A message to every organisation that collects, uses or processes personal data “It is our personal data. If you protect it properly under the DPDP Act, 2023, you will earn our confidence. Responsible data protection can also help your organisation avoid penalties of up to ₹200 crore for certain contraventions.” Every time we open a bank account, purchase an insurance policy, visit a hospital, use a mobile application, shop online or share our information with a company, we place a degree of trust in that organisation. We share our names, addresses, telephone numbers, email addresses, financial details, identification documents, health information and other personal details because we expect these organisations to use our information responsibly. But an important question remains: Are organisations protecting our personal data with the same care with which we entrust it to them? Personal Data Belongs to People, Not Just Databases For a company, personal data may be a record in a database, a customer profile, an application form or a digital file. For an individual, that same data represents their identity, privacy, financial security and personal life. A data breach or misuse of personal information can expose individuals to fraud, identity theft, financial loss, unwanted communications and a loss of privacy. The consequences can extend far beyond the organisation’s IT systems. Data protection, therefore, is not merely a technical exercise. It is a responsibility towards every individual whose information an organisation handles. The DPDP Act, 2023: A Step Towards Responsible Data Governance India’s Digital Personal Data Protection Act, 2023 establishes a legal framework governing the processing of digital personal data, subject to the Act’s scope, provisions and applicable exemptions. The law places important responsibilities on organisations that determine the purposes and means of processing personal data, referred to as Data Fiduciaries under the Act. Depending on the applicable provisions, organisations must address matters such as: Providing appropriate notices and obtaining valid consent where required. Processing personal data for lawful purposes and in accordance with applicable legal requirements. Implementing reasonable security safeguards to prevent personal data breaches. Establishing procedures for handling personal data breaches and fulfilling applicable notification obligations. Providing mechanisms for individuals to exercise their rights under the Act. Addressing grievances and complying with applicable data-retention, erasure and other obligations. Compliance should not be treated as a document prepared merely to satisfy an audit. It should be reflected in the organisation’s everyday decisions, technology, contracts, employee practices and customer interactions. ₹200 Crore: A Financial Risk That Organisations Must Take Seriously The DPDP Act, 2023 provides for substantial monetary penalties for specified contraventions. Under the Act’s Schedule, failure by a Data Fiduciary to take reasonable security safeguards to prevent a personal data breach may attract a penalty of up to ₹250 crore. Failure to notify the Board or affected individuals of a personal data breach, where required, may attract a penalty of up to ₹200 crore. These are maximum statutory penalties for specified contraventions, not automatic fines imposed on every organisation that experiences a data breach. The applicable legal provisions, facts and adjudication determine the consequences. For corporate leadership, the message is clear: inadequate data protection can expose an organisation to serious regulatory and financial risks, apart from reputational damage, customer dissatisfaction and loss of business confidence. Investing in compliance before a problem arises is a more responsible approach than trying to repair the damage afterwards. Compliance Is More Than Avoiding a Penalty A responsible organisation should ask itself: Do we know what personal data we collect and why we collect it? Do we inform individuals how their data will be used? Do we collect only the information that is necessary for our purposes? Do we have appropriate technical and organisational security safeguards? Do our employees understand their responsibilities concerning personal data? Do we have a documented procedure to identify, respond to and report data breaches as required? Do we have a process for handling requests, grievances, retention and erasure of personal data in accordance with applicable law? Have we assessed the responsibilities of our vendors, service providers and technology partners? If these questions cannot be answered confidently, the organisation should consider undertaking a structured DPDP readiness assessment and developing an appropriate compliance programme. The DPDP Act and Rules provide for phased implementation. The principal provisions governing data-fiduciary obligations are scheduled to commence 18 months after the commencement notification published on 13 November 2025, which works out to 13 May 2027. Organisations should use this transition period to prepare rather than wait until the deadline approaches. <Cite refs={[“turn939042search1″,”turn939042search9”]}/> Data Protection Builds Customer Confidence Imagine a customer choosing between two organisations offering similar products or services. One organisation is transparent about its data practices, takes security seriously, explains its policies clearly and provides accessible channels for addressing privacy concerns. The other collects information without adequate transparency and leaves customers uncertain about how their personal data is being used. Which organisation is more likely to earn lasting trust? Data protection can become an important part of an organisation’s reputation. It can strengthen customer relationships, support responsible digital innovation and demonstrate that the organisation values the people behind the data. Trust is not earned merely by collecting customers’ information. Trust is earned by protecting it. A Call to Corporate India We urge companies, banks, hospitals, insurance providers, educational institutions, e-commerce platforms, startups and other organisations handling digital personal data to make data protection a priority at the highest level of management. Corporate leaders should consider taking the following steps: Assess: Identify the personal data collected, the purposes for which it is processed and the applicable legal obligations. Prepare: Develop a practical, organisation-specific DPDP compliance roadmap. Protect: Review access controls, security measures, vendor arrangements and incident-response procedures. Train: Educate employees and management about responsible data handling. Implement: Establish appropriate policies, notices, procedures and accountability mechanisms. Review: Periodically assess compliance and improve safeguards as business operations and legal requirements evolve. Compliance should be proportionate to the organisation’s activities, size, risks and legal obligations. A well-designed programme should be practical, sustainable

