India’s businesses are about to face a question no policy document can answer: can they prove their customers’ data was protected? A new briefing from K7 CyberSecurity, Turning DPDP Compliance into a Security-Led Capability (November 2026), argues that the Digital Personal Data Protection (DPDP) Act will reward companies that can show their work.
The Clock Is Ticking
The Act’s main privacy, security, and breach-notification duties are scheduled to take effect on 13 May 2027. Penalties can reach ₹250 crore for failing to maintain reasonable security safeguards and ₹200 crore for failing to report a breach. The report stresses these are ceilings, not automatic fines, and follow a formal inquiry. One incident could trigger both. The report also warns against assuming any grace period after the deadline.
More Than a Security Problem
The report’s central message is that DPDP belongs to the whole business. Legal and Privacy teams handle consent and notices; Product teams build rights requests into applications; Procurement governs suppliers; and Security protects systems. Outsourcing work does not outsource accountability. The briefing recommends one accountable executive to coordinate the effort.
What Rule 6 Demands
The Rules name seven minimum safeguards, including encryption, access control, logging, backups, one-year log retention and processor contracts. Auditors are likely to test whether each control was well designed and whether it actually worked during the period reviewed. The report’s blunt line: you cannot show a control operated all quarter if the evidence was not kept. Existing ISO 27001 or SOC 2 work helps but does not automatically equate to compliance.
Beware the Green Dashboard
A dashboard claiming “96% compliant” may hide stale data. The report urges leaders to ask what was checked, on which systems, when, and who owns the gaps. An honest “last checked at 10:42” beats an unexplained green score. It also flags two blind spots: incoming files from customers and suppliers, and core applications such as ERP and CRM, where an endpoint agent cannot recreate access records the application never collected.
Breaches Are Broader Than Theft
Under Rule 7, a breach includes loss of access so that ransomware can count even without proof of data theft. Affected individuals and the Data Protection Board must be told without delay, with a detailed report within 72 hours of the company’s awareness. CERT-In’s separate six-hour reporting rule still applies, and the two do not replace each other. The report also describes an “agentic SOC” that uses AI for routine investigative work, while humans retain control over legal and containment decisions.
A Practical Route
The advice is simple: start small. Map one high-risk process, verify its safeguards, and rehearse a breach, including an after-hours one. Follow a 30-, 60-, and 60-day roadmap, then seek independent challenge before May 2027.
A Note of Caution
K7 is a security vendor, and the briefing ends with an offer of a “DPDP Security Evidence Review.” Still, no platform provides lawful purpose, valid consent, or independent assurance. The closing question should be answered now: can we show today that our data is protected, our safeguards work, and our evidence is ready?
