Privacy by Design for Product Teams: Build Before Legal Cleans Up
A product-development control that embeds purpose, minimisation, safe defaults, user choice, access, retention and incident evidence before launch.
Legal cannot repair an architecture that collects unnecessary data, gives broad access and has no deletion path after the product is live.
The DPDP framework is phased. The 14 November 2025 commencement notification brought specified institutional and enabling provisions into force immediately; Consent Manager-related provisions follow after one year; most operating duties and Rules follow eighteen months after Gazette publication. As of 22 June 2026, the control should distinguish current obligations from future-state DPDP readiness.
Privacy by design is not separately named as a universal certification duty in the Act, but it supports notice, consent, safeguards, purpose and rights compliance.
Product requirements should include data fields, purpose, user control, retention, processor use and deletion acceptance criteria.
Default settings should favour the core service rather than maximum tracking or sharing.
What the organisation should understand
- The DPDP framework is phased. The 14 November 2025 commencement notification brought specified institutional and enabling provisions into force immediately; Consent Manager-related provisions follow after one year; most operating duties and Rules follow eighteen months after Gazette publication. As of 22 June 2026, the control should distinguish current obligations from future-state DPDP readiness.
- Privacy by design is not separately named as a universal certification duty in the Act, but it supports notice, consent, safeguards, purpose and rights compliance.
- Product requirements should include data fields, purpose, user control, retention, processor use and deletion acceptance criteria.
- Default settings should favour the core service rather than maximum tracking or sharing.
- Engineering logs, test data and support tools should receive the same design attention as production databases.
The five-point review
| Check | What to examine |
|---|---|
| Feature | What user problem is solved. |
| Data | Fields, inferences and optionality. |
| Default | Collection, visibility, sharing and retention. |
| Control | Withdrawal, correction, deletion and access. |
| Failure | Breach, misuse, vendor outage and rollback. |
Practical example
A team launches a referral feature that uploads a user’s entire contact list though only one selected number is needed. A privacy-by-design review would replace bulk upload with user-selected entry.
How to apply the framework
Add privacy acceptance criteria to product tickets and architecture reviews. Require explanation for every new field and SDK.
Review data after launch. A field that was necessary for onboarding may become unnecessary once verification is complete.
Operating workflow
Define the real process before selecting the legal label
Identify the people, data, systems, purpose, owner, processor, user journey and failure scenario. Review feature, data and default together. A policy statement or vendor assurance cannot replace evidence of how the live product behaves.
Separate current obligations from scheduled DPDP controls
Apply the 14 November 2025 commencement notification provision by provision. Continue complying with currently operative CERT-In, banking, telecom, insurance, employment, consumer, contract and criminal-law requirements. Build the scheduled DPDP workflow now, but do not describe a future provision as already enforceable.
Test and preserve evidence
Run the workflow in the live or controlled test environment. Preserve screenshots, approvals, logs, vendor responses, user communications, exceptions and remediation. Assign a named owner and completion date to every failed control so management can distinguish an operating safeguard from a policy intention.
Action checklist
- Add privacy questions to product discovery.
- Minimise fields and permissions.
- Use safe defaults.
- Design user controls.
- Plan deletion and export.
- Test misuse and incident scenarios.
Evidence to keep
- Product requirement document
- Data-field decision log
- Architecture review
- Permission and default tests
- Launch approval and post-launch review
Warning signs
- Privacy review after code freeze
- Default public sharing
- No deletion API
- Test data copied from production
- New SDK with no owner
Finin2min takeaway
Privacy and cyber maturity are visible in operating behaviour: what the organisation collects, who can use it, how vendors are controlled, how users exercise choices, how incidents are handled and whether evidence survives scrutiny.