DPDP Act in the Boardroom: Governance FAQs for Indian Companies

Rainmaker May 10, 2026 Data Protection & Privacy 6 min read

There’s a moment every growing organisation eventually faces. Not during a data breach. Not after a regulatory notice. But in an ordinary leadership meeting, when someone asks a deceptively simple question:

‘Who actually owns data decisions here?’

That pause, the uncomfortable one, is where the Digital Personal Data Protection Act, 2023 (‘DPDP Act’) truly begins.

The DPDP Act was never meant to sit quietly inside legal teams or IT manuals. With the DPDP Rules, 2025 notified, the countdown has officially started. Indian businesses have until May 13, 2027, before full enforcement and maximum penalties kick in. Personal data has become something else entirely: a governance responsibility, cutting across leadership, operations, vendors, risk committees, and boards.

At Rainmaker, as a culture and compliance training organisation working closely with Indian businesses, this shift is visible in boardrooms and leadership offsites as much as in legal checklists. DPDP Act compliance rarely fails because organisations do not care. It fails because accountability is unclear, systems don’t scale, and risk is treated as an afterthought until it isn’t.

This FAQ is a guide to understanding when the DPDP Act stops being just a legal requirement and starts becoming a governance test—especially for organisations that are scaling, handling sensitive data, or likely to be classified as Significant Data Fiduciaries (‘SDFs‘).

Why is the DPDP Act being discussed as a governance issue at all?

This is because the DPDP Act allocates responsibility, not only technical obligations. Under the DPDP Act, Data Fiduciaries are judged not only on whether personal data was kept secure, but also on how decisions around data were made, who was accountable for those decisions, and whether internal systems were designed to prevent harm to Data Principals. This is a governance shift, not merely a compliance update.

Data breaches, consent failures, profiling risks, or purpose creep are no longer viewed as isolated IT issues. They are interpreted as symptoms of weak oversight, poor internal controls, and missing accountability frameworks—classic governance failures.

What kind of risk does the DPDP Act actually create for organisations?

DPDP risk is layered and cumulative.

Regulatory risk: The Data Protection Board of India can impose monetary penalties for specific contraventions, such as failure to implement reasonable security safeguards, delayed breach notification, or non‑compliance with SDF duties—based on facts and evidence, not abstract estimates.
Reputational risk: DPDP Act violations are easy to narrate in plain language: ‘User data collected for X was used for Y without proper consent or legal basis.’ Trust erodes quickly. Rebuilding it is slow and expensive.
Operational risk: When there is no clear internal data ownership, fragmented vendor ecosystems, and inconsistent consent practices across products or regions, the organisation struggles to respond when Data Principals exercise rights or when an incident occurs—not because the law is unclear, but because systems were never designed for accountability at scale.

What changes when an organisation is classified as an SDF?

An SDF designation is not cosmetic. It structurally raises the bar on governance. Once notified as an SDF under Section 10, DPDP Act and Rule 13 of the DPDP Rules, entities must:

Appoint a Data Protection Officer based in India reporting to the Board or equivalent governing body;
Conduct Data Protection Impact Assessments (DPIAs) before high‑risk processing;
Undergo independent data audits at least once every twelve months; and
Maintain stronger grievance redress mechanisms and records.

In governance terms, data protection moves closer to leadership, oversight becomes continuous rather than incident‑driven, and documentation (DPIAs, audit reports, records of processing)become evidence of accountability, not mere formality.

Is SDF compliance only relevant after notification?

No. Waiting for formal SDF notification to strengthen governance could be a strategic mistake. Even before designation, organisations that process large volumes of data, children’s data, financial or health data, or rely heavily on profiling and AI should ask: Would our current structure withstand SDF level scrutiny? Are decision‑makers identifiable? Is accountability traceable from policy to system to action?

If SDF readiness feels overwhelming, that is often a governance signal—revealing unclear ownership, under‑resourced functions, or gaps in internal risk oversight—rather than a narrow legal problem.

Who is actually accountable under the DPDP Act inside an organisation?

The DPDP Act deliberately frames obligations at the level of the Data Fiduciary, not a single function.

Legal, IT, security, and product teams all play critical roles, but accountability in law sits with the organisation that determines the purposes and means of processing. Management and business teams decide how data will be used, vendors process it on the organisation’s instructions, and the Board is expected to oversee risk and resilience.

When something fails, regulators and stakeholders will look at decision‑making and governance—who knew what, who signed off, what controls existed—not just at job titles. This is why internal training, role clarity, and documented delegations often matter more than the most elegant policy document.

Why do policies alone fail DPDP Act compliance?

Because the DPDP Act is validated through practice and evidence, not text alone. It is common to see organisations with well‑drafted privacy policies, vendor contracts, and consent language that read perfectly on paper, while operational teams informally reuse data, repurpose datasets without revisiting lawful purpose, or bypass consent flows under pressure to launch or hit targets.

DPDP Act compliance ultimately lives in daily behaviour, which is why governance systems, internal controls, and training are inseparable from documentation.

How does the DPDP Act change the role of leadership and boards?

Subtly, but permanently, the DPDP Act moves data protection into mainstream governance questions for leadership and boards. Instead of only asking ‘Are we compliant?’ boards and CXOs increasingly need to ask: ‘Do we have systems that prevent non‑compliance and demonstrate accountability if challenged?’

This requires periodic visibility into data‑risk mapping, accountability structures, key DPIA and audit findings, vendor risk, and incident‑response maturity—not because the DPDP Act spells out every board‑level step, but because governance failures now carry statutory penalties and reputational consequences.

What does accountability actually look like in practice?

In well‑prepared organisations, accountability is concrete and auditable. It looks like:

clearly assigned ownership of datasets and systems;
documented decision trails for major data uses or new products;
defined escalation paths for incidents and Data Principal requests;
regular role‑specific training; and
compliance processes that can be evidenced through logs, tickets, DPIAs, and audit reports.

Where do learning and training fit into DPDP governance?

They sit at the center of durable DPDP governance. Key concepts like ‘lawful purpose’, ‘legitimate use’, ‘reasonable security safeguards’, and ‘best efforts’ in breach response require consistent interpretation across legal, tech, product, HR, and vendor‑management teams.

Without structured learning, different teams apply the law differently, risk rises with each new hire, and compliance depends on a few individuals rather than on systems. For a governance‑mature organisation, DPDP Act learning is less about one‑off awareness sessions and more about building institutional memory through ongoing, role‑specific training and reinforcement.

Wrapping Up

The DPDP Act does not demand perfection. It demands something harder: intentional design.

From experience across sectors, organisations that will struggle with implementation of the DPDP Act will rarely be underprepared on written policies. They will be underprepared structurally and rely on individuals instead of systems, memory instead of process, and reaction instead of foresight when data incidents or regulatory changes arise.

That is why the DPDP Act is best understood not as a compliance burden but as an opportunity to mature—building internal capability, accountability, and resilience around data as a core asset. Well designed governance can turn privacy from a cost centre into a source of trust and differentiation.

At Rainmaker, the belief is that sustainable DPDP Act compliance is learned, practised, and reinforced over time. Through structured training, role‑specific learning journeys, and governance‑focused advisory, organisations can move from compliance anxiety to confidence in their DPDP Act posture.

When data protection becomes part of governance, compliance stops being a fire drill and starts becoming a strength—one that leadership, regulators, and customers can see and measure.

DPDP Act in the Boardroom: Governance FAQs for Indian Companies

Wrapping Up

Suggested Reading