DPDP for enterprises

What you own at enterprise scale

Group structures raise one question first: which entity determines the purpose and means of each activity? Shared services, group CRMs and common data platforms often blur the answer, so settle it before anything else.

• An entity map: which group company is the fiduciary for which processing.
• Notices, consent and privacy centers per brand, in English and the Eighth Schedule languages your customers use (s.5(3)).
• Discovery across databases, cloud stores, SaaS tools and employee devices.
• A vendor estate with processor contracts and security terms (s.8(2), Rule 6).
• An operating model: DPO or privacy lead, regional owners, and a route to the Board of Directors.

SDF readiness without assumptions

The Central Government notifies SDFs on s.10 factors such as the volume and sensitivity of data, risk to Data Principals' rights, and potential impact on the sovereignty and integrity of India, electoral democracy, security of the State and public order. You cannot self-designate, but you can be ready. Our SDF self-assessment walks through it.

• A DPO based in India, responsible to the Board of Directors, and the point of contact for grievances (s.10(2)(a)).
• An independent data auditor (s.10(2)(b)).
• A DPIA and an audit once every twelve months, with significant observations furnished to the Board (Rule 13).
• Due diligence that algorithmic software does not risk Data Principals' rights (Rule 13).
• Keeping in India any personal data the Central Government specifies, with related traffic data (Rule 13).

What to do this quarter

1. 01Settle the entity map

   Agree which entity is the fiduciary for each processing activity, and record it.

2. 02Connect the big stores first

   Scan the systems with the most customer data, then shared drives and devices.

3. 03Standardise the response

   One breach process, one request process and one grievance clock across brands, each with named owners.

4. 04Report upward

   Give the Board of Directors a short readiness view and the decisions you need from it, using our board reporting guide.

Evidence to keep

• Records of processing per entity, with the ground for each activity.
• DPIAs and their review dates.
• Consent event logs and notice versions (s.6(10)).
• Breach records with timelines, and request and grievance logs.
• Vendor assessments and contracts.
• An audit trail of who changed what, and when.

What to ask other teams

• Group legal: the entity map and intra-group agreements.
• Security: Rule 6 control status in each entity, and one breach declaration process.
• Procurement: a single vendor list across entities, with contract status.
• Business units: every new purpose, brand or app before launch.

How TruePrivacy helps

• Multiple brands and workspaces keep entities apart while one team runs them; users are unlimited.
• Data discovery, the DSPM endpoint agent and data security posture cover databases, cloud stores and devices.
• The SDF workspace records a designation once notified, with the DPO, the independent data auditor and yearly clocks for the DPIA, data audit and algorithmic due diligence.
• Integrations include an API and webhooks, with SSO and MFA. The DPDP checklist gives a readiness view from live records, not a certificate.