With the Digital Personal Data Protection Rules, 2025 now notified, Indian businesses are in a countdown to full enforcement of the Digital Personal Data Protection Act, 2023 (DPDP Act). The central question for every founder, CTO, compliance head and general counsel is the same: “Are we actually compliant, and can we prove it?” The most reliable way to answer that is a DPDP Act audit. Sam O Martin LLP, a data protection law firm serving clients across India, helps organizations assess their readiness, close compliance gaps and build audit-ready data governance programs. This guide explains what a DPDP Act audit is, who needs one, what it covers, and how to prepare. What Is a DPDP Act Audit? A DPDP Act audit is a structured, evidence-based review of how an organization collects, uses, stores, shares, secures and deletes digital personal data, measured against the requirements of the DPDP Act, 2023 and the DPDP Rules, 2025. It answers three questions: What personal data do we process, and why? Do our policies, contracts, systems and practices meet the law? Where are the gaps, how serious are they, and how do we fix them? The output is typically a written report with findings ranked by risk and a practical remediation roadmap. Voluntary Audit vs Mandatory Audit It helps to separate two situations: Mandatory audit for Significant Data Fiduciaries (SDFs). The DPDP framework requires a Data Fiduciary notified as a Significant Data Fiduciary to appoint an independent data auditor and to carry out a Data Protection Impact Assessment (DPIA) and an audit periodically (the Rules provide for this at least once every twelve months), with a report furnished to the Data Protection Board of India. The government may notify an organization as an SDF based on factors such as the volume and sensitivity of data processed, risk to Data Principals’ rights, and risk to the security and sovereignty of India. Voluntary (but strongly advisable) audit for all other Data Fiduciaries. Most businesses are not required to commission an external audit, but they are still fully subject to the Act’s duties and penalties. A DPDP compliance audit is the practical way to demonstrate “reasonable security safeguards” and good-faith compliance if a complaint or breach ever reaches the Board. Why a DPDP Act Audit Matters 1. Penalties Can Be Severe The DPDP Act provides for monetary penalties of up to ₹250 crore for failing to maintain reasonable security safeguards, with other violations such as failure to notify a breach or breaching children’s data obligations also attracting very large penalties. Penalties are imposed per instance and are decided by the Data Protection Board after an inquiry. 2. The Enforcement Window Is Closing The Rules phase in implementation, with the core obligations on notice, consent, security safeguards, breach notification, children’s data, Data Principal rights and SDF duties becoming enforceable about 18 months after notification, which is around mid-May 2027. Remediation work such as consent redesign, vendor contract renegotiation and technical controls takes months, so waiting for the deadline is a risk. 3. Data Principals Can Already Complain Once the Data Protection Board is operational, individuals can raise grievances and complaints. An organization that has audited itself can respond with documented evidence rather than scrambling. 4. It Protects Deals, Funding and Client Relationships Enterprise customers, banks, investors and acquirers increasingly ask for proof of DPDP readiness in vendor questionnaires and due diligence. An audit report is concrete evidence. 5. It Reveals Hidden Risk Audits routinely uncover shadow IT, forgotten databases, over-retention of data, unmanaged vendors and legacy consent records that leadership did not know about. Who Should Conduct a DPDP Act Audit? Startups and SaaS companies handling customer data E-commerce, retail and D2C platforms Banks, NBFCs, fintech, insurance and payment companies Healthcare providers, hospitals, diagnostics and health-tech companies EdTech platforms and any business processing children’s data Social media, gaming and digital media platforms HR, recruitment and staffing firms IT services and BPO companies acting as Data Processors Any organization likely to be notified as a Significant Data Fiduciary Companies already complying with GDPR that need to align with Indian law What Does a DPDP Act Audit Cover? 1. Applicability and Role Mapping Confirming whether the DPDP Act applies and whether you are a Data Fiduciary, Data Processor, Consent Manager or potential Significant Data Fiduciary, including processing of Indian residents’ data from outside India in connection with offering goods or services in India. 2. Data Inventory and Data Flow Mapping Documenting what digital personal data is collected, from whom, through which channels, where it is stored, who can access it and which third parties receive it. 3. Notice and Consent Review Checking that: Notices are clear, in plain language and itemise the personal data and the specific purpose Consent is free, specific, informed, unconditional and unambiguous, with a clear affirmative action Withdrawing consent is as easy as giving it Notices and consent mechanisms are available in English and the languages listed in the Eighth Schedule where required Legacy consents collected before the Act are handled correctly 4. Legitimate Uses Verifying that any processing relying on “certain legitimate uses” (for example, compliance with law, employment purposes, medical emergencies or voluntarily provided data) genuinely fits within those statutory grounds. 5. Purpose Limitation, Data Minimisation and Retention Reviewing whether you collect only what is necessary, use it only for the stated purpose, and erase it once the purpose is served or consent is withdrawn, unless retention is legally required. This includes retention schedules and deletion workflows. 6. Data Principal Rights Testing your ability to handle requests for access, correction, completion, updating, erasure, grievance redressal and nomination, within prescribed timelines, through a published and working channel. 7. Children’s and Persons with Disability Data Assessing verifiable parental or guardian consent mechanisms, and compliance with the prohibition on tracking, behavioural monitoring and targeted advertising directed at children, subject to the exemptions provided in the Rules. 8. Reasonable Security Safeguards Evaluating technical and organisational measures such as encryption, access controls, logging and monitoring, backup, business continuity, secure

