DPDP: Seven Questions Every Business Must Answer About Personal Data

India’s data protection framework demands more than privacy policies. It challenges businesses to account for personal data, respect people’s choices and demonstrate that they have met their responsibilities.

A customer asks a company to stop sending promotional messages. The request is recorded, but the messages continue. The CRM has registered the change; another system has not. Nobody intended to ignore the customer. The business simply cannot make one decision stick across all the systems involved.

This small failure reveals a bigger challenge facing Indian businesses as they prepare for the Digital Personal Data Protection (DPDP) framework. Collecting data has become easy. Managing it responsibly across departments, applications and external providers is considerably harder.

The DPDP Act, 2023, and the Rules notified in November 2025 put this challenge firmly on the business agenda. The question is no longer simply whether an organisation has a privacy policy. It is whether its operations can deliver on the commitments that policy makes.

Seven questions reveal where the real work begins.

1. Do you know where your customers’ data actually lives?

Personal data rarely stays in one place. Marketing holds prospect details, HR maintains employee records, customer service stores interaction histories, and vendors handle information on the organisation’s behalf. Spreadsheets often fill the gaps between formal systems.

As businesses grow, their records can fall out of step with reality. No single team may have a complete view of the information the organisation holds.

Before businesses can manage personal data effectively, they need to know what they hold, why they process it, where it resides and who has access. Data discovery must be an ongoing management discipline, not an inventory exercise undertaken before an audit.

2. Can one customer decision change what every relevant system does?

Consider the customer who withdraws consent. Her choice is recorded, but the instruction fails to reach every system involved in sending communications. The business has captured the decision without making it effective.

Where consent is the applicable legal basis, businesses must be able to manage it in practice, including responding appropriately to withdrawal. The DPDP framework also recognises specified legitimate uses and other circumstances in which consent is not the basis for processing.

The same discipline applies to requests concerning personal data and grievances. Businesses need clear ownership, coordinated action and a way to establish that requests have been handled.

3. If a vendor handles your data, can you still answer for it?

A payroll provider, cloud service or customer engagement partner may process personal data on a business’s behalf. Each relationship introduces another organisation, another set of systems and another potential gap in visibility.

Under the DPDP framework, the Data Fiduciary has defined responsibilities, while a Data Processor handles personal data on its behalf. Contracts matter, but businesses must also know which providers handle information, how responsibilities are divided and how providers will support requests or incident investigations.

Outsourcing a service should not leave a business unable to establish what happened to the data entrusted to it.

4. Six months later, can you prove what happened?

Imagine being asked to demonstrate how a customer’s consent was obtained and handled. The organisation searches emails, spreadsheets and application records. The information exists, but the sequence of events remains unclear.

Keeping records is not the same as maintaining reliable evidence. Businesses need to connect relevant actions to their context and retrieve records when required. Depending on the activity, these may include the applicable notice, the choice recorded, timestamps and subsequent actions.

Technology can help create a consistent evidence trail and protect record integrity. The objective is simple: answer questions confidently without reconstructing the past from scattered files.

5. Will your data protection practices hold up when something goes wrong?

A customer raises a request. A vendor reports an incident. A team needs to establish what happened to a particular record. These are the moments when an organisation discovers whether its processes work in practice or exist mainly on paper.

Businesses need to know who must act, how different teams will coordinate and how they will establish that the issue has been addressed. The objective is not simply to have a response plan, but to be able to put it into action when it matters.

6. Can you close the gaps before the deadline?

Policies can be drafted in weeks. Coordinating changes across systems, departments and providers can take considerably longer.

With the DPDP Rules providing for phased commencement, businesses should verify the deadlines applicable to their obligations and assess their readiness early. Start by identifying the gaps, assigning clear owners and prioritising the work. Smaller businesses do not need unnecessary complexity, but they do need a practical plan. The earlier they begin, the more time they have to address problems before those problems become urgent.

7. Could better data protection make yours a better-run business?

Disconnected systems, duplicated records and unclear responsibilities create work that businesses can ill afford. They complicate customer service, slow responses and make it harder to establish what happened when something goes wrong.

Improving data management can help businesses reduce these gaps, clarify ownership and make information easier to account for. Compliance alone does not guarantee customer trust, but consistently responsible data handling gives businesses a stronger foundation on which to earn it.

How Tata Tele Business Services Supports MSMEs

Tata Tele Business Services supports India’s MSMEs with technology solutions that help them connect, collaborate and strengthen their digital capabilities. As a technology partner, TTBS can help businesses explore technology-led approaches to responsible data management.