From data hoarding to data accountability: The DPDP reset for Indian businesses

By Yuvraj Shidhaye, Founder and Director, TreadBinary

For a long time, Indian organisations have collected data with the idea that having more is safer than having less. Customer records, logs, archives, and backups kept getting added, often without a clear plan for how they would be used later. That thinking is now being questioned. Research suggests that about 55% of organisational data globally is dark data, information that sits unused despite being stored and managed. This is not just a storage issue. It increases the risk of exposure, adds to operational load, and makes it harder to pick out what actually matters. The Digital Personal Data Protection Rules, introduced in 2025, aim to end this practice. They link data collection to a defined purpose, place limits on how long it can be kept, and give individuals the right to access, correct, or erase their information. Data now comes with responsibility at every step.

Every Data Point Now Needs a Reason to Exist
The first change shows up at the point of collection, where DPDP requirements are the hardest to ignore. Organisations now have to clearly state the purpose before taking any personal data, and consent must match that purpose. This has led to visible changes in how data is requested. Extra fields that once sat on forms as a precaution are being removed, and teams are reviewing whether each input is actually needed for a defined business or legal function.

This is not just a matter of trimming forms. It is forcing a rethink of how data is used across workflows. If information cannot be linked to a stated purpose, it cannot be retained or repurposed later without fresh consent. That constraint is changing internal decision-making, especially in functions like marketing, customer onboarding, and analytics where data was often collected more broadly. As a result, new data entering systems is more tightly aligned to specific use cases, which in turn puts pressure on organisations to examine whether their existing datasets meet the same standard.

Legacy Data Is Being Revisited With a Clear Lens
The Rules make it clear that personal data has to be erased once the purpose it was collected for is served, unless there is a legal reason to keep it. That has forced organisations to revisit years of stored records and confront a difficult question. Why is this still here, and can its continued use be justified? Any further use of such data now needs a clear basis, which was often missing earlier.

That review is exposing gaps that were easy to overlook. Data sits across teams, appears in multiple tools, and in many cases carries no record of why it was collected in the first place. To avoid repeating this, businesses are putting effort into mapping where personal data exists and how it moves within the organisation. Nearly 48% of organisations have already initiated gap assessments. It is detailed work, but it brings much needed order. Many are using ERP systems to bring these datasets into a more connected setup, where information can be tracked, classified, and managed with consistency. That level of clarity becomes essential as individuals have been given complete control of their personal data.

Data Handling Now Has to Stand Up to Scrutiny
The Act gives individuals the right to know what data is held about them, get it corrected if something is wrong, or ask for it to be erased. The real challenge begins when these requests start coming in. It is one thing to acknowledge the right, and quite another to act on it without delays or confusion. If the information is scattered or incomplete, even a simple request can take longer than it should.

This is where the way data is handled day to day starts to matter. Consent needs to be saved in a way that it can be easily found. Data should sit in a place where teams know how to access it without going back and forth. In some cases, organisations may be classified as significant data fiduciaries, which brings added responsibilities like appointing a data protection officer and going through audits. These are not just formal requirements. They shape how teams work with data on a regular basis. When someone reaches out with a request, the response should feel straightforward, backed by clear and complete records.

Conclusion
As DPDP requirements start to show up in day to day operations, the focus will move from getting compliant to staying consistent. That is where many organisations are likely to feel the pressure, especially when handling repeated requests, managing timelines, and keeping records aligned across teams.

This is where ERP systems bring clarity. When data sits within a connected setup, it becomes easier to apply the same rules across functions without constant follow ups or manual fixes. It brings a level of consistency that is difficult to achieve otherwise. Over time, this ability to stay aligned with requirements without disrupting daily work will make a visible difference in how organisations manage data at scale.