Field composites
Karthik 40 years · Data Protection Officer · Mumbai
Leads DPDP compliance for a fintech with ~18 million registered users — SDF-designated under MeitY's initial notification. The consent-manager integration is the first operational fault-line: the Rules mandate a DPDP-compliant consent manager as intermediary for collecting and managing user consent, but the certified consent-manager ecosystem in India is nascent. Karthik's team has mapped 11 potential integration points in the product stack, and 6 of them require consent-flow UX changes that will go through a legal review cycle of 8–12 weeks each.
The cross-border transfer question is the second fault-line. The fintech's cloud infrastructure runs on a US-headquartered hyperscaler with processing nodes in Singapore. MeitY's whitelist of approved jurisdictions for cross-border data transfer has been notified in draft form, but the final whitelist and contractual-standard mechanisms for non-whitelisted transfers remain under consultation. Karthik cannot finalise the data-residency architecture until the whitelist is settled — and the whitelist settlement is not on a disclosed timeline.
Anjali 38 years · Head of Compliance · Bangalore
Manages DPDP obligations for a health-tech platform processing health records, diagnostic data, and prescription histories for 2.4 million patients — categories the Act identifies as sensitive personal data requiring heightened consent and processing controls. The 72-hour breach disclosure SLA is the acute operational exposure: Anjali's team ran a tabletop exercise in Q1 2026 and found that the median time-to-detection for a data breach in their current SIEM stack is 38 hours, leaving a 34-hour window for detection-to-disclosure that is structurally tight.
The Data Subject Access Request (DSAR) processing pipeline is the second gap. The DPDP Rules specify a 30-day response TAT for DSARs. Anjali's team has processed 12 DSARs since the Act came into force; the median response time in that sample is 22 days — but the sample is small and the test population is technically sophisticated users. At scale, with non-English DSARs from Tier-2 patient cohorts, the 30-day TAT is not stress-tested. Guardian consent flows for minor patients are an additional unsolved design question — the platform has 180,000 registered users under 18, and the guardian-consent UX has not been built.
Vikram 52 years · MeitY policy officer · New Delhi
Oversees the Data Protection Board's enforcement capacity ramp. Three structural items from the composite scenario surface the asymmetry between the announced penalty architecture and the operational enforcement reality:
- Penalty ceiling: ₹250 crore per breach under Section 33. The DPB's adjudication capacity at current staffing allows for an estimated 60–80 complaint adjudications per year in the ramp-up phase. A ₹250 crore enforcement against a large Data Fiduciary requires a full adjudicatory hearing with legal representation — a process the DPB has not yet run at that scale.
- Enforcement priority signals from the Board's early communications indicate a complaint-driven, not systemic, intake model — meaning Data Fiduciaries that avoid public complaints face lower near-term enforcement risk, regardless of their structural compliance status. The priority sectors named are financial services, health, and edtech; the timeline for sector-wide audits is not disclosed.
- DPIA (Data Protection Impact Assessment) publication: the Rules do not mandate public disclosure of DPIAs. The announced DPIAs at large SDF entities are internal governance artefacts — not independently verifiable from outside the entity. The DPB has not yet published a DPIA framework or minimum-content standard.