India’s Digital Personal Data Protection Act (DPDPA) changes what “consent” and “data handling” mean for any business processing personal data of individuals in India — and the operational work to get ready is more involved than it sounds from the headlines.
The instinct is to start with a privacy policy.
Data inventory and flow mapping across all systems, including vendor and sub-processor…
If you’ve already built a GDPR programme — common for companies serving EU customers…
The instinct is to start with a privacy policy. The more useful starting point is a data map: what personal data you actually collect, where it lives, who inside (and outside) the organization can access it, how long you keep it, and which third parties it flows to. Without that map, every other DPDPA requirement — consent design, purpose limitation, breach notification — is being built on a guess rather than a fact.
If you’ve already built a GDPR programme — common for companies serving EU customers — a meaningful share of that work (data mapping, DPIAs, breach procedures) transfers directly. The DPDPA isn’t identical to GDPR, but the operational muscle of inventorying data and designing consent properly is the same muscle.
Many organizations find it easier to run DPDPA compliance as an extension of an existing ISMS, using ISO 27701’s Privacy Information Management System (PIMS) structure to organize the data mapping, risk assessment and control evidence DPDPA readiness requires, rather than building a separate, parallel privacy programme from scratch.
DPDPA applies broadly to processing of digital personal data within India, and to processing outside India where it relates to offering goods or services to individuals in India. Scope for your specific operations should be confirmed with counsel.
Not for every processing activity, but it’s expected for higher-risk processing — large-scale data use, data involving children, or activities that could significantly affect individuals. Building a DPIA process in now, even a lightweight one, avoids scrambling later.
They share a similar underlying logic (lawful basis for processing, individual rights, breach notification) but differ in specifics — consent mechanics, the role of “Consent Managers,” and penalty structure. Treat DPDPA as its own framework rather than assuming GDPR compliance automatically covers it.