A new book by Vaishali Mutalik — now available
The guide that takes Indian enterprises
from the DPDP Act to actual compliance.
Written for the people inside Indian companies who have to make the DPDP Act, 2023 and the Rules, 2025 work in practice — across every system, every vendor and every customer journey.
Now available · Buy your copy
DPDPA Compliance for Indian Enterprises is now available.
From Policy to Practice, the complete guide to building an operational DPDPA compliance programme.
Buy the Book01 / The framework
Eight phases. One loop. A programme that does not decay.
Compliance is a lifecycle, not a project. A programme built as a one-time project starts to decay from the day it is declared complete; a programme built as a lifecycle improves from the day it starts. The Enterprise Data Compliance Lifecycle (EDCL™) is the eight-phase operating model at the heart of this book — industry-agnostic, scale-adaptive, and mapped clause by clause to the Act and the Rules.
The phases are not stages of a project with a beginning and an end. They are functions of a running programme, operating in parallel — and every significant event in the organisation's life re-enters the loop: a new product, a new vendor, a change in the law, a breach.
Govern
Board accountability, the privacy operating model, a DPO or privacy owner, policy architecture, decision rights and a budget. Without Govern, every other phase is an orphan activity with no home, no owner and no budget.
to exercise deliberate, accountable stewardship of data as a business assetDiscover
What personal data do you hold? In which systems, for which purposes, under which lawful basis, flowing to which third parties, in which geographies? A living inventory, data-flow maps, a processing register and a vendor register — including shadow IT and shadow data.
to find what is actually there, not what you assume to be thereAssess
Gap analysis against the Act and Rules, risk read through both the Data Principal's lens and the enterprise's, and DPIA discipline applied to high-risk processing. The output is an ordered, resourced remediation roadmap.
to judge what the discovered reality means for your risk positionControl
Notice engineering, the consent lifecycle, rights-handling machinery, retention and erasure, processor flow-down clauses and children's data. This is where the policy-binder illusion is most decisively broken.
to exercise operational authority over processing through designed mechanismsSecure
Encryption, masking and tokenisation, identity and access, the one-year logging floor, backup, secure SDLC and cloud — then the seventy-two hours that follow a breach. The largest penalty in the Schedule, ₹250 crore, attaches here.
to protect data with measures proportionate to the riskOperate
The phase most programmes forget to design: the run-state. Consent operations, rights at volume, grievance redressal, vendor lifecycle, role-based training. A control that has been built but is not being operated is not a control; it is a technical fixture.
to run the programme at the pace of the businessAssure
The evidence function. It answers one question at all times: how do you know? Internal audit, the annual independent audit required of Significant Data Fiduciaries under Rule 13, metrics, the board reporting pack, and readiness for the Data Protection Board.
to build and sustain justified confidence in the programmeImprove
Every audit finding, every incident, every new guidance note is an input. A five-level maturity model, horizon scanning, the annual refresh ritual — and then the loop closes, back to Govern.
to raise capability continuously, not merely to maintain a stateEvery one of the twenty-four chapters closes the same two ways: a Practitioner's Checklist you can act on this week, and an EDCL Connection that places the chapter back in the loop. Not a summary of the law. An operating model for living with it.
The book is now available.
Get your copy of DPDPA Compliance for Indian Enterprises: From Policy to Practice.
You cannot comply your way out of an unencrypted database, and you cannot secure your way out of unlawful processing.DPDPA Compliance for Indian Enterprises — Preface
02 / Who it is for
For the professional who was handed a new law and told, make us compliant.
- For the DPO, privacy lead or compliance manager who has read the Act carefully and still has no answer to the question where do we start on Monday?
- For the CISO who has worked out that the largest penalty in the Schedule attaches to a security failure, not to a missing privacy notice — and that data protection and cybersecurity are two halves of one discipline.
- For the general counsel who can read the law perfectly well, and needs to know what it means for four hundred systems, two hundred vendors and every customer journey the business owns.
- For the board member or director who will be asked, after an incident, what the organisation had in place before it. The Data Protection Board does not audit policy documents; it investigates breaches.
- For the founder of a ten-person company who cannot afford a privacy function, is fully in scope anyway, and needs the framework right-sized rather than abandoned.
- For the auditor, consultant and student of a field that barely existed in India three years ago, and now touches every enterprise in it.
03 / What is inside
Twenty-four chapters, four parts, six appendices.
Written to be read in sequence the first time and consulted selectively for years afterwards — the book you underline in week one and pull off the shelf in year five.
