Most conversations about India's Digital Personal Data Protection Act happen in legal and compliance teams. That's a mistake. The heaviest lift and the biggest risk sit squarely with IT and security. DPDPA requires organisations to prove, at any moment, that personal data is being processed securely and that breaches are detected and reported within strict timelines.
Most conversations about India's Digital Personal Data Protection Act (DPDPA) happen in legal and compliance teams. That's a mistake. The heaviest lift and the biggest risk sit squarely with IT and security.
DPDPA doesn't just ask businesses to write better privacy policies. It requires organisations to prove, at any moment, that personal data is being processed securely, that consent was properly captured, and that breaches are detected and reported within strict timelines. That's not a legal deliverable. That's an infrastructure and security operations deliverable.
Full substantive obligations become enforceable on 14 May 2027, the final of MeitY's three notified enforcement dates. The single largest financial exposure in the entire penalty schedule — up to ₹250 crore per instance — is reserved for failing to implement reasonable security safeguards under Section 8(5).
Where the Real Gaps Are
Having worked across IT infrastructure, cloud, and cybersecurity for enterprises, these are the gaps we see most often when businesses start their DPDPA readiness assessments.
No unified view of where personal data actually lives. Data is scattered across CRMs, marketing tools, legacy databases, spreadsheets, and third-party vendors. You cannot secure or govern data you haven't mapped.
Consent capture that can't be audited. A checkbox on a form isn't proof. DPDPA requires durable, time-stamped, itemised consent records — something most legacy sign-up flows, cookie banners, and IVR systems were never built to produce.
Security safeguards that don't meet the reasonable security bar. Required measures include encrypting or masking personal data, appropriate access controls, and visibility through logs and monitoring to detect unauthorised access, with obligations that extend to any data processor acting on the fiduciary's behalf.
No tested breach response protocol. DPDPA requires breach notification to the Data Protection Board and affected individuals without delay, with a detailed report due within 72 hours. If your team has never run a breach simulation, you don't actually know if you can meet that deadline.
Systems that can't talk to the Consent Manager registry. Provisions about Consent Managers take effect from 13 November 2026. Retrofitting old architecture for this is a multi-month project, not a quick patch.
Why 2026 Is the Year That Matters
The 18-month phased rollout gives organisations a defined runway to realign processes, systems, controls, and governance before enforcement becomes real. The Data Protection Board of India is already operational, and there's no indication of an extended grace period once full enforcement begins. Waiting until early 2027 to start means building critical infrastructure under deadline pressure, with far less room to test, fix, and get it right.
Where to Start
If your organisation hasn't begun its DPDPA readiness assessment, the starting point isn't a legal memo. It's a technical audit: map every system that touches personal data; assess current consent capture and storage against DPDPA's evidentiary standards; run a gap analysis against the reasonable security safeguards requirement; build and test a breach notification protocol against the 72-hour timeline; and plan Consent Manager API compatibility now, before the November 2026 milestone creates a bottleneck.
The Bottom Line
DPDPA compliance will be judged on what your systems can actually prove, not what your privacy policy says. That makes it fundamentally a cybersecurity and infrastructure challenge, and the organisations that treat it that way now will be the ones not scrambling in 2027.
CoreGenix specialises in IT infrastructure, cloud security, and cyber risk assessments — the technical backbone DPDPA compliance depends on. Get in touch to start your readiness audit.