By Sachin Salian, SVP & Global Business Head – Cloud and Data Services, Writer Information
For the past two years, DPDP readiness in India was largely treated as a documentation exercise.
Enterprises published privacy notices, rewrote consent language, appointed data protection Officers and assured their boards that compliance programmes were progressing well. Those were necessary first steps. Yet they leave unanswered the question that regulators, auditors and customers will ultimately ask: when an individual withdraws consent, requests access to their data or seeks its deletion, can the organisation prove that every system handling that information acted accordingly within the required timeframe?
That question marks the transition from policy to operations. With the Digital Personal Data Protection (DPDP) Rules, 2025 now notified, the Data Protection Board operational and a phased compliance window closing in May 2027, that transition is no longer theoretical. Organisations are discovering that compliance will not be judged by the quality of their documentation alone. It will be measured by whether policies are consistently executed across business processes, applications and third-party ecosystems. The conversation in boardrooms has therefore shifted from asking, “Do we have a privacy policy?” to asking, “Can we demonstrate that our policy is enforced across every operational layer?”
Many organisations continue to view consent as the centerpiece of compliance. In reality, consent is only the starting point. A compliant consent lifecycle begins with collecting permission for a clearly defined purpose, allowing individuals to review what they have agreed to, providing an equally simple mechanism to withdraw that consent and maintaining evidence of every version, timestamp and policy applicable at that moment. Cookie consent, preference management and communication permissions add another layer of complexity, requiring controls that operate in real time rather than after the fact.
However, collecting consent is significantly easier than enforcing it.
The real operational challenge begins after a consent record is created. That information must travel beyond the customer-facing interface into every downstream system that processes personal data.
Marketing platforms, CRM applications, analytics engines, customer support tools and external service providers must all reference the same consent status before using an individual’s information. If these systems continue processing data based on outdated permissions or disconnected records, the organisation faces a compliance risk regardless of how sophisticated its consent collection interface appears.
This is why operational enforcement has become the defining capability of DPDP readiness. A policy that exists only at the point of collection provides limited protection if every subsequent business process cannot consistently honour it.
Beyond consent, enterprises must develop a broader set of operational capabilities that work together as an integrated compliance framework.
Customer notifications should be automated, traceable and verifiable rather than simply dispatched. Consent confirmations, withdrawal acknowledgements, expiry reminders and privacy communications should be delivered through the channels customers actively use while maintaining evidence of successful delivery. Grievance management must similarly evolve beyond a conventional support ticketing system into a structured workflow with defined ownership, service levels and auditable resolution timelines.
Governance is equally critical. Changes to consent language, retention policies or privacy configurations should follow documented approval workflows with clearly assigned ownership. Role-based administration ensures that only authorised individuals can modify sensitive privacy settings while maintaining accountability for every change made within the system.
Access management represents another area where enterprises often underestimate operational complexity. Broad administrative privileges that were acceptable in traditional IT environments are increasingly incompatible with privacy-first operating models. Organisations require granular, need-based access controls supported by detailed audit trails showing who accessed specific records, when they did so and for what purpose.
Audit logging itself has become a strategic capability rather than a technical feature. During an investigation or regulatory review, organisations may need to reconstruct the complete consent status of a specific individual months or even years after the original interaction occurred. This requires historical versioning, immutable records and the ability to recreate past states rather than merely displaying current information.
Retention and disposal policies complete another critical element of compliance. Data cannot simply remain within enterprise systems indefinitely because deleting it introduces operational challenges.
Different industries operate under different regulatory obligations regarding record retention, making configurable retention schedules essential. Equally important is the ability to demonstrate that data has actually been deleted once retention requirements have expired rather than assuming that deletion has occurred.
Fortunately, enterprises are not starting from zero.
Years of investment in cybersecurity, information governance and enterprise risk management have already created a foundation that organisations can leverage. Encryption, access controls, incident response frameworks and retention policies already exist across many enterprises. The remaining challenge lies in connecting these capabilities into a unified privacy operating model where consent governs data usage throughout its lifecycle and every action can be evidenced when required.
Compliance obligations do not stop at an organisation’s own boundaries either. Under the DPDP framework a data fiduciary remains accountable for personal data even when the processing is outsourced. Business process partners, outsourcing providers and technology vendors that handle personal data on an enterprise’s behalf must honour the same consent status and produce the same audit trails because their lapses become the fiduciary’s liability. Extending consent enforcement and evidence requirements across this processor chain, through contracts, assessments and technical integration, is part of the operational task rather than a separate one.
Perhaps the most underestimated challenge lies in historical data. Organisations have accumulated years of customer information through legacy applications, paper records, call centres, websites and multiple generations of digital platforms. Reconciling these fragmented consent histories into a single, current and evidence-backed record often proves more difficult than implementing controls for future interactions.
Ultimately, DPDP compliance should not be viewed as a collection of independent projects. Consent management, governance, auditability, access controls, retention, notifications and grievance handling derive their value from operating as connected capabilities rather than isolated initiatives. Enterprises that invest in this integrated operational foundation will be better positioned not only to satisfy regulatory scrutiny but also to build greater trust with customers and business partners.
As enforcement approaches, the distinction between organisations that merely document compliance and those that operationalize it will become increasingly visible. In the long run, the strongest privacy programmes will not be defined by the policies they publish but by the operational capabilities they can evidence on demand.