India's DPDP Framework: From Privacy Policy to Operational Readiness

Data Protection Is Becoming an Operational Question

For many organisations, privacy has traditionally been visible through documents.

A privacy policy appears on the website.

Consent language is added to a form.

Employment documentation contains a data-protection clause.

Vendor contracts include confidentiality provisions.

These elements matter.

But India's Digital Personal Data Protection framework brings a broader organisational question into focus:

Does the way the organisation actually handles personal data match what its policies and notices say?

The Digital Personal Data Protection Act, 2023 established India's central framework for processing digital personal data. The subsequent notification of the Digital Personal Data Protection Rules, 2025 provides much of the implementation detail required to operationalise that framework.

Importantly, implementation is phased.

The final Rules were notified in November 2025. Rules 1, 2 and 17 to 21 came into force on publication. Rule 4 has a one-year commencement period, while Rules 3, 5 to 16, 22 and 23 come into force eighteen months after publication.

The Act itself follows a corresponding phased commencement structure for many substantive provisions.

For businesses, this creates something valuable: implementation time.

The most useful way to use that time is not simply to rewrite a privacy policy.

It is to understand how personal data moves through the organisation and whether the processes surrounding it can support the emerging framework.

That is the difference between privacy documentation and privacy readiness.

Start with the Data, Not the Policy

Before an organisation can determine whether its privacy documentation is adequate, it needs to understand what personal data it actually processes.

This sounds straightforward.

In practice, personal data can be distributed across a surprisingly large number of systems and teams.

Customer information may exist in a CRM.

Prospect data may sit within marketing platforms.

Employee information may be held in HR and payroll systems.

Candidate CVs may remain in recruitment folders.

Contact information may exist in spreadsheets maintained by individual teams.

Customer-support conversations may contain personal information.

Website forms may feed data into multiple applications.

Vendors may process information on the organisation's behalf.

Backups may retain information long after it has disappeared from the primary system.

A privacy policy cannot provide meaningful governance over this environment unless the organisation first understands it.

This is why practical DPDP readiness should begin with data discovery and mapping.

The objective does not necessarily need to be a highly sophisticated technical data map.

For many organisations, a structured inventory answering a few basic questions can provide significant visibility:

-What categories of personal data do we collect?

-From whom do we collect it?

-Why do we need it?

-Where is it stored?

-Which teams use it?

-Which systems process it?

-Which external organisations receive it?

-How long do we keep it?

-What happens when it is no longer required?

Once these questions can be answered, many subsequent privacy decisions become considerably easier.

Purpose Should Be Clear Before Data Is Collected

One of the most useful disciplines in data governance is being able to explain why information is being collected.

Organisations often accumulate data because it might become useful later.

Forms acquire additional fields.

Systems retain historical records.

Marketing databases expand.

Departments create local copies of information.

Over time, the organisation can end up processing considerably more personal data than its current business requirements justify.

The DPDP framework encourages organisations to connect personal-data processing with a clear purpose.

This has practical implications.

Before introducing a new data field, organisations should be able to ask:

Why do we need this information?

What will we use it for?

Would the business objective still be achievable without collecting it?

These are not merely compliance questions.

Reducing unnecessary data can simplify systems, reduce storage requirements, improve data quality and decrease the amount of information that needs to be protected.

Good privacy governance can therefore support operational discipline as well as regulatory readiness.

Notice Is More Than a Website Privacy Page

The DPDP framework places considerable importance on the information provided to individuals in connection with consent.

The final Rules specify requirements relating to notices, including the need for information to be presented in a clear and understandable manner and to enable the individual to make an informed decision regarding the processing of personal data.

For organisations, this means thinking beyond a single generic privacy policy.

Different data interactions may require different forms of communication.

A prospective customer submitting a contact form has a different relationship with the organisation from an employee joining the business.

A candidate submitting a CV is providing information for a specific purpose.

A customer registering for a digital service may provide multiple categories of information at different stages.

A notice should help the individual understand the relevant processing rather than require them to navigate a dense legal document to determine what is happening.

This creates an important design principle:

Privacy information should appear where the data interaction occurs.

The website privacy policy can remain an important central document.

But operational transparency may also require clear notices within forms, applications, employee processes or other points where personal data is collected.

The objective is comprehension, not simply publication.

Consent Needs a Lifecycle

Consent is often treated as a moment.

A checkbox is displayed.

The user clicks it.

The system records the answer.

The process appears complete.

Operationally, however, consent can have a much longer lifecycle.

Organisations may need to understand:

-What the individual agreed to.

-When consent was provided.

-What information was presented at that time.

-Which purpose the consent covered.

-Whether consent was subsequently withdrawn.

-Which systems need to respond to that withdrawal.

This becomes particularly important when information moves between systems.

Suppose an individual withdraws consent through a customer portal, but their details remain active within a separate marketing platform.

The organisation may have provided a mechanism for withdrawal while failing to translate the individual's choice into the operational environment.

This illustrates a broader principle within privacy governance:

Rights and choices need workflows behind them.

The visible interface is only the beginning.