India is one of the world’s largest hubs for IT services, SaaS, BPO, fintech, e-commerce and outsourcing. Much of that business involves the personal data of people in Europe. That makes one question urgent for thousands of Indian companies: does the EU General Data Protection Regulation (GDPR) apply to us, even though we are based in India? For most businesses serving European customers or processing European data, the answer is yes. At the same time, India has its own law, the Digital Personal Data Protection Act, 2023 (DPDP Act), now supported by the DPDP Rules, 2025. Indian businesses must therefore manage two regimes at once. Sam O Martin LLP is a data protection law firm in India that provides GDPR compliance services at a national level, helping organizations in Delhi, Mumbai, Bengaluru, Hyderabad, Chennai, Pune, Kolkata, Patna and every other business centre across the country build compliance programs that satisfy both European and Indian law. This guide explains how GDPR works for Indian companies, where it overlaps with the DPDP Act, and what steps to take. What Is the GDPR? The General Data Protection Regulation (EU) 2016/679 is the European Union’s data protection law, in force since May 2018. It regulates how personal data of individuals in the European Economic Area (EEA) is collected, used, stored, shared and deleted. The UK has a near-identical regime in the UK GDPR and the Data Protection Act 2018. The GDPR is built on core principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. Non-compliance can lead to administrative fines of up to €20 million or 4% of total worldwide annual turnover, whichever is higher, along with orders to stop processing, compensation claims from individuals, and serious reputational damage. Does the GDPR Apply to Companies in India? Yes, it can. Article 3 of the GDPR gives it extraterritorial reach. It applies to an Indian organization where: It offers goods or services to individuals in the EU/EEA, whether or not payment is involved. A website targeting European users, pricing in euros, or European-language content are typical indicators. It monitors the behaviour of individuals in the EU/EEA, for example through tracking cookies, analytics, profiling or behavioural advertising. It processes personal data on behalf of a controller established in the EU/EEA. This is the situation of most Indian IT, BPO, KPO, SaaS, cloud and support providers, who act as data processors for European clients. Even if the GDPR does not apply directly, European clients will almost always flow its obligations down to you contractually through Data Processing Agreements (DPAs) and Standard Contractual Clauses (SCCs). In practice, GDPR compliance has become a condition of doing business with Europe. Indian Sectors Most Exposed to the GDPR IT services, software development and outsourcing companies SaaS, cloud and AI companies with European users BPO, KPO and call centre operators E-commerce and D2C brands that ship to or market in Europe Fintech, insurtech and payment companies Healthcare, pharma, clinical research and medical tourism providers EdTech platforms with international learners Travel, hospitality and mobility businesses Startups preparing for European expansion or funding rounds The DPDP Act, 2023 and the DPDP Rules, 2025: India’s Own Data Protection Law India’s Digital Personal Data Protection Act, 2023 received Presidential assent in August 2023. In November 2025, the Ministry of Electronics and Information Technology notified the Digital Personal Data Protection Rules, 2025, which put the Act into operation through a phased rollout: Immediately: the Data Protection Board of India and the framework provisions came into effect. After about 12 months: the consent manager framework begins. After about 18 months (around mid-May 2027): the main obligations become enforceable, including notice and consent requirements, security safeguards, breach notification, children’s data protections, data principal rights, and Significant Data Fiduciary duties. Penalties under the DPDP Act can reach ₹250 crore for certain violations, such as failure to maintain reasonable security safeguards. The window before full enforcement is shorter than it looks, and businesses that start now will be far better positioned. Timelines and thresholds under the DPDP framework can be refined by further government notifications, so businesses should confirm the current position with legal counsel before relying on any date. GDPR vs DPDP Act: Key Differences Indian Businesses Must Understand Many organizations assume that complying with one law automatically satisfies the other. It does not. Here is how they compare: Area GDPR DPDP Act, 2023 Scope of data Personal data of individuals in the EU/EEA, in any form Digital personal data, and non-digital data that is later digitised Special categories Stricter rules for sensitive data (health, biometric, religion, etc.) No separate sensitive-data category Legal bases Six: consent, contract, legal obligation, vital interests, public task, legitimate interests Consent and a list of “legitimate uses” Terminology Controller / Processor / Data Subject Data Fiduciary / Data Processor / Data Principal DPO requirement Mandatory in specified cases Required for Significant Data Fiduciaries (India-based) Breach notification To regulator within 72 hours where risk exists To the Data Protection Board and affected individuals Data transfers Adequacy, SCCs, BCRs Permitted generally, subject to government restrictions Maximum penalty €20M or 4% of global turnover Up to ₹250 crore Regulator EU Data Protection Authorities Data Protection Board of India The practical takeaway: GDPR is generally broader and more prescriptive, but the DPDP Act contains Indian-specific obligations (for example, verifiable parental consent for children’s data and the consent manager ecosystem) that a GDPR-only program will not cover. A unified compliance framework is the most efficient approach. Core GDPR Compliance Requirements for Indian Companies 1. Data Mapping and Records of Processing Activities (ROPA) Know what personal data you hold, why you hold it, where it sits, who can access it, and where it travels. Article 30 requires documented records for most organizations. 2. Lawful Basis and Valid Consent Every processing activity needs a lawful basis. Where you rely on consent, it must be freely given, specific, informed and unambiguous, and as easy to withdraw as to give. 3. Privacy Notices and Transparency

The Supreme Court’s recent concern over minors on social media highlights the urgent need for DPDP compliance The increasing use of social media, educational platforms, healthcare applications, gaming platforms and other digital services by children has brought privacy and protection of children’s personal data into sharp focus. Recent proceedings before the Supreme Court concerning the ability of minors to open social-media accounts have highlighted an important question: Are digital platforms doing enough to ensure that children’s personal data is processed in accordance with Indian law? The discussion has also brought the Digital Personal Data Protection Act, 2023 (DPDP Act) into greater public attention. Special protection for children The DPDP Act recognises that children require a higher level of protection. Section 9 places specific obligations on organisations processing the personal data of children, including requirements relating to verifiable parental consent and restrictions on certain forms of processing. The Digital Personal Data Protection Rules, 2025 provide further details on how parental or guardian consent is to be verified. The Rules contemplate mechanisms through which a Data Fiduciary can establish that consent has been provided by the child’s parent or legal guardian. This is particularly important for organisations whose websites or applications are regularly accessed by children, including: Social-media and digital-content platforms Educational and EdTech platforms Healthcare and childcare organisations Gaming and entertainment platforms E-commerce and consumer applications Financial and insurance platforms Organisations operating websites or applications that collect personal information from users DPDP compliance is not merely a privacy-policy exercise