The New Data Order
Chapters 1–5From Puttaswamy to the DPDPA. The Act decoded — scope, actors, consent, legitimate uses, children's data, Significant Data Fiduciaries, rights and exemptions. The Rules, 2025 rule by rule. Enforcement, the Data Protection Board and the penalty schedule. And how the DPDPA sits against GDPR, CERT-In and India's sectoral regulatory mesh.
The Enterprise Data Compliance Lifecycle
Chapters 6–10Why compliance programmes fail — the policy-binder illusion, the big-bang project, the ownership vacuum, checkbox audits, vendor blind spots, privacy debt and the GDPR-template trap. Then the EDCL itself, and the first phases built out in operational detail: Govern, Discover, Assess.
From Control to Continuous Improvement
Chapters 11–16Control: notice, consent, rights and retention. Secure I: engineering the reasonable security safeguards. Secure II: breach response, hour by hour through the first seventy-two. Operate, Assure and Improve — running the programme, evidencing it, and raising its maturity.
EDCL in Action
Chapters 17–24The framework walked through BFSI, healthcare and pharma, IT services, SaaS and the GCC economy, e-commerce and retail, manufacturing, education and the public sector, and startups and SMEs. Then AI and the coming governance convergence — and the road ahead.
Six appendices, built to be used
- Appendix AThe DPDP Act, 2023 at a glance — chapter by chapter, with the full penalty schedule
- Appendix BThe DPDP Rules, 2025 at a glance — rule by rule, with all four Schedules
- Appendix CThe 90-day quick-start, in three sprints, and the 24-month roadmap to full compliance
- Appendix DTen ready templates: privacy notice, consent wording, rights SOP, both breach notifications, RoPA schema, processor clauses, retention schedule, parental consent workflow and the regulatory notification matrix
- Appendix EThe EDCL maturity model — five levels, a phase matrix, a self-assessment method and the jump actions between levels
- Appendix FGlossary
04 / The countdown
13 November 2025 started a clock.
A quiet notification in the Gazette of India gave teeth, timelines and texture to a law that had waited two years for its machinery. The Rules commence in three phases. Phase III is the hard deadline for operational readiness.
Phase I · Immediate
13 November 2025
The Data Protection Board's establishment provisions, definitions and interpretation, and Rules 17–21 — the Board's constitution, appointments and digital-office functioning. The foundational machinery.
Phase II · 12 months
13 November 2026
The Consent Manager regime: Rule 4 and the First Schedule — registration, net worth, interoperability, data-blind architecture, record retention and fiduciary duties owed to Data Principals.
—Phase III · 18 months
13 May 2027
Everything substantive: notice, State processing, security safeguards, breach notification, retention and erasure, published contacts, children's data, SDF duties, cross-border transfers and appeals. The full regime, live and enforceable.
—| Breach category | Maximum penalty |
|---|---|
| Failure to implement reasonable security safeguards to prevent a personal data breach | ₹250 crore |
| Failure to notify the Board or affected Data Principals of a personal data breach | ₹200 crore |
| Breach of obligations relating to children's data | ₹200 crore |
| Breach of the additional obligations of a Significant Data Fiduciary | ₹150 crore |
| Breach of any other provision of the Act or Rules | ₹50 crore |
| Breach of duties by a Data Principal | ₹10,000 |
These are maximum figures, not default figures. Section 33(2) requires the Board to weigh the nature, gravity and duration of the breach, its repetitiveness, the gain realised or loss avoided, and the timeliness of mitigation. The penalty schedule is as much an incentive structure as a punishment mechanism — and Chapter 4 shows how to engineer your mitigation before you need it.
05 / About the author
Vaishali Mutalik
Vaishali is a privacy and data protection consultant with decades of experience in global data privacy compliance. She has consulted and audited more than 1,000 companies across banking and financial services, healthcare, technology and manufacturing — on information security management, regulatory compliance, third-party risk and audit readiness.
That work convinced her of the argument this book makes from its first page: privacy programmes fail not for lack of legal knowledge, but for lack of an operating model. The conviction became the Enterprise Data Compliance Lifecycle — a practical, industry-agnostic framework that helps organisations of every size turn the Digital Personal Data Protection Act from a legal document into a living management system.
She writes and speaks on data protection, cyber resilience and the governance of emerging technologies, and works with leadership teams to make compliance a source of trust and competitive advantage rather than a cost of doing business.
More about Vaishali's work →06 / Before you go
The data protection era of Indian business has begun.
Let us build it well.
Now available · Buy your copy
DPDPA Compliance for Indian Enterprises is now available.
Get your copy and build your compliance programme with the EDCL framework.
Buy the Book