In short
- The DPDP Rules, 2025 were notified in November 2025 with obligations phased to May 2027
- Every substantive privacy obligation depends on an accurate data inventory
- Ownership and classification are prerequisites, not parallel workstreams
- Retention is where privacy programmes most often stall
India's Digital Personal Data Protection Act, 2023 became operational alongside the Digital Personal Data Protection Rules, 2025, notified in November 2025. Implementation is phased: the Data Protection Board and complaint mechanisms came into effect first, consent manager registration follows, and substantive obligations on data fiduciaries — notice, consent, data principal rights and breach processes — apply from May 2027.
That runway is not generous, and the common mistake is to spend it on the visible artefacts. Privacy notices get drafted, a consent banner is procured, a rights request form is published. Then the first access request arrives and nobody can establish what data the organisation holds about that person.
Every obligation resolves to an inventory question
Work backwards from what the obligations require in operation:
- Notice at collection requires knowing every point at which personal data is collected and for what purpose
- Purpose limitation requires knowing what each dataset is used for downstream, including in analytics and testing
- Data principal rights require locating all instances of an individual's data across systems, including exports and copies
- Erasure requires knowing every copy, including backups, warehouses and non-production environments
- Breach notification requires establishing within hours which categories of data and which individuals were affected
- Retention requires knowing what you hold, why, and for how long it may legitimately be kept
None of these can be satisfied by a policy. They all require an accurate, maintained record of what data exists and where. That record is a data governance deliverable.
Establish ownership first
Data inventories built by a central privacy or IT team decay immediately, because the people who change the data landscape are not the people maintaining the record. A new integration is built, a dataset is copied to a reporting environment, and the inventory silently becomes wrong.
Assigning data owners by business domain — with a defined responsibility to keep their domain's inventory current — is what makes the record survive. It is an organisational change, not a technical one, and it is the highest-leverage step in the whole programme.
Classify in a way people can apply
Classification schemes fail by being too elaborate. Six tiers with subcategories will not be applied consistently by anyone outside the team that designed it.
Three or four tiers, each with concrete handling rules for storage, transmission, access and disposal, gets applied. Personal data should be identifiable as a category within the scheme, because privacy obligations attach to it specifically and handling rules need to reflect that.
Retention is where programmes stall
Retention requires a legal position on each data category, a technical mechanism to enforce it, and an owner willing to authorise deletion. Most organisations get the first, occasionally the second, and rarely the third — because deleting data feels risky and keeping it feels free.
Under a data protection regime, keeping it is not free. Retention beyond purpose is an obligation breach and an expanded breach exposure. Making retention decisions concrete — a documented schedule per category, an accountable owner, and an implemented mechanism — is what converts a policy into a control.
Where ISO/IEC 27701 fits
For organisations already operating an ISO/IEC 27001 management system, ISO/IEC 27701 extends it with privacy-specific controls and produces a certifiable privacy information management system. It provides useful structure — controller and processor obligations, and mappings to privacy regulation — and it reuses the risk assessment, internal audit and management review machinery you already run.
It is not a substitute for the inventory work. ISO/IEC 27701 will require the same record of processing that the regulation does. But it gives the programme a recognised structure and an external audit cycle that keeps it from quietly decaying after go-live.
