Suggested excerpt: DPDP implementation should not begin with a checklist or privacy policy. It should begin by understanding the personal data an organisation processes, where it moves and how it is managed.