DPDP Compliance in India: From Data Discovery to Accountability
India's Digital Personal Data Protection Act of 2023 has transitioned from theoretical framework to practical enforcement reality. Organizations that process personal data of Indian residents — whether headquartered in India or operating globally — must now demonstrate that they know what data they hold, where it lives, how it is protected, and how they can respond to individual rights requests.
The foundational questions regulators and auditors will ask are straightforward but operationally demanding to answer:
- Do you know what personal data your organization stores?
- Do you know where it resides — email, Teams, SharePoint, endpoints?
- Can you track who accessed that data and when?
- Can you respond to data access or deletion requests within the mandated timeframe?
For most organizations, answering these questions confidently requires a structured technology implementation. Microsoft Purview provides the toolset — but the tools only deliver value when correctly configured and aligned to your business workflows.
Step 1: Data Discovery
You cannot protect what you cannot see. The first step in DPDP compliance is understanding your personal data landscape: what categories of personal data exist, where they are stored, and in what volumes.
Microsoft Purview's data discovery capabilities automate the identification of personal data across your Microsoft 365 estate — Exchange Online, SharePoint, OneDrive, Teams, and enrolled endpoints. Built-in sensitive information type classifiers identify Indian-specific personal data including Aadhaar numbers, PAN card details, passport numbers, and financial account information.
The output of a data discovery exercise should be a documented inventory of personal data categories, their locations, and their estimated volumes — the foundation of your data protection impact assessment.
Step 2: Classification
Once personal data is discovered, it must be classified consistently. Microsoft Purview sensitivity labels enable a hierarchical classification framework — typically Public, Internal, Confidential, and Highly Confidential — that travels with content wherever it goes.
Sensitivity labels are not just metadata tags. They enforce specific protection behaviors: encryption that follows the document outside your environment, watermarking for Highly Confidential presentations, and restrictions on forwarding or printing for specific content categories. Auto-labelling policies ensure that newly created or uploaded content containing personal data is classified without relying on individual users to apply labels manually.
Step 3: Leak Prevention
Classification enables enforcement. Microsoft Purview Data Loss Prevention policies use sensitivity labels as triggers to block or restrict actions that would constitute a data breach: emailing personal data to external recipients, uploading classified content to unauthorized cloud services, or printing confidential documents.
For DPDP compliance, DLP policies should specifically address:
- Blocking external sharing of content containing Aadhaar or financial data without explicit approval
- Alerting compliance teams to unusual bulk access or download of personal data
- Preventing personal data from being processed by AI tools (including Copilot) without appropriate governance controls
All DLP policy matches generate audit log entries, creating the evidence trail required for regulatory accountability.
Step 4: Accountability Documentation
The DPDP Act places explicit accountability obligations on Data Fiduciaries. Demonstrating compliance requires audit trails that document what personal data you hold, what access occurred, what protection measures were applied, and how policy violations were handled.
Microsoft Purview's audit capabilities capture a comprehensive activity log across your Microsoft 365 environment — every file access, sharing event, label change, and DLP policy match. These logs can be retained for the periods required by your compliance obligations and queried to respond to regulatory enquiries or data subject access requests.
For data subject requests (access or deletion), Purview's Content Search and eDiscovery capabilities allow compliance teams to locate all personal data associated with a specific individual across your entire Microsoft 365 estate, supporting timely and complete responses to DPDP rights requests.
The Implementation Reality
Technology alone does not deliver DPDP compliance. Successful implementation requires correct technical configuration, policy alignment with actual business workflows, staff awareness of data handling obligations, and a continuous monitoring programme that maintains compliance as your data landscape evolves.
Organizations that deploy Purview without investing in policy design, staff training, and ongoing governance will have the tools but not the outcome. DPDP readiness is a programme, not a project.
AW InfraSec DPDP Readiness Assessment
AW InfraSec offers a structured DPDP readiness assessment that identifies your current compliance posture, documents your personal data landscape, highlights gaps between current controls and DPDP obligations, and produces a prioritized remediation roadmap. Our assessments are designed to prepare organizations for both regulatory audits and the adoption of AI tools that require robust data governance as a prerequisite.