Topic starter
10/07/2026 9:18 pm
TL;DR: India’s Digital Personal Data Protection Act sets a consent-centric privacy model with new obligations for data fiduciaries, rights handling, security safeguards, and breach notification, while also giving the Central Government wide rulemaking authority, according to OneTrust. The compliance challenge is operational, not just legal: organisations must connect data discovery, consent records, rights workflows, and cross-border controls into one governable programme.
Editorial analysis by NHI Mgmt Group, based on content published by OneTrust: “India DPDPA Compliance Guide: Requirements, Rights, Consent, and Governance”.
Key questions
Q: What breaks when consent data is inconsistent across systems?
A: Customer experiences fragment, privacy requests become harder to honour, and marketing teams lose confidence that they are acting within approved use.
Q: Why does the DPDPA make data mapping a privacy requirement?
A: Because access, correction, erasure, and transfer decisions all depend on knowing where personal data lives and how it moves.
Q: What are the signs that rights fulfilment is failing under the DPDPA?
A: Common warning signs include repeated manual lookups, inconsistent responses across business units, late erasure completions, and requests that stop at the first system while replicas, backups, or processors remain untouched.
Practitioner guidance
- Map personal data to control points Inventory where digital personal data is collected, stored, transformed, shared, and deleted so each processing step has an accountable owner and an evidence trail.
- Make consent withdrawal operational Connect consent records to processing systems so withdrawal triggers downstream suppression, processor notification, and review of any lawful basis exception.
- Orchestrate rights requests across systems Design access, correction, and erasure workflows that reach production systems, archives, analytics platforms, and third-party processors without manual rekeying.
Bottom line: The DPDPA turns consent, rights handling, transfer oversight, and breach response into linked operational controls rather than separate compliance tasks.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:40 pm
Consent governance is becoming a control-plane problem. The DPDPA does not just ask whether consent exists, it asks whether consent can be proven, withdrawn, and enforced across the processing estate. That pushes privacy teams toward event-driven governance, where consent status must change system behaviour instead of sitting in a legal archive. For practitioners, the lesson is that consent lifecycle control now belongs in operational architecture, not only in policy.
A few things that frame the scale:
- Only 37% of organisations had policies for managing AI or detecting shadow AI, according to IBM's 2025 Cost of a Data Breach Report.
A question worth separating out:
Q: How should privacy teams align DPDPA controls with identity governance?
A: They should treat identity assurance, role separation, and audit trails as prerequisites for rights handling and accountability. When employees, customers, guardians, or consent managers can act on behalf of a person, the organisation needs clear identity proofing, authorisation, and evidence of who did what.
👉 Read our full editorial: India's DPDPA raises the bar for consent, rights, and governance