The Digital Personal Data Protection Act received assent in August 2023, and the draft rules published in January 2025 gave organisations their first concrete picture of implementation timelines. For most Indian companies the legal review has already happened. The engineering work usually has not, and that is where compliance either becomes real or stays a document.
The gap is straightforward. A privacy policy can promise that data is deleted when no longer needed. Delivering on that promise requires knowing where every copy lives, including the analytics warehouse, the nightly backup, the CRM the sales team connected without telling anyone, and the CSV a manager exported last quarter.
The Obligations That Become Code
Four provisions in particular translate directly into system requirements rather than policy text.
- Consent that is specific, informed and withdrawable. Consent has to be recorded per purpose, with the notice version shown, the timestamp and the channel. Withdrawal must be as easy as giving it, and must actually stop the downstream processing. That means consent state is queried at processing time, not copied into a flag once at signup.
- Purpose limitation. Data collected for order fulfilment cannot quietly feed a marketing model. Enforcing this means tagging data with its collection purpose and checking that tag where it is consumed, which is a schema and access-layer change.
- Erasure on request. A data principal can ask for deletion. The system needs a single request that fans out across every store, with a record of what was deleted and what was legitimately retained under another legal basis, plus a defensible position on backups.
- Breach notification. The draft rules set an expectation of notifying the Data Protection Board and affected individuals without delay, with a detailed report following within 72 hours. Meeting that clock requires logging good enough to determine scope quickly, which is a decision you make months before an incident.
Penalties are the reason this gets budget. The Act provides for up to 250 crore rupees for failure to take reasonable security safeguards, and up to 200 crore for breach notification failures.
Start With the Map
Nothing else works without a data inventory. For each system, record what personal data it holds, which category, why it was collected, what the retention period is, who can access it and where it goes next. Most organisations doing this honestly for the first time find between two and four times more copies than they expected, and at least one integration nobody could name an owner for.
The inventory is also what makes everything downstream tractable. Retention jobs need a list of tables and periods. Erasure needs a route to every store. Access reviews need a list of what is worth reviewing. Vendor contracts need to reflect what those vendors actually receive.
Treat it as a living artefact tied to deployment. A new table holding personal data that does not appear in the inventory should fail review, in the same way an untested migration would.
Build for Evidence, Not for the Audit Week
The organisations that handle scrutiny well are not the ones with the thickest policy binder. They are the ones that can produce, on request, the consent record for a named user, the deletion log for last quarter, the access review sign-off for the customer database, and the retention job’s execution history. All of that is a byproduct of systems built to emit evidence continuously rather than a scramble assembled in a fortnight.
At Invexa, we approach data protection as system design rather than documentation. Consent models, retention schedules and deletion paths are decided alongside the schema, because retrofitting them into a live product is consistently the most expensive way to arrive at the same place.