First DPDP challenge: Knowing where your personal data lives

This article is authored by Suchit Karnik, chief operating officer, RAH Infotech.

Indian companies have never produced more paperwork about protecting personal data than they are producing right now. Consent notices are being redrafted. Privacy policies are being rewritten by the page. Compliance budgets are being approved. What most of these companies still cannot do, if a regulator or a customer actually asks, is say with certainty where one specific person's data is sitting today. The paperwork has moved. The underlying knowledge has not.

DPDP act (Gemini)

That gap is now on the clock. The Digital Personal Data Protection Rules, 2025 were notified by the ministry of electronics and information technology on November 13, 2025, and they come into force in three phases over eighteen months. Provisions on Consent Managers take effect in November 2026. The full substantive framework, notice standards, consent rules, data principal rights, follows in May 2027, and it arrives with penalties of up to ₹250 crore for failing to implement reasonable security safeguards. What looks like a grace period is really a countdown.

The Act itself never uses the phrase data mapping. It does not need to. Every obligation it creates leans on the same unstated premise: correcting inaccurate data, honouring an erasure request once its purpose has lapsed, notifying a regulator inside the window the Rules demand, all of it assumes a company already knows where its data sits. A company cannot delete what it cannot find. It cannot report a breach it does not know it has had.

Personal data at most Indian companies is not sitting in one system waiting to be catalogued. It is in the CRM the sales team has used for years and the HR platform that predates it. It is in a spreadsheet on someone's laptop, in a vendor's server nobody in legal has ever logged into, in a marketing tool a department signed up for on its own card. The Act does not care whose blind spot any of this was. Section 8(1) makes the data fiduciary answerable for its entire processing chain, including what a vendor does with the data on its behalf, and that liability cannot be signed away in a contract.

The objection arrives quickly: This is one more audit, one more line item for a consultant to bill against. It is not quite that. An inventory built once and filed away proves nothing to a board when the Data Protection Board comes asking how a breach happened. What holds up is a company that can say, on the day it is asked, exactly where a given person's data has been and who has had access to it.

The cost of not knowing is no longer theoretical. India's average data breach cost reached ₹25.5 crore in 2026, according to IBM's Cost of a Data Breach Report, up from ₹22 crore the year before. A breach a company does not know it has had cannot be contained, cannot be reported inside the deadline, and cannot be explained to a board once the regulator's letter lands.

A real inventory keeps answering, continuously, what data is held, why it was collected, where it sits, and who can reach it. Structured systems like databases and CRMs are the easy part, since their fields can be catalogued directly. Unstructured data, the emails, chat exports and stray documents scattered across a company, is harder to see and increasingly needs automated scanning rather than a once-a-year manual pass. Cloud tools a department procured without telling IT add a layer most companies have never mapped at all. Every vendor holding data on the company's behalf, a payment gateway, a marketing platform, a call centre, has to be tracked with the same rigour as an internal system, because Section 8(1) holds the fiduciary responsible either way.

None of this is a one-time project. An inventory finished in January is out of date by March, the moment a new tool is procured or a new field is added to a signup form.

Discovery on its own does not satisfy the Act. It has to feed into classifying data by sensitivity, assigning an owner to each system, setting rules for how long data is kept before it is deleted, and building the operational muscle to respond when a data principal actually makes a request. Work that starts here, before consent notices or grievance systems are drafted, tends to hold up. Work that starts with a privacy policy and hopes the systems underneath it catchs up later usually does not.

As November 2026 approaches and May 2027 comes into view behind it, the companies in the strongest position will not be the ones with the most polished privacy policy on their website. They will be the ones who do not need to check.

(The views expressed are personal)

This article is authored by Suchit Karnik, chief operating officer, RAH Infotech.