Critical Gaps Every BFSI Leader Must Fix Before the DPDP Rules Hit

1. From what date does DPDP apply?

The DPDP Act has been notified but is not yet in force, as the official Rules are still awaited. With a short compliance window expected, organizations should begin preparations now to avoid last-minute challenges, especially given the scale and complexity of required changes.

1. For companies already complying with regulations like GDPR, do they need to take any new steps now, or wait for the rules?

Even if you're GDPR-compliant, you shouldn’t assume you're fully covered under the DPDP Act. Here are the key additional requirements under the DPDP Act:

• All personal data is protected by the DPDP Act. Meanwhile, GDPR focuses on ‘special categories of personal data.’
• The purpose of consent collection under the DPDP Act is narrower. This will require you to revisit the basis for consent collection. 
• Applies globally to entities processing data of Indian customers. (Contrary to GDPR’s applicability primarily to individuals within the EU).
• All Data Fiduciaries need to appoint a Consent Manager as a single point of contact to enable a Data Principal to give, manage, review, and withdraw her consent through an accessible, transparent, and interoperable platform.
• The DPDP Act mandates that consent notices be available in local languages as well. 
• No obligation on Data Processors, requiring Data Fiduciaries to build strict protocols to ensure safeguarding of data shared with third parties. 
• All breaches must be reported to the Data Principals and the Data Protection Board. 
• Parental Consent is required for all children under 18.

1. Should a company define a Privacy Framework before starting a gap assessment?‍

No, the privacy framework should come after the gap assessment, not before. To build a Privacy Framework, you first need to identify:

• What personal data you collect
• For what purpose is such data collected
• Processes that use such data 
• Gaps that exist in current policies

1. Does DPDP require new or additional policies to be created?

Yes, in most cases, DPDP will require new or updated policies. Even if you already have privacy or InfoSec policies in place, they may not be fully compliant with DPDP Act requirements like explicit granular consent, data principal rights, grievance redressal, third-party data sharing or breach reporting.