The DPDP framework requires organisations to look beyond simply publishing a privacy policy. A responsible organisation should examine what personal data it collects, why it collects it, how consent is obtained, how consent is recorded, where the data is stored, who can access it, how long it is retained and what happens when the individual exercises his or her rights. For children, the organisation must additionally consider whether the user is a child and, where applicable, whether verifiable parental consent has been obtained before processing the child’s personal data. The 2025 Rules also provide for specified exemptions for certain organisations and activities, including certain healthcare, educational and childcare-related processing, subject to the conditions prescribed in the Rules. Why organisations should act now The Government notified the Digital Personal Data Protection Rules, 2025 on 14 November 2025. The Rules prescribe a phased commencement framework, giving organisations time to establish the systems and processes required for compliance. This transition period should not be viewed as a reason to postpone compliance. Implementing data protection within an organisation can require changes to: People + Processes + Technology + Contracts + Documentation + Governance Organisations should therefore consider undertaking a DPDP readiness assessment or audit and prepare a practical compliance roadmap. What organisations should consider implementing A practical DPDP compliance programme may include: Personal Data Mapping – identifying what personal data is collected and where it moves. Data Inventory – identifying categories of personal data and the purposes for processing. Consent Management – creating appropriate mechanisms for obtaining, recording and withdrawing consent. Children’s Data Controls – identifying child users and implementing appropriate parental-consent mechanisms. Privacy Notices – ensuring that notices are clear, accessible and legally compliant. Data Retention & Deletion – establishing appropriate retention periods and deletion procedures. Data Security Measures – implementing reasonable safeguards against unauthorised access, breaches and misuse. Data Principal Rights – establishing procedures for receiving and responding to requests from individuals. Vendor and Contract Management – reviewing arrangements with processors, technology providers and other third parties. Incident and Breach Response – establishing a documented procedure for responding to personal-data breaches. Employee Awareness and Training – ensuring that employees understand their responsibilities in handling personal data. Documentation and Governance – maintaining evidence that the organisation has actually implemented its DPDP compliance programme. The larger message The debate surrounding children and social-media accounts demonstrates that data protection is no longer only an IT issue. It is increasingly a matter of corporate governance, legal compliance, technology, risk management and consumer trust. Every organisation that collects or processes digital personal data should therefore ask a basic question: If our data-processing practices were examined today, could we demonstrate that we are complying with the DPDP framework? The answer should not depend upon waiting for a complaint, data breach, regulatory action or court intervention. DPDP compliance should be treated as an ongoing organisational process—not as a one-time exercise. Organisations that start by understanding their data, identifying compliance gaps and implementing practical procedures can build a stronger foundation for responsible and lawful processing of personal data. This article is intended for general awareness and does not constitute legal advice. The applicability of particular DPDP obligations depends on the nature of the organisation, its processing activities and the applicable provisions and commencement dates.

India’s data protection landscape has moved from legislative preparation to implementation. The Digital Personal Data Protection Act, 2023 (DPDP Act) was enacted to regulate the processing of digital personal data, and the Digital Personal Data Protection Rules, 2025 were notified on 14 November 2025. The Rules introduced a phased implementation framework, making 2026 an important year for businesses to assess and strengthen their data protection practices. For businesses, DPDP compliance should not be viewed simply as preparing a privacy policy or adding a consent checkbox to a website. It requires organizations to understand what personal data they process, why they process it, how it moves through the organization, who has access to it, how it is protected, and how individuals can exercise their statutory rights. This guide explains a practical step-by-step approach that businesses in India can follow to build a stronger DPDP compliance framework in 2026. Step 1: Determine Whether the DPDP Act Applies to Your Business The first step is to understand whether your organization processes digital personal data that falls within the scope of the DPDP Act. This assessment should cover customer information, employee records, user accounts, marketing databases, website data, application data, vendor information, and other personal information processed digitally. Businesses should also identify whether personal data is collected digitally or is collected in non-digital form and subsequently digitised. Understanding the scope of processing is the foundation of an effective compliance programme. Step 2: Map the Personal Data You Process Once applicability has been established, the next step is to create a clear picture of the organization’s personal-data ecosystem. A business should identify what personal data it collects, from whom it is collected, the purpose for which it is processed, where it is stored, who can access it, which vendors or processors receive it, and when it is deleted. This process is commonly referred to as data mapping. A properly maintained data inventory can help identify unnecessary collection, excessive access, inappropriate retention, third-party risks, and potential compliance gaps. Step 3: Review Your Notice and Consent Mechanisms The DPDP framework places significant importance on transparency and informed consent where consent is the applicable basis for processing. The 2025 Rules require notices to be clear, standalone, and understandable, including an itemised description of the personal data being processed and the specific purpose or purposes of processing. The Rules also contemplate mechanisms through which Data Principals can withdraw consent and exercise their rights. Businesses should therefore review their website privacy notices, application notices, registration processes, consent forms, employee documentation, and other data-collection interfaces. A consent mechanism should not merely obtain a user’s agreement; it should support transparency, appropriate record-keeping, and meaningful withdrawal where consent is relied upon. Step 4: Establish Data Principal Rights Processes DPDP compliance also requires organizations to establish practical mechanisms for responding to Data Principal requests and grievances. Businesses should determine who will receive such requests, how the identity of the requester will be verified, which internal