Individual Rights Require Internal Processes

The DPDP framework provides Data Principals with rights that include access to information about personal data, correction and erasure, grievance redressal and nomination, subject to the provisions of the Act.

From the individual's perspective, exercising a right may involve submitting a request.

From the organisation's perspective, responding may involve several teams and systems.

Consider an erasure request.

The organisation may need to determine:

Where does the individual's information exist?

Which records can be deleted?

Is any information still required for another lawful purpose?

Has the data been shared with processors?

Which systems need to be updated?

Who confirms completion?

The challenge is therefore not simply creating an email address for privacy requests.

It is designing the workflow that begins when a request arrives.

A useful readiness exercise is to simulate several common scenarios.

What happens if a customer asks what information the organisation holds about them?

What happens if an individual says their information is inaccurate?

What happens if someone asks for deletion?

What happens if they raise a grievance?

Following a request through the organisation often reveals process gaps that are difficult to identify from a policy review alone.

Security Safeguards Need to Follow the Data

Data protection and information security are closely connected, although they are not identical disciplines.

The DPDP framework requires Data Fiduciaries to protect personal data through reasonable security safeguards, with the Rules providing further detail around measures expected to protect personal data against breaches.

For organisations, this reinforces the importance of understanding where personal data exists.

Security controls cannot protect information that the organisation does not know it holds.

Practical safeguards may involve access controls, encryption or other measures, monitoring, backups, appropriate logging and processes for managing security incidents.

But governance also includes everyday operational behaviour.

Who can access employee files?

Are former employees' accounts removed promptly?

Are sensitive spreadsheets shared through appropriate channels?

Can personal information be downloaded to unmanaged devices?

Do employees know how to report a suspected incident?

Does the organisation understand which vendors hold copies of its data?

The strongest security frameworks connect technical controls with operational behaviour.

A Data Breach Requires a Process Before It Happens

Few organisations want to design their breach-response process while a breach is already occurring.

The final DPDP Rules establish requirements around notifying affected Data Principals and the Data Protection Board following a personal data breach.

This makes incident readiness an important part of DPDP preparation.

A useful breach-response framework should clarify:

How employees report a suspected incident.
Who determines whether personal data is involved.
Which internal stakeholders need to participate.
How the scope and potential impact are assessed.
How affected systems are contained or secured.
How required notifications are prepared and issued.
What evidence is retained about the incident and response.

Smaller organisations do not necessarily need a large dedicated incident-response team.

They do need clarity.

When something goes wrong, knowing who does what next can be more valuable than having an elaborate policy document that nobody knows how to activate.

Retention Is Often Where Governance Becomes Difficult

Organisations are generally much better at collecting information than deleting it.

There are understandable reasons.

Storage is inexpensive.

Historical information may appear useful.

Deleting data can feel irreversible.

Different teams may have different views about how long information should remain available.

The result can be indefinite retention by default.

DPDP readiness provides an opportunity to challenge that assumption.

Organisations should identify major categories of personal data and establish retention logic based on business requirements and applicable obligations.

This does not necessarily mean that every record needs an individual deletion date.

It means moving from:

"We keep it because we have it"

to:

"We know why we retain it and what should happen when that reason no longer applies."

Technology can help automate retention and deletion, but the underlying policy decisions still need to be made.

What needs to be retained?

For how long?

Who owns the decision?

Which systems are affected?

What happens to backups?

These questions turn retention from a storage issue into a governance issue.

Vendors Are Part of the Data Environment

Modern organisations rarely process personal data entirely within their own infrastructure.

Cloud providers, payroll platforms, CRM systems, marketing tools, recruitment platforms, analytics services and software vendors may all process information as part of delivering their services.

This means vendor governance is inseparable from data governance.

An organisation preparing for the DPDP framework should understand which vendors process personal data on its behalf and what those relationships involve.

A practical review might consider:

What personal data does the vendor receive?
Why is the data being shared?
Where is it processed?
What security controls are in place?
What happens when the contract ends?
How are incidents communicated?
Can the vendor engage additional processors?
How does the organisation ensure appropriate contractual protection?

The objective should not be to treat every supplier as equally risky.

A vendor processing basic business contact information presents a different risk profile from a provider hosting extensive employee or customer datasets.

Vendor governance should therefore be proportionate to the nature and significance of the processing.

Children’s Data Requires Particular Attention

The DPDP Act establishes additional requirements where personal data relating to children is processed.

This is particularly relevant for businesses operating digital platforms, education services, consumer applications or other services that may be used by children.

Organisations should not wait until implementation deadlines approach to determine whether they process children's data.

The first question is simply:

Could children reasonably use this service or provide information through this process?

If the answer is yes, the organisation should examine the specific requirements applicable to that processing and determine what age assurance, consent or other safeguards may be necessary.

This is another example of why privacy readiness needs to begin with understanding the business model rather than with rewriting legal documents.

Privacy Governance Needs Ownership

One of the easiest ways for a privacy programme to become ineffective is for everyone to assume somebody else owns it.

Technology assumes Legal owns privacy.

Legal assumes IT manages the data.

Marketing controls customer information.

HR manages employee data.

Procurement manages vendors.

