Topic starter
24/10/2026 8:50 pm
TL;DR: DPDP Rules make data mapping, consent handling and deletion the centre of DPDPA compliance, Osano reports, not just the wording of privacy notices. Privacy workflows now need accurate lineage, linked rights handling and proof of deletion to avoid friction and exposure.
Editorial analysis by NHI Mgmt Group, based on content published by Osano: “DPDPA Rules: How India’s Privacy Law Will Be Put into Practice”.
Key questions
Q: Why does the DPDPA make data mapping a privacy requirement?
A: Because access, correction, erasure, and transfer decisions all depend on knowing where personal data lives and how it moves.
Q: What are the biggest operational mistakes organisations make with DPDPA notices?
A: The most common mistake is treating the notice as a legal template instead of a living control.
Q: What breaks when consent withdrawal is not connected to deletion workflows?
A: When withdrawal is handled only as a front-end preference change, the organisation keeps processing or retaining data that should have been suppressed.
Practitioner guidance
- Map personal data to collection and sharing points Create a living inventory that records what data is collected, where it is stored, which teams touch it and which third parties receive it.
- Automate consent withdrawal into deletion workflows Link consent status to downstream storage, analytics and support systems so a withdrawal request triggers suppression and deletion where retention is not legally required.
- Separate CMP ownership from fiduciary accountability Document which controls belong to the company, which belong to the platform and which remain legal duties of the data fiduciary.
Bottom line: DPDPA compliance is shifting from policy interpretation to operational control over data mapping, consent and deletion.
Glossary terms: Data Fiduciary, Consent Management, Purpose limitation, Data Subject Rights
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
25/10/2026 11:11 am
DPDPA compliance is fundamentally a data governance problem, not a notice-writing exercise. The article makes clear that itemised disclosure, purpose limitation and deletion obligations depend on accurate data mapping. Without a current view of what data is collected, where it flows and who receives it, privacy teams will produce policies that are legally elegant but operationally false. The practitioner conclusion is straightforward: privacy governance now lives or dies on control accuracy.
A question worth separating out:
Q: How should organisations handle consent requests submitted by authorised agents?
A: They should authenticate the requester, verify the authority of the agent and then route the request through the same rights workflow used for direct submissions. The key is to preserve evidence of who acted, on whose behalf and which records were affected, because the DPDPA makes agent handling part of the compliance process.
👉 Read our full editorial: DPDPA compliance now hinges on data mapping and consent operations
This post was modified 7 days ago by NHI Mgmt Group