team will process the request, how the response will be documented, and how unresolved matters will be escalated. These procedures should be incorporated into internal workflows rather than being treated as an informal customer-service function. Step 5: Review Your Data Security Measures Legal compliance and information security are closely connected. Organizations should assess the technical and organizational safeguards used to protect personal data against unauthorized access, disclosure, alteration, loss, or other security incidents. The review should consider access controls, authentication mechanisms, encryption, employee access, vendor security, backups, incident management, data storage, and internal security procedures. The objective is to ensure that security measures are proportionate to the nature of the personal data and the risks associated with its processing. Step 6: Strengthen Vendor and Third-Party Contracts Many organizations do not process personal data entirely within their own systems. Cloud providers, SaaS platforms, payroll providers, marketing agencies, technology vendors, consultants, and other service providers may process personal data on behalf of a business. Businesses should therefore review their third-party arrangements and ensure that contracts appropriately address data-processing responsibilities, confidentiality, security, breach management, data deletion, and other applicable obligations. Third-party compliance should form part of the organization’s broader data-governance framework. Step 7: Establish a Personal Data Breach Response Framework A business should not wait for a data breach before deciding how it will respond. Organizations should establish an internal incident-response framework identifying who must be informed, how an incident will be assessed, how affected systems will be secured, what records must be maintained, and what regulatory or communication obligations may arise. The DPDP Rules, 2025 prescribe requirements concerning personal data breach notifications and related information. A documented response framework can significantly improve an organization’s ability to respond quickly and consistently when an incident occurs. Step 8: Review Data Retention and Deletion Practices Businesses frequently retain personal data simply because there is no defined process for deleting it. A DPDP compliance review should therefore examine whether personal data continues to be necessary for the purpose for which it was collected and whether applicable legal or business requirements justify continued retention. Organizations should establish appropriate retention schedules and deletion or anonymisation procedures wherever applicable. Effective retention governance can reduce both privacy risk and the volume of data exposed during a security incident. Step 9: Assess Whether Additional Governance Measures Are Required Organizations should assess whether their scale, nature of processing, or regulatory classification creates additional compliance responsibilities. Businesses should also monitor regulatory developments, notifications, directions, and implementation requirements issued under the DPDP framework. The notified Rules establish a phased commencement timeline, with different provisions becoming operative at different stages. Therefore, businesses should assess their compliance roadmap against the applicable commencement dates rather than assuming that every provision becomes operational simultaneously. Step 10: Conduct a DPDP Compliance Audit Finally, organizations should conduct a structured DPDP compliance gap analysis or audit. The assessment should examine the organization’s data inventory, privacy notices, consent mechanisms, rights-management procedures, security safeguards, vendor contracts, retention practices, breach-response mechanisms, governance structures, and documentation. The purpose of an audit is not

In an era of tightening privacy regulations and rising enforcement actions, businesses can no longer afford to guess whether their data handling practices are compliant. A data protection gap analysis is the most effective way to answer that question with certainty — and to build a defensible, audit-ready compliance program. This guide explains what a data protection gap analysis involves, why every organization handling personal data needs one, and how to get started. What Is a Data Protection Gap Analysis? A data protection gap analysis is a systematic assessment that compares your organization’s existing data handling practices, policies, and controls against applicable legal and regulatory requirements — such as the GDPR, UK Data Protection Act, CCPA/CPRA, or other regional privacy laws. The purpose is to identify: Where your current practices fall short of legal obligations What risks those shortfalls create (financial, legal, reputational) What steps are needed to close the gaps Unlike a general compliance checklist, a proper gap analysis is tailored to your organization’s actual data flows, industry, and jurisdictional exposure. Why Every Business Needs a Data Protection Gap Analysis 1. Regulatory Fines Are Increasing Data protection authorities worldwide are issuing larger and more frequent fines. A gap analysis helps you identify and fix vulnerabilities before they trigger regulatory investigations or penalties. 2. Data Privacy Laws Are Multiplying Businesses today may be subject to overlapping frameworks — GDPR, UK GDPR, CCPA, LGPD, PIPEDA, and more. A gap analysis clarifies exactly which obligations apply to your organization and where you currently stand against each one. 3. Data Breaches Are Costly Beyond regulatory fines, data breaches carry reputational damage, litigation risk, and loss of customer trust. Identifying weak data security and governance practices early significantly reduces breach risk. 4. Investors and Partners Expect Compliance Due diligence processes for funding rounds, partnerships, and acquisitions increasingly include data protection compliance reviews. A documented gap analysis demonstrates operational maturity and reduces deal friction. 5. It Builds a Defensible Compliance Position If a regulator or claimant ever questions your data practices, having a documented gap analysis and remediation plan shows a good-faith, proactive approach to compliance — a factor regulators often consider favorably. Why Every Business Needs a Data Protection Gap Analysis A comprehensive review typically assesses: Data inventory and mapping — what personal data you collect, where it’s stored, and how it flows internally and externally Legal basis for processing — consent, contract, legitimate interest, and other lawful grounds Privacy notices and policies — accuracy, transparency, and accessibility Data subject rights procedures — access, correction, deletion, and portability requests Third-party vendor management — data processing agreements and subprocessor oversight Data security controls — encryption, access controls, and incident response readiness Cross-border data transfer mechanisms — standard contractual clauses, adequacy decisions, and transfer risk assessments Records of processing activities (ROPA) Data retention and deletion practices Breach notification protocols The Data Protection Gap Analysis Process Step 1: Scoping Define which regulations apply based on