Topic starter
10/07/2026 9:07 pm
TL;DR: India’s DPDPA looks familiar to GDPR teams, but its consent-centred operating model changes lawful processing, notice design, breach response, and vendor accountability, according to OneTrust. Privacy programmes that treat DPDPA as a simple GDPR extension will miss the operational redesign it requires.
Editorial analysis by NHI Mgmt Group, based on content published by OneTrust: “Why GDPR Readiness Does Not Automatically Prepare Organizations for India’s DPDPA”.
Key questions
Q: Where does GDPR-style privacy governance fail under DPDPA?
A: It fails where organisations assume lawful-processing flexibility, notice structure, and breach handling can be copied across jurisdictions.
Q: Why does DPDPA create more operational risk than GDPR for many teams?
A: Because many GDPR programmes rely on multiple lawful bases and broad processor patterns, while DPDPA makes consent and defined legitimate uses central to more processing decisions.
Q: What do privacy teams get wrong about DPDPA consent management?
A: They often treat consent as a form field instead of a governed workflow.
Practitioner guidance
- Review lawful-basis mappings for India Reassess each personal-data processing activity that currently relies on GDPR lawful bases and determine whether it needs explicit consent or a narrowly defined legitimate use under DPDPA.
- Rebuild consent propagation paths Trace how consent is captured, stored, withdrawn, and enforced across websites, apps, customer systems, and vendor-supported workflows so revocation actually stops downstream processing.
- Localise breach and grievance workflows Align escalation, evidence preservation, notice routing, and complaint handling to India-specific obligations instead of assuming a global GDPR incident template will be sufficient.
Bottom line: DPDPA is not a simple regional variant of GDPR because its consent-centred model changes how lawful processing works in practice.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:30 pm
DPDPA readiness is an operating-model problem, not a documentation problem. Organisations that assume GDPR maturity transfers cleanly to India miss the fact that DPDPA reorganises how lawful processing works across the lifecycle. Consent, notice, withdrawal, and enforcement are tied more tightly together, which means the quality of the workflow matters as much as the wording of the policy. The practical conclusion is that privacy programmes need control design, not just legal mapping.
A few things that frame the scale:
- 54% of organisations are actively deploying AI agents across workflows, yet only 21% report a mature governance model for agentic AI.
A question worth separating out:
Q: Who is accountable when DPDPA compliance fails across vendors and processors?
A: The data fiduciary remains the primary accountability point, even when processors and service providers are involved. That means vendor oversight, contract language, audit rights, and escalation paths must be designed around fiduciary responsibility rather than assuming processor obligations carry the same weight as under GDPR. Accountability needs to be operational, not just contractual.
👉 Read our full editorial: Why GDPR readiness does not equal DPDPA readiness