DPDP Act 2023: Where Should an Organisation Actually Begin?
India's Digital Personal Data Protection Act, 2023 has changed the privacy conversation for organisations.
For many businesses, however, the difficult question is no longer “What is the DPDP Act?”
It is:
“What do we actually need to do?”
The temptation is to begin with a privacy policy, consent form, compliance checklist or a technology tool. These may eventually form part of the programme, but they are rarely the best starting point.
Privacy implementation should begin with understanding the organisation itself — what personal data it handles, why it needs that data, where the data moves, who has access to it and what happens to it throughout its lifecycle.
That turns DPDP implementation from a documentation exercise into an operational programme.
Start by Understanding Your Role and Responsibilities
The DPDP Act applies to the processing of digital personal data within India and, in specified circumstances, processing outside India connected with offering goods or services to Data Principals within India. The Act describes an organisation that determines the purpose and means of processing personal data as a Data Fiduciary.
That sounds straightforward, but an organisation may interact with personal data in several different contexts.
Consider employees, job applicants, customers, website visitors, vendors, business contacts and users of digital services. Different departments may collect and process their data for completely different purposes.
The first practical step is therefore not drafting a policy. It is understanding where the organisation participates in the personal-data lifecycle and what responsibilities arise from those activities.
Discover the Personal Data You Already Have
Ask a simple question:
What personal data do we actually process?
The answer is often more complicated than expected.
HR may maintain employee and candidate information. Sales teams may have customer contacts in a CRM. Marketing may maintain mailing lists. Finance may hold bank and tax information. Security systems may generate access records. Websites may collect enquiries. Applications may contain customer or user information.
And data may exist outside formal business applications — in spreadsheets, shared folders, email attachments or other working environments.
A practical data inventory helps bring these activities into view.
At this stage, organisations should identify at least the type of personal data being collected, its source, the purpose for which it is used, where it is stored, who can access it, with whom it is shared and how long it is retained.
You cannot effectively govern personal data that you do not know exists.
Map How the Data Moves
An inventory tells you what you have. Data mapping tells you what happens to it.
Take a seemingly simple activity such as recruitment.
A candidate may submit information through a recruitment portal. The information may then be reviewed by HR, forwarded to a hiring manager, stored in an HR system, shared with a background-verification provider and retained after the recruitment process.
That is one business process involving several systems, people and potentially third parties.
Mapping these flows helps identify questions that are otherwise easily missed:
Why are we collecting this information? Is all of it necessary? Who receives it? Is it transferred to another service provider? How long does each system retain it? What happens when it is no longer required?
This is where privacy starts becoming operational.
Assess the Gaps — Don't Start With a Generic Checklist
Once the organisation understands its data and processing activities, it can meaningfully assess where gaps exist.
Those gaps may involve notices, consent, handling of Data Principal requests, security safeguards, breach management, retention and erasure, processor arrangements or internal accountability.
The DPDP framework addresses areas including consent and certain legitimate uses, obligations of Data Fiduciaries, rights and duties of Data Principals, children's personal data and additional obligations that may apply to Significant Data Fiduciaries.
The notified Rules add operational detail in areas such as notices and other implementation requirements, although commencement is phased rather than every substantive requirement applying from the same date.
This distinction matters.
A useful readiness assessment should therefore answer two different questions:
What does the organisation need to prepare for under the DPDP framework?
and
Which requirements are applicable and in force at this point in the phased implementation timeline?
That is far more useful than treating privacy compliance as fifty identical boxes that every organisation must immediately tick.
Prioritise What Matters
Not every privacy gap carries the same risk or urgency.
An organisation processing large volumes of customer information through several digital platforms may have different priorities from a manufacturing business whose primary personal-data environment consists of employees, vendors, customers and business contacts.
Priorities should be influenced by factors such as the nature and volume of personal data, the purpose of processing, exposure to third parties, security risks, existing controls and the potential impact on individuals.
This produces a privacy implementation roadmap rather than an uncontrolled collection of compliance activities.
Some actions may be immediate. Others may require changes to technology, business processes, vendor arrangements or organisational responsibilities.
Turn Requirements Into Working Processes
This is where implementation really begins.
A privacy notice has little value if the organisation's actual collection practices do not match what it says.
A retention policy has little value if nobody can identify and erase information when its retention period ends.
A process for Data Principal rights has little value if requests arrive but nobody knows who should validate, investigate and respond to them.
And an incident procedure is incomplete if privacy considerations begin only after the cybersecurity team has finished handling the incident.
The objective should therefore be to translate privacy requirements into repeatable business processes.
That may involve notices and consent processes, Data Principal rights and grievance handling, retention and erasure, security and breach response, vendor and processor governance, privacy risk assessment and internal accountability.
Build Privacy Into Everyday Operations
Privacy cannot remain the responsibility of one privacy professional, consultant or legal team.
HR influences how employee information is handled. Marketing influences how customer information is collected and used. IT controls systems and access. Information security protects the environment. Procurement introduces processors and service providers.
Business teams determine why information is needed in the first place.
That makes awareness and role-based capability an important part of implementation.
Employees do not all need to become privacy experts. They do need to understand the privacy responsibilities relevant to the work they perform.
Establish Governance — Then Keep Improving
Privacy implementation does not finish when the initial documents and processes have been created.
Business processes change. New applications are introduced. Vendors change. New data is collected. AI tools enter workflows. Employees move roles. Regulatory requirements evolve.
Governance provides the mechanism for keeping privacy aligned with those changes.
That can include defined ownership, periodic reviews, incident escalation, vendor oversight, training, metrics, management reporting and reassessment of higher-risk processing.
The objective is not simply to become documentation-ready.
It is to make privacy operational and sustainable.
So, Where Should You Begin?
For an organisation beginning its DPDP journey, the sequence can be surprisingly straightforward:
Understand → Discover → Map → Assess → Prioritise → Implement → Govern → Improve
Don't begin by asking:
“Which privacy documents do we need?”
Begin by asking:
“What personal data do we process, why do we process it, where does it go, and how well are we managing it today?”
Once those answers are visible, the path towards practical DPDP implementation becomes much clearer.
Moving From DPDP Understanding to Implementation
Ace Data helps organisations understand their current privacy environment, assess readiness and translate privacy and DPDP requirements into practical processes, governance and organisational capability.
Explore: Data Privacy & DPDP Implementation → Understand: Understand Privacy & DPDP → Implement: Implement Privacy & DPDP →
