When a new data protection law arrives, organisations call their lawyers. For India's Digital Personal Data Protection
Act, 2023 (the DPDP Act), they should. But the documents lawyers produce are only half of what the Act tests. The other
half is evidence, and most of that evidence comes out of the systems engineers build and run.
In our experience at Blue Copper Technologies, organisations often focus first on the legal and documentation side of
DPDP compliance. The documents are well prepared. The question no one can answer is who will make them true every day after they are signed.Lawyers write the promise. Operations produce the proof. The Data Protection Board will test the
proof.
TL;DR
A law firm can make your DPDP documents compliant: privacy notices, consent wording, vendor contracts, policies and
legal opinions. It cannot, on its own, make your organisation compliant, because the Act and Rules repeatedly require
& "technical and organisational measures" that run inside your systems and teams every day: answering complaints within 90 days, keeping access logs for a year, detecting and reporting breaches, deleting data when its purpose ends,and controlling what vendors do.
What does "technical and organisational measures" mean in the DPDP Act?
It means the practical systems (technical) and processes, roles and training (organisational) an organisation uses to make sure the law is followed. The phrase appears in Section 8(4) and Rules 6, 10 and 14. It refers to things that are done, not documents that are written.
Read the Act for verbs, not definitions
Read the Act and Rules for verbs and a pattern appears. Most duties are things an organisation must keep doing, not documents it must have. Each one reads like a system requirement:
Withdrawal of consent. Section 6(4) says withdrawal must come "with the ease of doing so being comparable to the ease with which such consent was given". A system has to accept a withdrawal through the same channel as consent, and apply it everywhere the data lives.
Access visibility. Rule 6(1)(c) asks for "appropriate logs, monitoring and review, for enabling detection of unauthorised access". A system has to log who accessed personal data, and those logs have to be reviewed.
*Log retention *
Logs must be kept for one year (Rule 6(1)(e)), including logs of processing by vendors (Rule 8(3)). A system has to retain a year of logs, yours and your vendors'.
Erasure
Data must be erased when consent is withdrawn or the purpose ends, "whichever is earlier", and vendors
must erase it too (Section 8(7)), unless another law requires keeping it. A system has to delete on schedule across
copies and vendors, while honouring legal holds.
Grievances
Complaints must be answered "within a reasonable period not exceeding ninety days", backed by "appropriate technical and organisational measures" (Rule 14(3)). A system has to log, route and close requests against a deadline.
Breach reporting
Breaches must be reported to the Board and every affected person "without delay" (Rule 7). A system has to detect incidents and keep a time-stamped timeline.
Overall. Section 8(4) requires "appropriate technical and organisational measures" to ensure effective observance of
the Act. In system terms, that means all of the above, working every day.
A notice can promise all of this. Only systems and people can do it. And the evidence that it was done, on the day a
patient or borrower complains, is a log, a ticket, a timestamp or a deletion record. It is not a policy.
The Paper vs Proof check
Paper vs Proof is the method we use at Blue Copper to check whether a DPDP programme is complete. For each duty, it
asks two questions: what document says we do this, and what evidence shows we did?
Notice and consent (Rule 3, Section 6). The paper is the notice text, consent wording and translations. The proof is
the notice actually shown at every point of collection: front desk, app, branch and agent's phone. The evidence the
Board could ask for is consent records with time, version and channel.
Withdrawal of consent (Section 6(4)). The paper is the withdrawal process in the policy. The proof is a withdrawal that reaches every system and vendor holding the data. The evidence is a log showing the withdrawal was received, applied and propagated.
Security safeguards (Section 8(5), Rule 6). The paper is the information security policy. The proof is access control,
encryption, monitoring and backups. The evidence is access logs kept for a year and access review records.
Breach response (Rule 7). The paper is the breach response plan. The proof is detection, a 6-hour CERT-In report and notices to people. The evidence is a time-stamped incident timeline.
Erasure (Section 8(7)). The paper is the retention schedule. The proof is deletion actually performed, across copies
and vendors. The evidence is deletion records and vendor erasure confirmations.
Grievances and rights (Rule 14). The paper is the grievance policy and published contact. The proof is requests
logged, routed and answered within 90 days. The evidence is a request register with dates opened and closed.
Vendors (Section 8(1), Rule 6(1)(f)). The paper is the data processing agreements. The proof is vendor reviews, sub-
contractor approvals and exit checks. The evidence is a vendor register with review dates.Look at the proof and the evidence in each case. None of it can be produced by a law firm from outside the organisation,however capable. Most of it is produced by people who will never read the policy: a billing clerk, a field agent, a lab technician, an IT administrator.
What do regulators actually fine?
India's Data Protection Board has not imposed any penalties yet, and most duties begin on 13 May 2027. So the best
evidence of how a data protection regulator behaves comes from Europe, where GDPR has been enforced since 2018.
(These cases are evidence of regulatory practice, not Indian law.)
The CMS GDPR Enforcement Tracker Report 2026 records 2,685 fines worth about €6.11 billion up to March 2026. The three most common reasons are insufficient legal basis for processing, non-compliance with general data processing
principles, and insufficient technical and organisational measures for security.
Four cases read like incident post-mortems. None of them was about a missing privacy notice.
• No MFA, no access scoping, no detection. Hôpital Privé de la Loire, France, €500,000 (September 2026). The
CNIL found no multi-factor authentication on remote access, one account could reach every patient's records
with no restriction by care team, and there was no real-time detection, so an attacker extracted data over several
days unnoticed. 524,867 patients were affected.
