DPDP Act compliance: why identity is the new perimeter

TL;DR: Arcon argues that Indian enterprises cannot meet the DPDP Act with perimeter security, checkbox privacy controls, or static administrative access, because privileged identities are now the main attack surface and breach fines can reach ₹250 Crore. The real shift is from fragmented compliance tasks to governed identity controls that limit access, prove accountability, and reduce blast radius.

Editorial analysis by NHI Mgmt Group, based on content published by Arcon: “Identity is the New Perimeter: A Strategic Blueprint to Navigate India’s DPDP Act”.

Key questions

Q: How should organisations implement identity-based controls for DPDP Act compliance?

A: Start by treating identity as the enforcement point for access to personal data.

Q: When does standing administrative access create the biggest DPDP risk?

A: Risk peaks when admin or root access persists beyond the task that justified it.

Q: What breaks when teams treat privacy compliance as a checkbox exercise?

A: Checkbox compliance misses the operational controls that actually limit exposure.

Practitioner guidance

• Replace perimeter-first trust assumptions Map which DPDP-relevant data paths still depend on network location, then move access decisions to identity, session, and privilege controls instead of relying on the corporate boundary.
• Eliminate standing administrative access Inventory all persistent admin and root accounts, then convert them to time-bound elevation for tasks that genuinely require elevated rights.
• Make privileged activity provable Anchor every administrative session to a single identity and keep immutable logs that allow auditors to reconstruct who accessed sensitive systems, when, and why.

Bottom line: The article’s core argument is that DPDP compliance fails when organisations keep relying on perimeter security and checkbox privacy controls instead of identity governance.

What's in the full article

Arcon's full article covers the operational detail this post intentionally leaves for the source:

• The full DPDP-oriented access blueprint with the article’s step-by-step governance framing
• The explicit discussion of statutory fine exposure up to ₹250 Crore under the Act
• The detailed breakdown of RBAC, JIT privilege, audit logging, and contextual MFA as a combined control model
• The article’s operational argument for reducing help desk friction through automated access layers

👉 Read Arcon's blueprint for identity-led DPDP Act compliance →

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →