Topic starter
24/10/2026 8:50 pm
TL;DR: India’s DPDP Rules turn the DPDPA from a high-level privacy law into an operational compliance programme, according to Osano, with prescriptive notice, consent, retention, vendor and rights-handling obligations due across 2025 to 2027. The real risk is not policy wording but whether organisations can map data flows, manage consent and prove deletion on time.
Editorial analysis by NHI Mgmt Group, based on content published by Osano: “DPDPA Rules: How India’s Privacy Law Will Be Put into Practice”.
Key questions
Q: What breaks when consent withdrawal is not connected to deletion workflows?
A: When withdrawal is handled only as a front-end preference change, the organisation keeps processing or retaining data that should have been suppressed.
Q: Why does the DPDPA make data mapping a privacy requirement?
A: Because access, correction, erasure, and transfer decisions all depend on knowing where personal data lives and how it moves.
Q: What are the biggest operational mistakes organisations make with DPDPA notices?
A: The most common mistake is treating the notice as a legal template instead of a living control.
Practitioner guidance
- Map personal data to collection and sharing points Create a living inventory that records what data is collected, where it is stored, which teams touch it and which third parties receive it.
- Automate consent withdrawal into deletion workflows Link consent status to downstream storage, analytics and support systems so a withdrawal request triggers suppression and deletion where retention is not legally required.
- Separate CMP ownership from fiduciary accountability Document which controls belong to the company, which belong to the platform and which remain legal duties of the data fiduciary.
Bottom line: DPDPA compliance is shifting from policy interpretation to operational control over data mapping, consent and deletion.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →