Before You Map the Data, Map the Decisions: Ground Zero in DPDP Implementation
A business can know exactly where its personal data rests in the systems and still be unable to defend why it holds it. That is the exposure the DPDP framework creates, and no inventory closes it.
Every piece of personal data in a business is the result of a decision. Someone chose what data to collect, why it was needed, where it would be used and how long it would be kept. Over time, those decisions become embedded in products, systems and vendor relationships. Some remain purposeful. Others become hard to trace once a purpose expands, a vendor is added or a process is carried forward because it has always worked that way.
DPDP implementation brings those decisions back into focus. Where the data is stored is no longer the primary question. The question is whether the company can explain why the data is processed, on what basis that processing is permissible, who is accountable if the reason is wrong, and what evidence shows the business continues to operate on that basis.
A data mapping inventory is essential, but it shows only what data a business holds and where it moves. It cannot decide whether the business should hold it, establish the lawful basis for doing so, or assign accountability. Nor can it show, on demand, that the business continues to operate on that lawful basis. Those are three separate decisions, the lawful basis, the accountability and the evidence, and in most organisations none of them has an owner.
The first task in DPDP implementation, therefore, is not to map the data. It is to map the decisions behind the data.
That is the real ground zero.
The timeline issued for initiation of DPDP compliance makes mapping these decisions in order before mapping data more critical. The substantive obligations under the DPDP Rules, 2025 take effect together, 18 months after notification, covering notice, consent, Data Principal rights, security safeguards, breach reporting, retention and children’s data. The challenge is therefore not simply the volume of work. It is getting the order right.
Five challenges, three decisions
Organisations building their DPDP framework meet five obstacles: no data inventory or flow map, no governance structure, consent and notices that fall short of the Act, no operational workflows for Data Principal rights and incident response, and no retention schedule or deletion mechanism. They look like five workstreams. They are symptoms of three undecided questions: on what lawful basis data is processed, who holds accountability, and what evidence shows the organisation continues to operate on that basis.
The missing inventory, the non-compliant consent and notices, and the absent retention schedule are failures of basis. The inventory belongs here because a basis attaches to a purpose, and an inventory that does not record purposes cannot carry one. The missing governance structure is a failure of accountability. The absent Data Principal rights and incident workflows are failures of evidence. Each obstacle is overcome by taking the decision it depends on.
Decision One: Settle the Lawful Basis
Every processing activity rests on a decision about why the data is needed, and the DPDP Act requires that decision to be defensible. The lawful basis is the legal ground that permits the processing of the personal data. Every activity must rest on consent or fall within the “certain legitimate uses“ as per the Section 7 of the Act. It provides no general legitimate interest ground.
A single system serves several purposes, and a single purpose runs across several systems. A basis attaches to the purpose, not the database, so the inventory has to be organised around purposes: what is collected, where it sits, who touches it and on what basis it is held.
Consent counts only if it was validly obtained. A consent bundled with other terms, buried in a long notice or difficult to withdraw does not meet that standard, and processing that relies on it has no lawful basis. Legacy data sharpens the problem. For consents obtained before the Act, under Section 5(2) old consents cannot be assumed to hold. Each one is checked against the Act’s standard. If falls short meeting the standards, fresh notice to Data Principals must be given as soon as reasonably practicable and processing is allowed to continue until they withdraw.
A lawful basis also has a lifespan. The justification for holding data lasts only as long as the purpose it serves, and Section 8(7) requires erasure once that purpose is complete, unless a law demands otherwise. Retention is therefore a decision made for each category of data, tied to its purpose and enforced by deletion that happens by design.
These are legal positions, not administrative tasks. Together they settle the data inventory, the consent architecture and the retention schedule.
Decision Two: Make Accountability Operational
A defensible processing position needs clear ownership. The Act places the responsibility on the Data Fiduciary, while Section 8 extends that responsibility to processors acting on its behalf. The accountability therefore remains with the business, even when processing is distributed across systems, functions and third party vendors. For that reason, accountability becomes a business-wide responsibility.