your industry, data types, and jurisdictions of operation. Step 2: Data Mapping Document what personal data exists, where it lives, who accesses it, and how it moves through your organization and third parties. Step 3: Compliance Benchmarking Compare current practices against specific legal requirements, identifying gaps clause by clause. Step 4: Risk Scoring Rank identified gaps by severity, likelihood of enforcement, and potential business impact. Step 5: Remediation Planning Develop a prioritized action plan — updated policies, new procedures, staff training, and technical controls. Step 6: Implementation and Monitoring Put fixes into practice and establish ongoing monitoring to maintain compliance as laws and business practices evolve. Common Gaps Identified in Data Protection Audits Organizations across industries frequently discover: Outdated privacy policies that don’t reflect current data practices Missing or informal data processing agreements with vendors No formal process for handling data subject access requests Incomplete or nonexistent records of processing activities Weak or undocumented breach response procedures Unclear legal basis for marketing or analytics data processing Insufficient data retention and deletion policies Identifying these gaps early prevents them from escalating into regulatory violations or breach liabilities. How Sam O Martin Law Firm Can Help Sam O Martin Law Firm provides comprehensive data protection gap analysis services tailored to your industry and regulatory footprint. Our legal team combines regulatory expertise with practical business insight to help you: Understand exactly where your compliance gaps lie Prioritize fixes based on real legal risk Build sustainable, audit-ready data governance frameworks Navigate multi-jurisdictional privacy obligations with confidence Whether you’re conducting your first compliance review or reassessing your data protection posture after a regulatory change, our team is here to guide you through every step.

Data protection compliance is no longer optional — it’s a legal necessity. For businesses handling personal data of EU residents (or UK residents under the UK GDPR), a GDPR gap analysis is the foundational first step toward full compliance. At Sam O Martin Law Firm, we help organizations of all sizes identify compliance gaps, mitigate legal risk, and build data protection frameworks that stand up to regulatory scrutiny. In this article, we break down what a GDPR gap analysis is, why it matters, and how our legal team can support your business through every stage of the process. What Is a GDPR Gap Analysis? A GDPR gap analysis is a structured review that compares your organization’s current data protection practices against the requirements set out in the General Data Protection Regulation (GDPR). The goal is simple: identify the “gaps” between where your business currently stands and where it needs to be to achieve full GDPR compliance. This process typically examines: How personal data is collected, stored, and processed Legal bases for processing (consent, legitimate interest, contract, etc.) Data subject rights procedures (access, erasure, portability) Data breach response protocols Third-party data processing agreements and vendor contracts Records of Processing Activities (ROPA) Data Protection Impact Assessments (DPIAs) International data transfer mechanisms A thorough gap analysis doesn’t just flag problems — it produces a clear, prioritized roadmap for remediation. Why a GDPR Gap Analysis Matters 1. Avoid Costly Regulatory Fines Non-compliance with GDPR can result in fines of up to €20 million or 4% of global annual turnover, whichever is higher. A proactive gap analysis identifies vulnerabilities before regulators do, significantly reducing your exposure to enforcement action. 2. Build Customer and Partner Trust Data protection compliance signals to clients, partners, and investors that your business takes privacy seriously. In competitive markets, demonstrable GDPR compliance can be a genuine differentiator. 3. Reduce Data Breach Risk Many data breaches stem from poor internal processes rather than sophisticated cyberattacks. A gap analysis uncovers weak points in data handling procedures that could otherwise go unnoticed until it’s too late. 4. Prepare for Audits and Due Diligence Whether you’re facing a regulatory audit or preparing for investment, mergers, or acquisitions, having documented evidence of GDPR compliance efforts — including a completed gap analysis — strengthens your position. Who Needs a GDPR Gap Analysis? If your organization processes personal data of individuals in the EU or UK, you likely need a GDPR gap analysis, regardless of your location. This includes: SMEs and startups scaling into European markets E-commerce and SaaS companies handling customer data Healthcare providers managing sensitive personal data Financial services firms subject to strict data governance rules Any organization that has never conducted a formal data protection audit Even businesses that believe they are compliant often discover meaningful gaps once a formal review is conducted. How Sam O Martin Law Firm Approaches GDPR Gap Analysis Our data protection team follows a structured, legally rigorous methodology designed to give clients clarity and confidence: Step 1: Data Mapping We identify what personal data your organization collects, where it is stored, who has access to it, and how it flows through your systems and third parties. Step 2: Compliance Assessment We benchmark your current policies, contracts, and procedures against GDPR requirements, highlighting specific articles and obligations that are not being met. Step 3: Risk Prioritization Not all gaps carry equal risk. We categorize findings by severity and likelihood of enforcement action, so you can address the most pressing issues first. Step 4: Remediation Roadmap We deliver a practical, actionable compliance plan — including policy templates, consent mechanisms, breach response procedures, and staff training recommendations. Step 5: Ongoing Support GDPR compliance isn’t a one-time project. We offer ongoing legal advisory support to help your business adapt to regulatory changes and evolving data practices. Common Gaps We Find During GDPR Audits Through years of conducting gap analyses, our team frequently identifies: Outdated or missing privacy policies Inadequate consent collection mechanisms Missing or incomplete Records of Processing Activities Absence of a formal Data Protection Officer (DPO) where required Unsecured or non-compliant international data transfers Weak vendor and third-party data processing agreements No documented data breach response plan Addressing these issues early prevents them from becoming costly liabilities later. Get Started With a GDPR Gap Analysis Today Data protection compliance is complex, but you don’t have to navigate it alone. Sam O Martin Law Firm combines deep regulatory expertise with practical, business-focused legal guidance to help you close compliance gaps efficiently and effectively. Whether you’re conducting your first GDPR audit or reassessing compliance after a policy change, our legal team is ready to help you protect your business, your customers, and your reputation. Contact Sam O Martin Law Firm today to schedule your GDPR gap analysis consultation.

