By Nilesh Bhojani, Chief Product and Technology Officer, Seclore
Most enterprises have data policies. Very few have proof that those policies are working.
That distinction is about to matter in ways it hasn’t before. When the Data Protection Board of India moved from DPDP consultation to enforcement standards earlier this year, it changed the question enterprises are being asked to answer. Not: what does your policy say? But: what actually happened to your data?
For most organisations, that is a question they cannot answer. And the gap between intent and demonstrable outcome is larger than most leadership teams realise.
The risk that isn’t being measured
There is a persistent assumption in enterprise security that risk is primarily external. Breaches. Attackers. Compromised credentials. The safeguards most organisations have built are designed around this model.
But the most material data risks today originate inside the organisation, through legitimate access.
A finance analyst pulling a sensitive report. A team sharing contracts across a vendor network. An employee using a Copilot or a ChatGPT session to summarise internal documents. None of these are malicious acts. All of them can result in sensitive data leaving its original context without a trace, without a policy applied, and without any record of where it went.
This is the blind spot that DPDP enforcement will expose. Organisations can show who accessed data. They cannot show what happened to it afterward.
With AI adoption accelerating across Indian enterprises, this gap is not shrinking. It is widening. Data is being processed, summarised, and redistributed through AI systems at a scale and speed that existing governance architectures were never designed to track. A RAG pipeline pulling from an internal document repository. An agent executing a workflow across systems. A copilot session that reads, summarises, and retains. Each of these is a data interaction that leaves no audit trail in most enterprise security tools today.
The 72-hour reality check
The DPDP Act’s breach notification requirement is typically framed as an operational challenge. It is actually a structural one.
To report a breach within 72 hours, an organisation must be able to reconstruct the lifecycle of the affected data almost immediately. Who accessed it. Where it moved. What systems touched it. What controls were in place at each step.
For most enterprises, that reconstruction takes weeks, not hours. Data flows across email, endpoints, third-party systems, cloud platforms, and AI tools without persistent tracking. The information exists in fragments across systems that were never designed to talk to each other.
This is not a people problem or a process problem. It is an architecture problem. The tools were not built to answer the question DPDP enforcement is now asking.
Why the architecture doesn’t fit the problem
Traditional enterprise security is location-based. Secure the network, protect the endpoint, control access to the application. These controls work well when data stays within defined boundaries.
Data doesn’t stay within defined boundaries anymore.
It moves across organisations, vendors, cloud environments, and AI systems in real time. Once it leaves its point of origin, most controls cease to apply. The policy says data should not be shared externally without authorisation. The system has no way to enforce or verify that once the file is downloaded, forwarded, or fed into an inference call.
DPDP enforcement is effectively testing whether enterprises have closed this gap. Most haven’t. Not because they haven’t tried, but because the tools available to them were built for a different threat model.
What readiness actually looks like
Enterprises that will navigate DPDP enforcement effectively are not the ones with the most comprehensive documentation. They are the ones that have built visibility and control at the data level, not just the system level.
That means four things working together continuously, not periodically.
First, discovery: knowing where sensitive personal data actually resides across systems, workflows, cloud platforms, and AI pipelines. Not a point-in-time scan. A continuous, current picture.
Second, contextualisation: understanding what that data means, who owns the risk associated with it, and whether the controls currently in place are appropriate for its sensitivity and its movement. A contract sitting in a shared drive accessible to two hundred employees carries different risks than the same contract held by the three people negotiating it. The governance layer needs to reflect that distinction.
Third, enforcement: controls that travel with the data. Not controls that sit at the perimeter and stop applying the moment a file is emailed, downloaded, or passed to an external system. Persistent protection that remains active regardless of where the data ends up and who is handling it.
Fourth, proof: audit-ready evidence generated as a byproduct of normal operations, not assembled after the fact. When a regulator asks what happened to a specific category of data over the past 90 days, the answer should be retrievable in minutes, not weeks.
Discover. Contextualise. Enforce. Prove. That loop needs to run continuously, not once at deployment or once before an audit.
The shift enterprises cannot defer
DPDP enforcement is not introducing a new problem. It is putting a deadline on an existing one.
For years, Indian enterprises have treated data governance as a compliance exercise: update the policy, train the team, document the framework, repeat annually. That approach was never sufficient. DPDP enforcement makes it visibly insufficient.
The organisations that manage this transition well will be the ones that move early from policy to proof. From access control to data intelligence. From security tools that tell you a system was breached, to Data Security Intelligence that tells you what data was affected, what its context was, whether protection held, and what the evidence shows.
Because when enforcement begins in earnest, the question will not be what safeguards your policy intended. It will be what your audit trail can demonstrate.
Most enterprises are not ready to answer that question today. The ones that start building toward it now will be the ones that don’t get caught unprepared when it’s asked.