What breaks when personal data governance is only documented in policies?
A: Policies do not prove how personal data moved through live systems, who accessed it, or whether delegated processors stayed within scope.
Q: Why does DPDP create higher risk for APIs and third-party workflows?
A: Because those paths often move personal data outside the primary application where ownership is clearer.
Q: How can organisations tell whether data protection is actually working?
A: Look for fewer high-risk access paths, better alignment between privilege and task, and cleaner separation between normal business use and bulk or administrative movement.
Practitioner guidance
- Map personal data to runtime identities Identify which human users, service accounts, processors, and automation paths can touch regulated personal data in production, then reconcile that map against actual access and data movement.
- Instrument breach-grade logging for personal data flows Make sure access logs, API logs, and data-flow telemetry can reconstruct who accessed personal data, where it moved, and what changed before a notification decision is needed.
- Tie third-party access to current purpose and retention Review vendor and processor access so delegated rights, retention windows, and offboarding actions match the data being handled, not the contract language alone.
Bottom line: DPDP makes personal data governance an operational proof problem, not just a privacy policy problem.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/09/2026 3:45 pm
Runtime data governance is now an identity problem as much as a privacy problem. DPDP does not merely ask whether organisations wrote a policy about personal data, it asks whether they can prove who accessed it, through which systems, and for what purpose. That means access governance, data-flow visibility, and processor oversight now sit on the same enforcement path. The practitioner conclusion is that privacy controls must be operationalised through live identity and data evidence.
A question worth separating out:
Q: Who is accountable when third parties process personal data under the DPDP Act?
A: The Data Fiduciary remains accountable even when processors or other third parties handle the data on its behalf. That means the organisation must set security requirements, define breach notification duties, and ensure contracts reflect compliance responsibilities. Accountability cannot be outsourced, because the fiduciary still determines why and how the data is processed.
👉 Read our full editorial: India's DPDP Act makes runtime data governance an audit issue