With under eight months left before 13 May 2027, most companies I speak to want to start with the privacy policy. It is the easiest document to update and the least likely to protect you.

In our readiness work, the real gaps show up elsewhere: in personal inboxes, in shared vendor logins, and in teams that handle the most personal data while understanding the law the least. Here is what we are seeing on the ground, organised around the four questions every organisation eventually has to answer.

1. Where do we begin? Finding the data you actually have

SOPs tell you how data should move. They rarely tell you how it does. Most organisations have department-wise SOPs for collection and handling. In practice, employees do not follow them when circulating documents within and across departments.

During our data mapping interviews, one pattern kept repeating. Employees were sharing work documents through personal email accounts instead of official IDs. Once that happens, the data is no longer traceable, and the network becomes chaotic.

This is not unique to India. Security researchers have long flagged how employees copy work files to personal cloud and email accounts for convenience, creating copies outside any corporate control. SOPs alone will not capture real document flow; a simple employee-completed survey often reveals more.

The root cause is basic. Employees do not know what qualifies as personal information. You cannot ask someone to protect data they cannot recognise.

Then there is software sprawl. Most organisations cannot say with confidence which tools touch personal data, especially now that teams adopt AI tools on their own. DataGrail, a privacy software vendor, says its own research shows manual mapping exercises miss up to half of the third-party SaaS systems holding personal data.

What works:

  • Pair SOP review with employee surveys and interviews, so you map actual behaviour, not intended behaviour
  • Issue a plain-language employee privacy notice that explains what counts as personal data and how to handle it
  • Build an inventory of every software tool with access to personal data, including AI tools teams have adopted on their own

2. Who owns what? Bringing HR, IT, Security, Legal and Operations together

Privacy usually starts as one function's job, typically Legal or IT. It stays that way until an audit, a customer question or an incident forces everyone else to get involved.

The bigger problem is a mismatch between knowledge and exposure. An EY India survey of 150+ professionals, released in early 2026, found that understanding of the DPDP Act was highest in Legal, Risk, Cybersecurity and Technology, and lowest in Business Operations, HR, Finance and Manufacturing. These are exactly the teams handling personal data every single day.

A single named "privacy owner" for the whole company rarely works. What works better is a RACI-style split by data domain:

  • HR: accountable for employee data
  • Operations: data collected at plants and stores
  • IT: systems and access
  • Security: technical safeguards
  • Legal: contracts and regulator queries

These owners still need one shared forum. Without it, you have not solved the silo problem. You have multiplied it by five.

Training has to be role-based. A store cashier does not need breach notification timelines, but does need to know what to do when a customer asks for their CCTV footage. A plant HR officer needs to know how biometric attendance data should be handled.

Finally, the DPO or privacy lead often exists only on paper. Without authority, budget and a seat at the leadership table, the role becomes a mailbox that collects requests instead of a function that resolves them. Give the role explicit power to pause a launch or a vendor deal on privacy grounds, not just the responsibility to draft the policy.

3. What happens beyond our walls? Vendors and contractors

Vendor risk is not only about a vendor losing your data. It is also about the physical and network access vendors get at your plants and stores, which often outlives the reason it was granted.

The 2013 Target breach remains the textbook case. Attackers got in using credentials stolen from an HVAC contractor, Fazio Mechanical, and moved from there to payment systems the vendor never needed to reach. Target said about 40 million card records and personal information of about 70 million customers were stolen.

Closer to home, remote access set up so a supplier can fix a machine quickly tends to become a permanent, forgotten connection. Shared logins across a vendor's service team make it impossible to tell which technician did what.

Two habits fix most of this:

  • Give each vendor technician a named individual login, never a shared account
  • Set every vendor access grant to expire automatically at the end of the project or contract, so someone must actively renew it rather than remember to remove it

A signed data processing agreement on file does not mean you know where the data goes next. Vendors use their own subcontractors and cloud sub-processors, and sometimes do not know every processing location themselves.

What works:

  • Tier vendors by the data they touch before drafting contracts. A canteen or housekeeping vendor needs very different scrutiny from a payroll processor or CCTV monitoring vendor
  • List sub-processors in the same vendor register as the main contract, not in an appendix nobody reopens
  • Require subcontractors to carry the same confidentiality and deletion duties, with audit rights that are not optional

Vendor onboarding is usually the slowest workstream in the entire programme. Not because the policy is hard to write, but because notifying, negotiating and collecting attestations from dozens of vendors takes months. Vendor cycles set the pace for everything else, so start them from month one, in parallel with internal policy work.

4. What should we prioritise before May 2027?

The Data Protection Board has been in place since November 2025 and is already accepting complaints. Yet as of early 2026, EY found that more than 83% of organisations had not begun comprehensive implementation, and about 81% had not updated their privacy policies or governance frameworks.

Prioritise by lead time, not visibility. Updating the public privacy policy feels urgent because it is visible. Consent management systems, encryption upgrades and vendor agreements take months, not weeks, and those months are running out.

Run quick wins and slow projects side by side. The most common mistake I see is sequencing: finish data mapping, then write policy, then start on vendors. That approach almost guarantees a missed deadline. Kick off data mapping, role-based training and vendor notification in the same month, even if they finish at different speeds.

Hold a formal checkpoint now. If your organisation has not reviewed progress against plan yet, do it this quarter. Measure actual progress, not activity, and be ready to ask for more budget or people at that review, not in April 2027.

Large data processors should plan for less time, not more. In January 2026, MeitY floated compressing the timeline for Significant Data Fiduciaries to 12 months, which would pull their deadline to November 2026. It has not been notified, but if you are likely to be designated an SDF, that risk belongs in your plan.

The deadline is not going to move later. For some, it may move earlier. What is still in your control is the order in which you start.

DPDP Readiness Scorecard

Sources