By Priya Sharma, Compliance Lead, Sirius Star Last updated 27 May 2026 Two Sundays ago an IT-plus-admin head at a 120-person Mumbai garment exporter sent me a WhatsApp at 11:10 in the morning. His Company Secretary had emailed a Rs.84,000-plus-GST “DPDP onboarding kit”. The AGM was 25 working days away, with a 20-minute slot reserved…
By Priya Sharma, Compliance Lead, Secure Data Guard Practice, Sirius Star Enterprise Technologies Last updated 26 May 2026 Last November a senior recruiter resigned from a 280-person Pune fintech NBFC. He carried five years of candidate emails, offer letters, and a CSV of every notice-period employee on his way out. The HR head only realised…
By Priya Sharma, Compliance Lead, Sirius Star Last updated 24 May 2026 Last month an IT head at a Pune fintech texted me at 7:40 on a Sunday evening. The audit committee had moved the DPDP review forward by six weeks. He had fifteen minutes before dinner and the board memo was due Monday. He…
By Priya Sharma, Compliance Lead, Sirius Star Last updated 22 May 2026 Last quarter we ran a DPDP readiness call with the COO of a 220-person Mumbai logistics SaaS. Her IT head opened with, “we have policies in place.” Thirty-five minutes later we had counted 14 obligations missing entirely and 7 more where the policy…
By Priya Sharma, Compliance Lead, Sirius Star, Last updated 18 May 2026 Last quarter we audited a 280-person Pune SaaS firm that ships analytics into both Indian fintechs and three EU logistics customers. Their CISO walked in with the line every Indian compliance lead is hearing right now: “We are GDPR-compliant, so DPDP is basically…
That is the actual job DPDP compliance for BFSI lands on, and the trade press never describes it that way. The Act looks like one regulation. In the BFSI seat it is the third overlapping circular in 18 months, all asking for similar controls written differently, and the auditor wants one operating model that closes…
A DPDP compliance checklist for an Indian mid-size company comes down to ten controls: appoint a DPO, classify your personal data, rewrite your consent flows, build a 72-hour breach drill, audit every vendor that touches user data, fix data retention, set up a deletion request workflow, lock down endpoint exit routes, document everything, and run…
Personal data under DPDP is anything that can identify a living person, and that includes the spreadsheet of employee phone numbers your HR head emails to herself every Friday. The Digital Personal Data Protection Act 2023 has no “sensitive” tier the way GDPR does. There is one category called personal data, and the law applies…
Data breach cost India for a mid-size firm runs approx Rs.14 to 27 crore in fines, breach response, and lost client trust.
By Priya Sharma, Compliance Lead, Data Loss Prevention practice · Last updated 19 April 2026 DPDP Act penalties India, ₹250 crore per violation under the 2027 enforcement regime. DPDP Act penalties India can reach ₹250 crore per violation, plus mandatory 72-hour breach notification. Most mid-size companies haven’t started compliance, but you have until May 13,…