Notifications
Clear all
Topic starter
14/07/2026 4:25 pm
TL;DR: India’s DPDPA shifts privacy from policy intent to demonstrable safeguards, with Proofpoint citing 99% of Indian CISOs reporting sensitive data loss, 90% expecting a material cyberattack, and 85% of organisations experiencing data loss in the past year. The real test is whether organisations can govern personal data across email, cloud, endpoints, collaboration tools, and AI workflows, not just where data is stored.
NHIMG editorial — based on content published by Proofpoint: Navigating India’s Digital Personal Data Protection Act and its operational implications
By the numbers:
- 99% of CISOs in India reported sensitive data loss in the past year.
- 90% expect a material cyberattack in the next 12 months.
- 85% of organisations experienced data loss in the past year.
Questions worth separating out
Q: How should organisations govern personal data that moves through email, cloud apps, and AI tools?
A: They should treat personal data governance as a flow problem, not a storage problem.
Q: Why do routine work actions create so much privacy risk under DPDPA?
A: Routine actions create risk because most exposure happens during normal business behaviour, such as forwarding files, oversharing links, or pasting information into AI prompts.
Q: What do organisations get wrong about privacy controls for generative AI?
A: They often focus on model governance while ignoring the data that users supply to the tool.
Practitioner guidance
- Map personal data flows across work channels Inventory where regulated personal data is handled in email, collaboration tools, endpoints, SaaS apps, and generative AI prompts.
- Align identity controls with data handling rules Tie access permissions, sharing restrictions, and masking policies to the sensitivity of the data rather than to broad team membership.
- Treat retention and deletion as enforceable controls Define retention periods, deletion triggers, and evidence capture for personal data so privacy obligations can be demonstrated during audit or incident review.
What's in the full article
Proofpoint's full white paper covers the operational detail this post intentionally leaves for the source:
- DPDPA-oriented classification rules for personal data in common work tools and collaboration flows
- Practical guidance on how enterprise DLP and DSPM can be combined for everyday data handling
- Behavioural and insider-risk context for prioritising investigations across email, cloud, endpoints, and AI workflows
- Retention, deletion, and audit-evidence considerations for teams preparing for privacy review
👉 Read Proofpoint's white paper on DPDPA and personal data protection →
DPDPA and modern work: what it means for data governance teams?
Explore further
14/07/2026 5:07 pm
DPDPA turns personal data handling into an evidence problem, not just a policy problem. Organisations are no longer judged only on whether a rule exists, but on whether controls can be demonstrated across the actual places where data moves. That changes the governance burden for security, privacy, and identity teams, because proof now matters as much as policy. Practitioners should treat evidencing as a control requirement, not a reporting afterthought.
A question worth separating out:
Q: Who is accountable when personal data is exposed through a processor or third-party workflow?
A: Under the DPDPA model described here, the data fiduciary remains accountable for reasonable safeguards even when processing is performed by a processor on its behalf. That means ownership, evidence, and incident response cannot be delegated away, only operationalised through contracts and controls.
👉 Read our full editorial: DPDPA raises the bar for personal data governance in modern work
