The 12 Months DPDPA, When MeitY Signals!

Three uncomfortable truths I am seeing in the field:

1. You are suffering from “Bandwidth Bankruptcy.” If your DPDPA lead is your GC or CISO doing four other jobs, you have a narrative, not a programme.

You are expecting overstretched teams, even of consultants, law-firms, advisors, etc to rewrite hundreds of vendor contracts and remap fragmented data flows while hitting quarterly targets.

When an organization runs this hot, shortcuts stop being exceptions; they become the operating norm.

2. You are building “Privacy by Patchwork.” Under time pressure, Privacy by Design is the first casualty.

Data inventories are being rushed, leaving shadow systems invisible and unmanaged. Legacy platforms that cannot support granular deletion are being wrapped in policy language rather than actual code.

The result would be that You spend heavily, move quickly, and end up with brittle controls that won’t survive first contact with a regulatory audit.

3. Training is a Culture and Checkbox. We have a thin crust of specialists who understand how the Act translates to a database.

Everyone else is learning on live systems with real data. Staff click through modules, then immediately revert to side spreadsheets and unencrypted sharing because that is how work actually gets done.

If middle management doesn’t internalize the “why,” compliance dies at the desk level.

The Leadership Mandate

Serious leaders are not asking for more time; they are making harder choices:

• Prioritize Ruthlessly: Fix high risk data flows first. Abandon the illusion of perfect coverage everywhere.
• Ring fence Capacity: If no one owns this full time, no one owns it. Stop treating privacy as a “side-of-desk” project.
• Retire, Don’t Wrap: If a system cannot comply on a credible timeline, kill it. It is cheaper to retire an asset than to defend it after a ₹250 crore breach.