DPDP in the AI era: Why privacy must move from policy to enterprise operations

As enterprises scale AI, cloud and digital ecosystems, speakers at a Mint CIO Circle webinar said DPDP compliance will depend on data visibility, operationalising consent and continuous oversight of third-party and AI systems.

By: Sohini Bagchi

India’s Digital Personal Data Protection (DPDP) framework is pushing enterprises to rethink how they handle personal data, from simply storing and securing it to continuously governing, tracking and acting on it.

The shift matters because DPDP sets obligations around how personal data is collected, used, retained and deleted, alongside requirements around consent, user rights and security. For technology teams, compliance therefore has to be embedded in the systems and workflows that handle data.

Execution begins with visibility

The challenge is growing as data spreads across legacy systems, cloud platforms, SaaS applications, archives and increasingly, AI environments. At a recent Mint CIO Circle webinar, “DPDP and Privacy by Design in the AI Era”, Shekhar Soni, Principal Consultant, Mint CIO Circle, said privacy can no longer remain confined to legal documentation and policy.

According to recent Mint CIO Circle research cited by Shekhar Soni, nearly three-quarters of enterprise architectures face non-compliance risk under DPDP. Organisations need visibility into where personal data resides, how consent is managed and where accountability lies across its lifecycle.

The question is therefore not only what a privacy policy says, but whether systems and processes can enforce those commitments. This makes privacy by design an architectural issue, with controls around data minimisation, purpose, access, consent, retention and deletion built into workflows rather than added after deployment.

Virendar Koul, Data Privacy Leader at Kyndryl, described this as a change in the basic operating model of data. “Simply storing personal data has moved now to actively governing, justifying, protecting and managing it throughout the lifecycle,” he said.

That starts with knowing where the data actually resides. Koul said organisations need to discover personal information across on-premises environments, cloud, SaaS platforms, lakehouses, warehouses, archives and backups. Once identified, it can be inventoried and assessed for impact, risk and exposure.

Koul compared this to having a “Google Map for enterprise data”. Without knowing where data sits, organisations cannot reliably manage consent, deletion or access.

Bridging consent to operational workflows

But visibility is only one part of the problem. Sriram Kannan, Consult Partner for Banking and Financial Services at Kyndryl India, framed DPDP readiness around three pillars: visibility, execution and evidence.

“Do I have visibility of my data? Can I execute the required action, and do I have evidence to prove it?” he said. “Know it, control it, prove it.”

This becomes particularly important when a customer withdraws consent. A consent manager, Kannan said, should bridge customer choice and enterprise action. A withdrawal cannot simply change a field from yes to no; it must trigger the appropriate action across upstream and downstream applications, processes and workflows.

Integration challenge remains

The integration challenge is already visible in the webinar poll, with 39% of participants identifying consent integration as their biggest DPDP challenge.

Koul recommended assessing application readiness and staging integrations through environments such as User Acceptance Testing (UAT), System Integration Testing (SIT) and disaster recovery before moving to production. APIs and SDKs can connect modern applications, while legacy systems may require messaging queues or other connectors.

Deletion also cannot always be treated as a simple technical command. Regulated organisations may need to retain records for statutory reasons. In such cases, Koul said, data can be flagged and processing stopped while it is retained for the required period.

AI raises the privacy bar

As AI adoption accelerates, these controls also need to move upstream. Koul said organisations should “inspect, validate and protect” data before it enters an application or AI system, establishing where personal data resides, who owns it, what consent was obtained and for what purpose.

Koul said organisations need to screen data before it enters AI applications and retrieval-augmented generation (RAG) systems, similar to security checks at an airport, to ensure personal data is validated and protected upfront.

For AI and RAG systems, he believes that companies should allow only trusted sources, repositories and agents, including approved databases, document repositories and controlled data lakehouses. Consent should be validated before personal data is used by an AI system, while training datasets need clear governance, controls against manipulation and defined accountability.

These controls also need to address risks such as shadow AI, prompt injection, model drift and model security. Organisations need clear guardrails and visibility into what data enters AI systems, how it is governed and who is accountable for it.

For AI, privacy by design means building these checks into the workflow itself. Data minimisation, purpose limitation, access controls and consent checks need to operate before personal data enters an AI system, rather than becoming a review after deployment.

“Privacy can no longer be treated as a compliance checkbox. In the era of AI and intelligent agents, it must be embedded into data, applications, workflows, and business processes by design,” Sairam Kannan said.

Extending oversight to third parties

Third-party processors create another potential gap. PwC India’s 2026 Global Digital Trust Insights study found that 18% of Indian business and technology leaders considered third-party breaches the threat they were least prepared to handle, citing limited visibility into vendor practices and fragmented governance. The India findings were based on responses from 138 businesses.

Kannan’s framework was simple: “Know, minimise, verify.” Organisations should know what information a processor receives, why it needs it, who can access it, how long it needs it and whether subcontractors are involved. They should minimise the information shared to what is necessary for the stated purpose. Contracts alone cannot establish compliance.

“Just because an organisation has outsourced the processing, does not mean that they've outsourced accountability,” Kannan said, pointing to encryption, masking, monitoring, audit trails, traceability, incident processes and clear retention and deletion requirements as part of ongoing assurance.

The road ahead: Pragmatic prioritisation

Kannan’s framework is to “understand, prioritise, automate, scale”, starting with high-risk customer journeys, sensitive data repositories, third parties with significant access, and AI systems and agents.

Large banks with significant legacy estates may need to prioritise high-risk customer and data journeys rather than wait for wholesale modernisation. Digitally native banks and FinTechs, meanwhile, increasingly need to manage privacy across APIs, cloud environments, fintech partnerships and AI ecosystems, Kannan said.

“The future belongs to organisations that can not only protect data, but also demonstrate visibility, control, and accountability across its entire lifecycle,” he said.

Koul’s final filter is to identify where sensitive data, high regulatory exposure and critical business risks intersect, and start there.

For Shekhar, that makes DPDP readiness an enterprise architecture and operating challenge, not simply a compliance exercise. The test is whether organisations can demonstrate, with evidence, that they are in control of the data they hold, use and share.