In this “Privacy Hour” session, Seqrite hosts Apurva Saxena from KPMG India to discuss the practical transition from viewing privacy as a mere compliance hurdle to a core business framework. With the Digital Personal Data Protection (DPDP) Act coming into full force, the

conversation emphasizes that Indian organizations must now adopt a “privacy-first” security posture to protect data principals and avoid significant penalties.

The following FAQs are based on the strategic and operational insights shared during the session.

Frequently Asked Questions (FAQs)

How does the DPDPA empower Indian citizens (Data Principals)?

The Act significantly enhances user rights compared to previous laws. Key empowerments include the Right to Nominate (appointing someone to exercise rights in case of death or incapacity) and a clear Grievance Redressal mechanism. Organizations must now resolve grievances within 90 days as mandated by the government.

Is the “Consent Manager” mandatory for all organizations?

No. A common misconception is that every company needs a Consent Manager. Existing consent systems are often sufficient. Consent Managers, acting as aggregators or integrators, are primarily needed for complex scenarios involving third-party validations, such as credit checks or ID verification (similar to DigiLocker).

How should organizations handle Data Subject Requests (DSRs) effectively?

While many currently handle requests manually, a robust digital system is essential for scale. This involves:

  • A DSR system to capture requests.
  • An underlying Data Discovery layer to find structured and unstructured data.
  • ROPA (Record of Processing Activities) to map where data resides and its source, ensuring reports are accurate and defensible.

Can an organization “automatically” delete data once a purpose is served?

While automation is achievable, it can be dangerous if not carefully implemented. Deletion logic must account for various constraints, such as:

  • Sectoral Laws: RBI mandates may require retention for several years regardless of the DPDPA.
  • Legal Holds: Data currently involved in court disputes must be preserved.
  • Backups: Deletion must also consider data residing on tapes or backup servers.

What is DPIA, and why is it important for Significant Data Fiduciaries (SDFs)?

A Data Protection Impact Assessment (DPIA) is a risk-based assessment focused on the impact of processing on the Data Subject. It helps SDFs identify risks such as identity theft, reputation damage, or financial loss, and link them to specific technical and organizational mitigation measures.

How does AI impact privacy governance?

AI adds a layer of complexity to governance. Organizations using AI should:

  • Anonymize Prompts: Use logic to trim personal data before it enters an LLM.
  • Human-in-the-loop: Ensure a “human eye review” of AI outputs to avoid bias and errors.
  • Vendor Controls: Understand if back-end providers (like Microsoft or OpenAI) are using your data to train their models.

What is the new timeline for reporting data breaches under the DPDPA?

Unlike previous informal 72-hour windows, the DPDPA requires organizations to notify the board and affected individuals “as soon as possible” (ASAP) upon identifying a breach. A detailed report must then follow within 72 hours.

What is the first step for a company starting its privacy journey today?

The most critical step is hiring the right people. It is also highly recommended to keep the Data Protection Officer (DPO) role separate from the CISO (Chief Information Security Officer) to ensure transparency and avoid internal conflicts of interest when reporting issues.

This session serves as a roadmap for IT and Legal leaders to operationalize their data privacy frameworks, moving beyond compliance to build genuine digital trust.