By Mohd Kaif Idrisi, Internal Audit Associate, Eventus Security
The real test of DPDP compliance won’t be whether an organisation has a privacy policy on paper. It will be a test of whether its people, processes and security controls work when personal data is accessed, shared, altered, lost or exposed. As companies prepare to comply with the Digital Personal Data Protection Rules, 2025, the key question is whether their security controls can truly protect personal data in case of a breach.
The DPDP Rules have been framed by the Ministry of Electronics and Information Technology (MeitY) in November 2025. The law will be implemented in phases. The main compliance deadline for a range of provisions is May 2027. However, for CISOs and compliance leaders, waiting until the relevant deadlines to start implementation could leave organisations with a lot of work to do in a tight timeframe. The challenge is that DPDP compliance cannot be viewed as a privacy issue nor a legal checklist. The compliance requirements go much deeper into the security infrastructure of an organisation, ranging from identity and access management through encryption, monitoring and incident response, and continuing with vulnerability management and third-party risk assessment.
A less obvious challenge is that data sharing does not always involve an obviously compromised account. What if an employee has a legitimate need to access customer information, but that account suddenly downloads an unusually large amount of personal data, accesses it from an unusual location, or transfers it to an unauthorized external destination? Credentials may be valid, but the behavior may still show risk.
This is DPDP preparedness comes into the picture. Organisations should know not only who has been granted access to personal data, but whether this access is being used appropriately. Logging, monitoring and periodic access reviews should be in place to complement role based access, least privilege, privilege-access controls, multi-factor authentication and appropriate controls over Data Processors.
There may be another challenge of a simpler sort: Companies should know what personal data they have, where it is stored, why it is processed, who has access to it, what Data Processors are processing it, how long it is retained, what controls are in place to protect it and how it is finally deleted. The first stage of DPDP preparation is an initial data discovery and mapping process, identification of processors, assessment of existing controls, identification of high-risk processing operations and attribution of accountability to the program.
The Rules are divided into phases. First provisions come into force in November 2025. Provisions of Rule 4, primarily related to consent managers, will enter into force in November 2026. Provisions of Rules 3, 5-16, 22, 23 will enter into force in May 2027.
In theory, an 18-month period sounds pretty comfortable. But in practice, organisations may need to be working on different elements of data mapping at the same time. This includes privacy notices, consent processing, technical controls, vendor assessment, contracts, retention and deletion, incident handling, staff education and training. “So it’s not just one compliance requirement, it’s the orchestration of change across processes, systems, vendors and teams. In the end, it is an incident that tests an organisation’s privacy and security framework. Security departments will have to determine what happened, why it happened, what systems were impacted and if any personal data was impacted in any way by the incident.
The DPDP Rules stipulate that the Data Fiduciaries shall promptly notify the affected Data Principal(s) and shall provide certain information to the Board through the prescribed channels. The process includes identification, investigation, risk assessment, damage mitigation, recovery and notification.
The financial risks associated with the transition are important. The DPDP Act provides for penalties of up to ₹250 crore for failure to take reasonable security safeguards to prevent personal data breaches, and up to ₹200 crore for failure to notify the Board and affected Data Principals of a personal data breach.
The abovementioned penalties are maximum legal ones and do not imply automatic fines for any failure of compliance, but they emphasize a clear message: security must not be treated as an afterthought.
The best DPDP programs will not only work on the question, “Do we have the framework in place?” They will confront a more challenging one: “Can we demonstrate that our controls are implemented and operating effectively when required?” By May 2027, the goal should not be to start becoming compliant. It should be to arrive with security controls already implemented, tested and operational.