• Role sprawl. Centro Hospitalar Barreiro Montijo, Portugal, €400,000 (2018). The hospital had 985 active user
accounts with "doctor" access rights, but only 296 doctors.
• A system that could not delete. Deutsche Wohnen, Germany, €14.5 million (2019). Its archive system had no way to delete personal data once it was no longer needed, including social and health insurance records.
• Retention jobs that never ran. A credit collection company, Hamburg, €900,000 (2024). It kept a six-digit number of records past their deletion deadlines, some for five years after the legal retention period had ended.
Each is an operational failure that a well-written policy would not have prevented, and that continuous checks would have caught.
The Day 2 problem
A legal team's work peaks on Day 1: the notice is approved, the policy is signed, the contracts are updated. DPDP is tested on Day 2, and on every day after.
In a hospital, Day 2 looks like this:
• The front desk collects data from a walk-in patient using last year's form, not the new notice.
• The hospital information system has shared logins at a nursing station, so no one can say who opened a record.
This is exactly what regulators fined in the Barreiro and Loire cases.
• Medical records must be kept for at least three years under the Indian Medical Council regulations, and patients
can ask for copies within 72 hours. The hospital must track which records sit under a legal hold, provide copies on time, and delete what is no longer required.
• The DPDP Rules exempt clinical establishments from parental consent for child patients only "to the extent
necessary for the protection of her health". A paediatric wellness campaign or a birthday SMS from the CRM falls outside that exemption.
• A lab partner starts sending reports by WhatsApp without telling anyone.
In an NBFC, Day 2 is shaped by long data chains and overlapping laws:
• Consent withdrawal meets KYC retention. RBI's KYC Direction requires identification records to be kept for at least five years after the relationship ends. When a borrower withdraws consent, the NBFC must stop other uses of the data, keep what the law requires, and delete the rest on time. That needs systems that can tell the difference.
• Field and sourcing agents collect KYC on personal phones, and leave the company without handing them back.
• Collection agencies and lending partners hold borrower data. RBI already holds the NBFC "fully responsible"
for its lending service providers, and DPDP adds the same for every processor.
Indian lawyers see the same shift. Writing on Mondaq in June 2026, the law firm Shivadass & Shivadass observed that
DPDP compliance "may become something embedded directly into code, APIs, workflows and system architecture itself". AMLEGALS, writing about healthcare consent, put it more directly: "Legal compliance must be operationalized across the institution," and "Immutable logs, timestamps, and audit trails are necessary to withstand scrutiny."
Who does what
The right model is a clear division of labour, not "law firm or engineering".The law firm is responsible for interpreting the Act and Rules, drafting notices and contracts, retention decisions under other laws, legal opinions, and representation before the Board.
The compliance platform and team are responsible for data inventory, consent and request tracking, access and log
monitoring, vendor oversight, breach timelines, deletion records and board reporting.
Internal owners are responsible for running each duty in their own department: front desk, branch, HR, procurement
and IT. The board of directors is responsible for oversight: asking for evidence every quarter, not just policies once.
When legal and operations work together, the legal advice gets turned into tasks, and the tasks produce the evidence
that defends the legal position. When only one is present, there is either good paper with no proof, or busy activity with
no legal grounding.
Can your systems answer these five questions?
- If a patient or borrower withdrew consent today, could we show, with a timestamp, every system and vendor where that withdrawal was applied?
- Can we produce one year of logs showing who accessed personal data, as Rule 6 will require?
- Do we know every place our personal data sits, including spreadsheets, email and vendors?
- Who will check, every month after May 2027, that the policies our lawyers wrote are being followed?
- Has our legal adviser told us what evidence we will need if the Data Protection Board opens an inquiry, and who will produce it? Quick answers How long must logs be kept under the DPDP Rules? At least one year, including logs of processing done by vendors (Rules 6(1)(e) and 8(3)). How quickly must a grievance be answered? Within a reasonable period not exceeding 90 days, backed by "appropriate technical and organisational measures" (Rule 14(3)). When must personal data be erased? When consent is withdrawn or the purpose ends, whichever is earlier, and vendors must erase it too, unless another law requires it to be kept (Section 8(7)). Is a DPDP gap assessment enough to be compliant? ** No. A gap assessment shows where you stand on the day it is done. Compliance depends on closing the gaps and keeping them closed as staff, vendors and systems change. Have any companies been fined under the DPDP Act yet? No. The Data Protection Board has not imposed any penalties, and most duties begin on 13 May 2027. **How long does the work take? Law firms such as IndiaLaw estimate four to eight weeks for a baseline gap analysis of a mid-sized company and three to five months for a full rollout. Data inventory, classification and deletion across older systems can take longer. With duties starting on 13 May 2027, most hospitals and NBFCs have about six months.
The takeaway
The DPDP Act is a law, and it needs lawyers. But it is a law about how organisations behave with personal data every
day, and behaviour cannot be drafted. It has to be run, recorded and proved, and much of that recording happens in the systems engineering teams own.
What does your stack do today when a user withdraws consent?
I'd like to hear how other teams are handling it in the
comments.
About the author: Gayatri leads Strategic Growth and Marketing at Blue Copper Technologies, focusing on DPDP Act awareness, technology solutions, and business growth. She brings over 10 years of experience in B2B marketing, strategic communications, and brand development. Her work focuses on helping organisations identify the right technology solutions for regulatory compliance, digital transformation, and busines.
This article is for general information and is not legal advice. It reflects the Digital Personal Data Protection Act, 2023, the
DPDP Rules, 2025 and RBI directions as of 6 November 2026.
This post was restructured from an earlier article with the help of an AI writing tool, and reviewed by the author.
