Notifications
Clear all
Topic starter
06/09/2026 3:45 pm
TL;DR: GDPR-oriented privacy programs often fail in India because the Digital Personal Data Protection Act is built around continuous consent enforcement and runtime data handling, not documentation alone, according to LEVO. The gap is structural: privacy teams must move from rights workflows and policy artifacts to system-level controls that prove personal data stays constrained as it flows.
NHIMG editorial — based on content published by LEVO: GDPR compliance is not DPDP readiness
Questions worth separating out
Q: Why do GDPR-compliant privacy programmes fail under DPDP rules?
A: They often rely on documentation, rights workflows, and legal justification, but DPDP expects consent and purpose limits to be enforced inside live systems.
Q: When should organisations prioritise runtime privacy controls over governance documentation?
A: They should prioritise runtime controls as soon as personal data moves through APIs, distributed services, or automated workflows.
Q: What are the signs that consent enforcement is failing in production?
A: Common signs include data being reused after consent withdrawal, services processing data without a current purpose code, and deletion requests not removing data from downstream systems.
Practitioner guidance
- Instrument consent propagation across systems Make consent state machine-readable and carry it through APIs, queues, and downstream services so processing rules remain attached to the data lifecycle.
- Verify purpose limitation at runtime Check that each processing step has a valid purpose code before data is shared, transformed, or retained beyond the original consent boundary.
- Replace documentation-only evidence with system telemetry Use logs, policy decisions, and data-flow monitoring to prove how personal data was actually handled, not just how it was described in records of processing.
What's in the full article
LEVO's full article covers the operational detail this post intentionally leaves for the source:
- A deeper breakdown of how GDPR-era privacy programmes map poorly to DPDP enforcement expectations in practice.
- Specific examples of runtime consent enforcement, retention handling, and data-flow control across distributed systems.
- The article’s longer comparison of rights workflows versus execution controls for privacy compliance.
- Implementation context for teams translating legal obligations into system behaviour, monitoring, and evidence.
👉 Read LEVO's analysis of why GDPR compliance does not equal DPDP readiness →
DPDP vs GDPR: where privacy controls fail at runtime?
Explore further
06/09/2026 3:45 pm
GDPR-first privacy programmes create a runtime enforcement gap. The article’s central governance point is that documentation-heavy privacy models do not reliably control live data processing in consent-centric regimes. That gap matters because modern architectures move personal data across services faster than policy artefacts can track. For privacy, IAM, and data governance teams, the operational question is whether enforcement follows the data or only the paperwork.
A question worth separating out:
Q: What is the difference between rights workflows and runtime privacy controls?
A: Rights workflows handle requests after processing has already happened, such as access or deletion. Runtime privacy controls prevent or constrain processing in the first place by attaching consent, purpose, and retention rules to system behaviour. Both are useful, but only runtime controls can stop misuse during live processing.
👉 Read our full editorial: GDPR compliance is not enough for DPDP readiness in India