The Digital Personal Data Protection Act, 2023 (DPDP Act) establishes a rights-based framework for protecting the digital personal data of individuals in India. One of the key pillars of this framework is the Consent Manager, an independent entity that enables Data Principals to give, manage, review, and withdraw consent for the processing of their personal data. While the First Schedule – Part A of the Draft Digital Personal Data Protection Rules, 2025 prescribes the eligibility conditions for registration as a Consent Manager, Part B of the First Schedule lays down the obligations that every registered Consent Manager must continuously fulfil. These obligations are designed to ensure that Consent Managers operate with transparency, integrity, independence, security, and accountability. They also ensure that Data Principals remain in complete control of their personal data while using a Consent Management Platform. This article explains each obligation prescribed under Part B of the First Schedule in detail. What is the Role of a Consent Manager? A Consent Manager is a registered entity that provides an interoperable platform through which a Data Principal can: Give consent for processing personal data. Review previously given consent. Manage consent preferences. Withdraw consent at any time. Monitor how personal data is shared with Data Fiduciaries. The Consent Manager acts as a trusted intermediary and must always operate in the best interests of the Data Principal. Obligations of a Consent Manager 1. Enable Data Principals to Give Consent through its Platform The Rules provide: “The Consent Manager shall enable a Data Principal using its platform to give consent to the processing of her personal data by a Data Fiduciary onboarded onto such platform either directly to such Data Fiduciary or through another Data Fiduciary onboarded onto such platform, who maintains such personal data with the consent of that Data Principal.” A Consent Manager must provide a platform that allows individuals to provide consent digitally and conveniently. Consent may be given: Directly to the Data Fiduciary requesting the information, or Through another onboarded Data Fiduciary that already holds the individual’s personal data. This enables secure and interoperable sharing of personal data without requiring the Data Principal to repeatedly provide the same information. Illustration provided in the Rules The Rules explain this concept using the example of a Consent Management platform P, where an individual X is registered and two banks (B1 and B2) are onboarded. Case 1:B1 requests X’s consent to access her bank account statement. X stores her statement in a Digital Locker and, using platform P, directly grants consent to B1, which then receives access to the statement. Case 2:B1 again requests access to X’s bank account statement. However, this time the statement is maintained by B2. Using platform P, X routes her consent through B2 and digitally instructs B2 to share the bank account statement with B1. B2 then securely transfers the information to B1. This illustration demonstrates how a Consent Manager enables secure, interoperable and user-controlled sharing of personal data across multiple Data Fiduciaries. 2. Personal Data Must Not Be Readable by the Consent Manager The Rules provide: “The Consent Manager shall ensure that the manner of making available the personal data or its sharing is such that the contents thereof are not readable by it.” A Consent Manager facilitates the transfer of consent—not the processing of personal data. Accordingly, the platform should be designed so that although it enables the sharing of data, the actual contents of the personal data remain inaccessible to the Consent Manager. This principle significantly enhances privacy and ensures that the Consent Manager remains a neutral facilitator rather than becoming another processor of personal information. 3. Maintain Complete Consent Records The Rules require the Consent Manager to maintain records of: Consents given. Consents denied. Consents withdrawn. Notices preceding or accompanying consent requests. Sharing of personal data with transferee Data Fiduciaries. Maintaining accurate records creates transparency and allows Data Principals to verify how and when their consent has been used. 4. Provide Access to Consent Records The Rules further provide that the Consent Manager: Shall give the Data Principal access to these records. Shall make such information available in a machine-readable format whenever requested and in accordance with its terms of service. Shall preserve these records for at least seven years, or for a longer period if agreed upon with the Data Principal or required by law. This obligation promotes transparency and allows individuals to maintain a complete history of their consent decisions. 5. Maintain a Website or Mobile Application The Rules provide: “The Consent Manager shall develop and maintain a website or app, or both, as the primary means through which a Data Principal may access the services provided by the Consent Manager.” Every Consent Manager must maintain an easily accessible digital platform. The website or mobile application should enable users to: Register securely. View consent requests. Give or refuse consent. Withdraw existing consent. Review consent history. Access records maintained by the Consent Manager. The platform should be user-friendly, secure, and continuously available. 6. No Outsourcing of Statutory Obligations The Rules provide: “The Consent Manager shall not sub-contract or assign the performance of any of its obligations under the Act and these rules.” The legal responsibilities assigned to a Consent Manager cannot be delegated to another organization. This requirement ensures accountability by preventing the transfer of core statutory functions to third parties. 7. Implement Reasonable Security Safeguards The Rules provide: “The Consent Manager shall take reasonable security safeguards to prevent personal data breach.” Appropriate technical and organisational measures should be implemented to protect personal data against unauthorized access, disclosure, alteration, or destruction. Such safeguards may include: Encryption Access controls Multi-factor authentication Security monitoring Incident response procedures Secure infrastructure Regular vulnerability assessments Strong cybersecurity is essential for maintaining public confidence in the Consent Management ecosystem. 8. Act in a Fiduciary Capacity The Rules provide: “The Consent Manager shall act in a fiduciary capacity in relation to the Data Principal.” A fiduciary relationship requires the Consent Manager to act honestly, fairly, and solely in