No single function has complete visibility.

In reality, data governance is inherently cross-functional.

The organisation therefore needs clear accountability.

Who coordinates privacy governance?

Who owns specific datasets?

Who approves new processing activities?

Who reviews vendors?

Who responds to rights requests?

Who manages incidents?

Who decides retention periods?

Who monitors whether processes continue to operate as intended?

The appropriate model will depend on the organisation's size and complexity.

A smaller business may assign several responsibilities to the same individuals. A larger organisation may establish dedicated privacy teams and formal governance committees.

The structure matters less than the clarity.

SMEs Should Aim for Proportionate Readiness

Data protection can appear overwhelming when organisations assume that compliance requires building the governance infrastructure of a multinational corporation.

It does not.

A smaller organisation may begin with a relatively straightforward foundation:

Know what personal data you hold.

Understand why you hold it.

Know where it is stored and who can access it.

Provide appropriate information to individuals.

Create processes for handling their choices and requests.

Protect the data appropriately.

Know what to do if something goes wrong.

Delete information when there is no longer a reason to retain it.

Understand which vendors process data on your behalf.

These principles can then be developed into more sophisticated controls as the organisation grows or as particular regulatory requirements demand.

The objective should be governance that works in practice.

A simple process that employees understand and follow is more valuable than an elaborate framework that exists only on paper.

Use the Implementation Window as a Design Window

The phased commencement of India's DPDP framework should not be interpreted simply as additional time before compliance becomes necessary.

It is an opportunity to design the operating model properly.

Organisations can use this period to map personal data, review notices, examine consent mechanisms, establish rights workflows, review security safeguards, rationalise retention practices and strengthen vendor governance.

They can also integrate privacy into future technology and process decisions.

When a new application is purchased, privacy can be considered during procurement.

When a new customer journey is designed, data collection can be reviewed before launch.

When a new employee system is introduced, retention and access controls can be considered during implementation.

This is significantly easier than attempting to retrofit governance after systems and processes have become deeply embedded.

The most effective privacy programmes therefore move privacy closer to the point where business decisions are made.

From Privacy Compliance to Data Governance

There is a broader opportunity within the DPDP framework.

Personal data is not only a regulatory responsibility.

It is an organisational asset.

Businesses depend on reliable customer information, employee records, operational data and digital systems to function.

Poor data governance creates problems beyond privacy.

Duplicate information affects accuracy.

Excessive access increases security exposure.

Unclear ownership slows decision-making.

Indefinite retention increases complexity.

Uncontrolled vendor relationships reduce visibility.

Seen from this perspective, DPDP readiness can support a broader improvement in how organisations manage information.

The regulatory requirement creates the catalyst.

Better data governance can become the longer-term organisational benefit.

Key Takeaways

India's DPDP framework is being implemented through phased commencement rather than a single compliance date.
The implementation period gives organisations an opportunity to build practical data governance before major operational provisions take effect.
DPDP readiness should begin with understanding what personal data the organisation processes and why.
Privacy notices should reflect actual data interactions rather than relying solely on a generic website privacy policy.
Consent requires operational processes for recording and responding to individual choices.
Data Principal rights need internal workflows behind the visible request mechanism.
Security safeguards depend on knowing where personal data exists and who can access it.
Breach response should be designed before an incident occurs.
Retention requires deliberate decisions about why information is kept and when it should be removed.
Vendors form part of the organisation's data environment and should be governed proportionately.
Effective privacy governance requires clear ownership across business functions.
For SMEs, practical and proportionate governance is more valuable than unnecessary complexity.

Conclusion

India's DPDP framework creates an important moment for organisations.

The legislation and final Rules establish the regulatory direction.

The phased implementation period provides time to translate that direction into business practice.

The organisations that use this period effectively will do more than update privacy policies.

They will understand where personal data exists.

They will know why it is collected.

They will create clearer processes for consent and individual rights.

They will strengthen security and incident readiness.

They will make deliberate decisions about retention.

They will understand the vendors that form part of their data environment.

And they will establish clearer ownership for how personal information is governed across the business.

None of this requires privacy to become an obstacle to digital growth.

In fact, the opposite is possible.

When organisations understand their data environment, they can make better decisions about technology, reduce unnecessary information, strengthen security and build greater confidence in the digital services they provide.

The implementation window should therefore be viewed as more than time to prepare for a regulatory deadline.

It is an opportunity to build better data governance.

The goal is not simply to have a compliant privacy policy.

It is to create an organisation that understands its personal data well enough to manage it responsibly throughout its lifecycle.

That is what operational readiness looks like.

References & Further Reading

About ACEVO

ACEVO helps organisations translate regulatory and digital complexity into practical governance structures.

Our work spans compliance readiness, data and technology governance, workforce governance and digital solutions, with an emphasis on building processes that work within real operating environments.

As India's data protection framework moves into implementation, ACEVO supports organisations in approaching readiness as more than a documentation exercise — connecting regulatory requirements with data visibility, process design, technology, accountability and proportionate governance.

The objective is practical: helping organisations build the structures needed to manage data responsibly while continuing to innovate and grow.