DPDP Act 2023: Why Businesses Should Start Preparing Now

DeepSec Consulting | DPDP Act & GRC Series
India’s digital economy has made personal data a core business asset. Customer registrations, employee records, support tickets, marketing databases, applications, websites, and cloud platforms all create data trails.

The Digital Personal Data Protection Act, 2023 (DPDP Act) establishes India’s framework for processing digital personal data. The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025 and provide the implementation framework.

The important point for businesses is timing. The Act and Rules use a phased commencement structure. Several major provisions are scheduled to become applicable eighteen months after the 13 November 2025 notification, while Rule 4 has a one-year commencement timeline. That means organizations have a preparation window, but not a reason to postpone the work.

A strong readiness program starts before the final deadline. The first step is understanding what personal data the organization actually handles.

Why DPDP Is a Business Issue

• Privacy is not only a legal responsibility.
• Cybersecurity controls affect the confidentiality, integrity, and availability of personal data.
• Business processes determine why information is collected and used.
• Vendors and cloud platforms determine where information travels.
• Management must decide who owns privacy risk and how it is monitored.

The Five Questions Every Business Should Ask

1. What personal data do we collect?
2. Why do we collect it?
3. Where is it stored and processed?
4. Who can access or receive it?
5. What happens when we no longer need it?

Practical Case Study: The Forgotten Customer Database

Scenario: A growing online business discovered that an old marketing database containing customer names, phone numbers, and email addresses was still stored on a former project server. Nobody had listed the server in the current asset inventory.

The immediate problem was not a sophisticated cyberattack; it was a lack of visibility.

Lesson: DPDP preparation begins with visibility. If an organization does not know where personal data exists, it cannot confidently govern, secure, retain, or delete it.

Building DPDP Readiness

Organizations should begin by identifying the personal data they handle and understanding how that data moves through their business environment.

This includes reviewing data collection, storage, access, processing, third-party sharing, retention, security controls, and incident response processes.

Starting early gives organizations time to identify gaps, assign responsibilities, strengthen controls, and build a practical approach to privacy and data governance.

DeepSec Consulting can help organizations assess DPDP readiness, identify privacy and security gaps, and build a practical GRC roadmap aligned with their business environment.