The Digital Personal Data Protection Act, 2023 (DPDP Act) introduces a new framework for protecting the digital personal data of individuals in India. One of the most significant features of this framework is the concept of a Consent Manager—an entity that enables individuals (Data Principals) to give, manage, review, and withdraw their consent for the processing of their personal data through an accessible, transparent, and interoperable platform. To operationalise this framework, the Draft Digital Personal Data Protection Rules, 2025 prescribe detailed conditions that an entity must satisfy before it can be registered as a Consent Manager. These conditions are set out in Part A of the First Schedule of the Draft Rules. They establish minimum standards relating to legal status, financial capacity, governance, technical capability, integrity, and operational readiness. The objective is to ensure that only competent, reliable, and accountable organizations are entrusted with managing the consent of Data Principals. This article explains each condition prescribed under Part A of the First Schedule in detail. What is a Consent Manager? A Consent Manager is an independent entity registered under the DPDP framework that acts as a trusted intermediary between a Data Principal and a Data Fiduciary. Its primary role is to provide a secure and interoperable platform through which individuals can: Give consent for processing their personal data. Review the consent they have already provided. Modify or manage existing consent preferences. Withdraw consent at any time. Maintain greater control over how their personal data is processed. A Consent Manager is expected to operate independently, transparently, and in the best interests of the Data Principal. Conditions for Registration of a Consent Manager The First Schedule – Part A of the Draft DPDP Rules, 2025 lays down the eligibility requirements for registration. 1. The Applicant Must Be a Company Incorporated in India The Rules provide: “The applicant is a company incorporated in India.” Only a company incorporated under the applicable laws of India is eligible to apply for registration as a Consent Manager. This requirement ensures that the entity is subject to Indian corporate laws, regulatory oversight, and legal accountability. Partnerships, sole proprietorships, trusts, or other forms of business organisations are not eligible unless they are incorporated as a company. 2. The Applicant Must Have Sufficient Technical, Operational and Financial Capacity The Rules provide: “The applicant has sufficient capacity, including technical, operational and financial capacity, to fulfil its obligations as a Consent Manager.” A Consent Manager is expected to manage sensitive personal data and provide continuous digital services. Therefore, the applicant must demonstrate adequate resources to discharge its statutory responsibilities effectively. This includes: Appropriate technological infrastructure. Reliable operational processes. Skilled human resources. Adequate financial resources. Business continuity mechanisms. Information security capabilities. The objective is to ensure that the Consent Manager can provide uninterrupted, secure, and efficient services to Data Principals. 3. The Financial Condition and General Character of Management Must Be Sound The Rules provide: “The financial condition and the general character of management of the applicant are sound.” The Government intends to register only organizations that demonstrate financial stability and responsible corporate governance. This assessment may include: Financial health of the company. Corporate governance practices. Regulatory compliance history. Reputation in the market. Quality of internal management. Overall business stability. A financially stable organization is more likely to maintain secure systems and provide long-term compliance support. 4. Minimum Net Worth Requirement of ₹2 Crore The Rules provide: “The net worth of the applicant is not less than two crore rupees.” Every applicant must possess a minimum net worth of ₹2 crore. This financial threshold demonstrates that the organization possesses sufficient capital to establish and maintain the technical infrastructure, cybersecurity measures, compliance framework, and operational capabilities necessary for performing the functions of a Consent Manager. The minimum net worth requirement also serves as a safeguard against undercapitalised entities entering a highly sensitive regulatory ecosystem. 5. Adequate Business Prospects and Capital Structure The Rules provide: “The volume of business likely to be available to and the capital structure and earning prospects of the applicant are adequate.” Registration is not based solely on existing financial strength. The authorities may also evaluate: Expected business volume. Sustainability of operations. Capital structure. Revenue model. Long-term financial viability. Future earning prospects. The objective is to ensure that the applicant can continue operating effectively while meeting ongoing compliance obligations. 6. Directors and Senior Management Must Have Integrity The Rules provide: “The directors, key managerial personnel and senior management of the applicant company are individuals with a general reputation and record of fairness and integrity.” Leadership plays a critical role in protecting personal data. Accordingly, the individuals responsible for managing the company should possess: Professional competence. Ethical conduct. Integrity. Fairness. Good corporate reputation. Responsible management practices. This requirement helps promote public trust in the Consent Management ecosystem. 7. Constitutional Documents Must Incorporate Compliance Obligations The Rules provide: “The memorandum of association and articles of association of the applicant company contain provisions requiring that the obligations under items 9 and 10 of Part B are adhered to, that policies and procedures are in place to ensure such adherence, and that such provisions may be amended only with the previous approval of the Board.” This is one of the most important governance requirements under the Rules. The applicant’s Memorandum of Association (MoA) and Articles of Association (AoA) must specifically provide that: The obligations contained in Items 9 and 10 of Part B will be complied with. Appropriate internal policies and procedures exist to ensure compliance. These constitutional provisions cannot be amended without obtaining prior approval from the Board. Embedding these obligations within the company’s constitutional documents demonstrates a long-term institutional commitment to compliance and accountability. 8. Operations Must Be in the Interests of Data Principals The Rules provide: “The operations proposed to be undertaken by the applicant are in the interests of Data Principals.” Every activity undertaken by a Consent Manager should prioritize the interests of the Data Principal. The platform should therefore be designed to: Promote transparency. Enable informed decision-making. Provide