The Data Protection Officer, where one is appointed, can establish the framework, but product, technology, procurement and other functions make the decisions that determine how data is collected, used, shared and retained. Governance therefore takes the form of a small cross-functional group drawing on legal, IT and HR, led by a named executive sponsor with management backing and the authority to change processes. Only the executive team can confer that authority, which makes this the one decision the privacy function cannot take alone.
The same ownership extends to processors. Contracts reflect the lawful basis and conditions of processing, and the group knows who can access the data and which third parties receive it. That closes the governance gap.
Decision Two: Make Accountability Operational
A defensible processing position needs clear ownership. The Act places the responsibility on the Data Fiduciary, while Section 8 extends that responsibility to processors acting on its behalf. The accountability therefore remains with the business, even when processing is distributed across systems, functions and third party vendors. For that reason, accountability becomes a business-wide responsibility.
The Data Protection Officer, where one is appointed, can establish the framework, but product, technology, procurement and other functions make the decisions that determine how data is collected, used, shared and retained. Governance therefore takes the form of a small cross-functional group drawing on legal, IT and HR, led by a named executive sponsor with management backing and the authority to change processes. Only the executive team can confer that authority, which makes this the one decision the privacy function cannot take alone.
The same ownership extends to processors. Contracts reflect the lawful basis and conditions of processing, and the group knows who can access the data and which third parties receive it. That closes the governance gap.
Decision Three: Make DPDP Compliance Demonstrable
Section 6(10) of the DPDP Act requires the Data Fiduciary to demonstrate that consent was obtained in accordance with the notice given to the Data Principal. Evidence is therefore part of the compliance framework itself, and a position is only as defensible as the records behind it.
Evidence matters most in two places: when a Data Principal exercises its rights, and when a breach occurs. A Data Principal can ask to access their data, correct it, have it erased or raise a grievance. Each request needs an owner, a deadline and a record of how it was handled. That record is the organisation’s evidence that it responded.
A data breach leaves far less time. Rule 7 allows 72 hours for a detailed report to the Data Protection Board (DPB), so roles, escalation and reporting have to be fixed before an incident occurs. A breach also brings the organisation’s security safeguards under scrutiny, and failing to maintain reasonable safeguards carries a penalty of up to ₹250 crore.
Evidence is designed around the DPB’s likely questions. Can consent records be retrieved by individual and purpose? Can affected Data Principals be identified within hours? Has the breach process been rehearsed rather than merely documented? A documented process establishes intent; a tested process proves it works.
Evidence has to keep pace with the business. When a purpose changes or a vendor is added, the records change with it. That is how an organisation shows it still operates on its lawful basis today, and not only that it once did. It is also how the gap left by missing rights and incident workflows gets closed.
Where DPDP Implementation Really Begins
Ground zero is rarely a blank slate. Organisations already have systems, contracts, policies, teams and established ways of handling personal data. The challenge is bringing these pieces into alignment with the requirements of the DPDP framework, and the sequence of that alignment matters.
Basis comes first, because it determines which notice, consent and retention obligations apply. Accountability follows, because an owner can be named only for a purpose whose basis is settled. Evidence comes last, because it can be built only on a settled basis and a named owner. The workstreams can run side by side. The decisions cannot. An error in basis carries into every step that follows. The test of the sequence is one question, asked purpose by purpose: can the organisation state the basis, name the person answerable and produce the proof?
Sequence is only half the task. The framework must also hold once the programme ends, keeping pace with how the business actually operates: when a new product is launched, a vendor is onboarded, a purpose changes or an incident occurs. Each of these events reopens a decision. The basis is confirmed again, the owner is identified, the proof is produced. DPDP readiness ultimately rests on whether compliance can function as part of the operating model, rather than as a parallel exercise maintained by the privacy function.
That is the shift from preparing for DPDP to being ready for it.
This article states the position under the DPDP Act, 2023 and the DPDP Rules, 2025 as notified on 13 November 2025.
