DPDP Board Pack: What Management Should Review Quarterly
A quarterly dashboard for phased DPDP readiness, data inventory, notices, rights, children, vendors, security, incidents and retention.
A board should not receive a green compliance slide based only on a privacy policy and one penetration test.
The DPDP framework is phased. The 14 November 2025 commencement notification brought specified institutional and enabling provisions into force immediately; section 6(9), section 27(1)(d) and rule 4 follow after one year; most operating duties and rules follow eighteen months after Gazette publication. As of 22 June 2026, readiness should distinguish current law from future-state DPDP controls.
The Data Protection Board is established, while most operating obligations remain on phased commencement as of June 2026.
Management oversight should distinguish legal readiness, current sector compliance, security posture and incident status.
Metrics should show coverage and exceptions: mapped systems, risky vendors, access reviews, deletion failures, rights tests and incidents.
What the organisation should understand
- The DPDP framework is phased. The 14 November 2025 commencement notification brought specified institutional and enabling provisions into force immediately; section 6(9), section 27(1)(d) and rule 4 follow after one year; most operating duties and rules follow eighteen months after Gazette publication. As of 22 June 2026, readiness should distinguish current law from future-state DPDP controls.
- The Data Protection Board is established, while most operating obligations remain on phased commencement as of June 2026.
- Management oversight should distinguish legal readiness, current sector compliance, security posture and incident status.
- Metrics should show coverage and exceptions: mapped systems, risky vendors, access reviews, deletion failures, rights tests and incidents.
- Significant Data Fiduciary obligations apply only after notification and relevant commencement; companies should prepare without self-designating.
The five-point review
| Check | What to examine |
|---|---|
| Law | Commencement and regulatory changes. |
| Data | Mapped processing and high-risk categories. |
| People | Rights, grievances and children. |
| Vendors | Critical processors and locations. |
| Security | Access, logs, backups and incidents. |
Practical example
Management receives ‘100% compliant’ because employees completed training, though there is no data map, vendor register or breach simulation. A credible pack reports those gaps with owners and dates.
How to apply the framework
Use red, amber and green only where the metric and tolerance are defined.
Include decisions required from management: budget, risk acceptance, product change, vendor exit, staffing and disclosure.
Operating workflow
Define the processing or incident precisely
Identify the people, data, system, purpose, owner, vendor and transaction or event. Review law, data and people together. Do not start from a policy template or software feature; start from what the business and system actually do.
Separate current duties from future-state DPDP readiness
Apply the 14 November 2025 commencement notification provision by provision. Continue complying with currently operative IT, CERT-In, telecom, banking, insurance, employment, consumer, contract and criminal-law requirements. Build the future DPDP process now, but do not describe a scheduled rule as already legally operative.
Preserve proof and improve the system
Keep the approved decision, notice or workflow version, access or event logs, vendor evidence, user communications and remediation record. Update product design, role access, retention, support scripts or incident playbooks so the same weakness does not recur.
Action checklist
- Maintain commencement tracker.
- Report map coverage.
- Show vendor and access status.
- Test workflows.
- Track deletion failures.
- Record decisions.
Evidence to keep
- Dashboard
- Compliance register
- Risk log
- Exercise reports
- Minutes
Warning signs
- Undefined compliance percentage
- No law timeline
- Only cyber metrics
- Vendor risk omitted
- Material incidents oral only
Finin2min takeaway
Privacy governance is an operating system, not a policy PDF. The data map, purpose, access, vendor, retention, user workflow, incident response and evidence file must all tell the same story.