Topic starter
12/07/2026 12:17 pm
TL;DR: India’s DPDP Act 2023 makes consent, purpose limitation, audit trails, SDF duties, and cross-border safeguards mandatory for organizations handling Indian citizens’ personal data, with penalties reaching 250 crores for serious violations, according to eMudhra. For identity and access teams, the practical issue is proving who accessed what, when consent changed, and whether sensitive records stayed within policy boundaries.
Editorial analysis by NHI Mgmt Group, based on content published by eMudhra: “DPDP Act 2023: A Digital Trust Compliance Guide for Enterprises”.
Key questions
Q: What breaks when consent changes are not audited for non-human identities?
A: Governance loses the ability to prove who approved scope expansion and when it happened.
Q: When do privacy teams need IAM and NHI governance in DPDP compliance?
A: They need it whenever personal data access, signing, retention or transfer is performed by employees, service accounts, automation or delegated workflows.
Q: What are the main failure points in consent-based privacy programmes?
A: Common failure points are missing withdrawal tracking, weak purpose-change handling, unlinked access logs and retention rules that outlive consent.
Practitioner guidance
- Map consent to identity events Record who captured consent, which data principal it applied to, what purpose was disclosed and when that purpose changed.
- Bind access logs to processing purpose Ensure application and data platform logs show the identity, the dataset, the purpose statement and the retention decision for each access event.
- Separate sensitive-data transfer approvals Route cross-border transfers of sensitive personal data through an approval path that records the authorising identity, destination, contractual safeguard and certificate or signing evidence.
Bottom line: DPDP Act compliance is not only a privacy obligation, it is an evidence problem that depends on identity, access and retention controls.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:31 pm
DPDP Act compliance turns evidence into the primary control objective. The article is not really about privacy policy language, it is about whether organisations can prove lawful processing after the fact. Consent logs, processing audits and access traces become the artefacts regulators will examine. For practitioners, the key shift is from policy declaration to evidentiary integrity.
A question worth separating out:
Q: Which controls matter most for proving data localisation and transfer compliance?
A: Teams need identity-bound transfer approvals, certificate or signature evidence, clear data residency mapping and logs that show which identity authorised movement. The goal is not just to block unauthorised transfers, but to demonstrate that permitted transfers were governed end to end.
👉 Read our full editorial: DPDP Act compliance raises the bar for consent and auditability