Choosing where to begin

Why programmes stall before they start

The whole Act at once is too much

The compliance head of a mid-sized NBFC in Pune printed the DPDP Rules the week they were notified in November 2025. By December she had a list: notices, consent, rights requests, grievances, retention, erasure, security safeguards, breach intimation, processor contracts and record keeping. The loan app alone touched almost every item on it.

Read as a single programme, a list like that produces a familiar reaction. The work seems large enough to need a proper plan. The proper plan needs a proper assessment. The assessment needs people from technology and collections who are busy with year end. Her first instinct was to commission the full plan, and by March nothing in the business had changed. No notice had been corrected, no request process existed, and no processor contract had been reopened.

The other usual reaction is quicker: start with whatever is most visible, which is usually the privacy notice. Someone rewrites it, it goes live on the website and the app, and everybody feels that progress has been made. None of the underlying work has happened. The notice describes data flows nobody has mapped and promises rights nobody can yet deliver. If a borrower writes in asking what data the company holds on him, the answer still depends on who remembers which system to check.

Both reactions come from treating the Act as one thing. In practice it is a set of duties that land on different teams, and they can be brought under control in an order.

What the timing allows

The DPDP Rules, 2025 were notified on 13 November 2025 and come into force in phases. The definitions and the provisions on the Data Protection Board applied at once. The Consent Manager provisions follow around 13 November 2026. Most of the duties of a Data Fiduciary, including notice, security safeguards, breach intimation, erasure, the extra care needed for children's data and the duties of a Significant Data Fiduciary, apply from around 13 May 2027 as notified, unless amended. A January 2026 proposal to shorten that period was not notified; check for later amendments, and avoid planning for the last possible month.

That leaves enough time to do the work properly in phases, and not enough time to spend a year planning it. A phased programme also gives you an accurate answer when a lending partner, a bank or your own board asks where you stand.

What a phased approach avoids

Bringing everything into a platform at once means configuring the whole company before anything becomes usable. At that scale configuration takes months, the people contributing lose interest, and the early records age while the later ones are still being gathered.

Bringing in one area means the platform is doing real work within weeks. The people who contributed see something running, which makes the next request for their time easier. The second area also benefits from what the first one taught about how the company describes itself: which names people use for systems, who answers questions quickly, and where the records are thin.

The order matters less than the fact of having one. A company working through areas in a defined sequence makes visible progress and can say where it has reached. A company working on everything at the same time is busy, but cannot state its position.

The scoped assessment

What it establishes

A scoped gap assessment is a few weeks of focused work. It produces the information needed to plan properly, and it should establish five things.

Where you are today. Most organisations already have more than they think: a notice, a few processor contracts, a partial list of systems, perhaps a retention schedule written for an RBI inspection. Knowing what is usable saves you from redoing it.

Who would own each area. Ask who would be accountable for consent, for rights requests, for retention and for breach response if work started on Monday. Often there is no ready answer. Finding those gaps in ownership early is one of the most useful things the assessment does.

Where the gaps carry the most exposure. This is the distance between what the duties require and what the company does now, weighted by how much harm a failure would cause.

What the technical dependencies are. Note which systems hold the data each duty reaches, and how hard each will be to work with. A modern loan origination system with an API is a different job from a fifteen year old collections database that one vendor still supports.

A realistic order. The last output pulls the other four together into a sequence, with a first phase that has a clear scope and an end date.

None of that requires a long engagement. It requires access to the people who know how the company works, and a willingness to record plainly what is missing.

Why the assessment has to be candid

An assessment that reports you as broadly compliant with minor gaps has produced a comfortable document and no plan. The value lies in the specifics, including the uncomfortable ones:

• Which systems hold personal data that nobody owns.
• Which processors have no adequate data protection terms in their contracts.
• Whether retention rules exist, and whether anything actually enforces them.
• Whether a request from a borrower or a patient could be answered completely today.
• Whether your logs would support an investigation if a customer database leaked. Rule 6 expects logs and related data to be kept for at least one year, so it is worth checking how long yours actually last.

Answering those accurately produces a list somebody can work from. Answering them optimistically produces a plan built on a picture of the company that does not match the company, and the mismatch surfaces halfway through the work, when it is most expensive to correct.

The assessment is also the point at which a company learns how much it does not know about its own data. That figure sets the length of the first phase more than any other factor, and it is far better to establish it at the start than to discover it in the middle.

Choosing the first area

The candidates

Any of the operating areas can come first: personal data mapping, purposes and notices, consent and withdrawal, rights requests and grievances, retention and erasure, breach readiness, processor oversight, impact assessments, and evidence. Each is a defensible starting point in the right circumstances, and the right one depends on the company. A general rule or a framework's diagram will not settle it.

What usually settles it is a combination of where the exposure is greatest and where your teams are already feeling pain. An area that is causing weekly friction gets attention and gets used. An area picked because it sits first on a slide competes with everything else for the same people's time.

Which area suits which situation

You cannot say where personal data sits. Start with the inventory, because every other area depends on it. Rights requests search it, retention applies to it, breach reports describe it and notices summarise it. A retailer with stores in three states, a website, a loyalty programme and a WhatsApp ordering number often finds that the inventory alone changes how it answers every later question.

Requests are already arriving by email. A hospital that gets patients asking for copies of their records, or an edtech platform hearing from parents, should start with requests and grievances. The response periods are already running, the work is visible, and intake is where most of the time is lost. Putting requests in one place with dates, owners and a search across a known list of systems helps within weeks. Rule 14 gives at most 90 days to respond to a grievance, which sounds generous until requests sit unread in three different inboxes.

You depend on many vendors with thin contracts. Start with processor oversight. Renegotiating terms with a call centre partner, a collections agency or a cloud provider depends on the other side, and it takes calendar time that nobody can compress later.

You hold sensitive data at volume. If you hold health, financial or children's data in large volumes, or think you might be notified as a Significant Data Fiduciary, start with the inventory and move quickly to impact assessments and evidence. Those duties tend to arrive with the least warning, and the penalty ceiling for Significant Data Fiduciary duties in the Schedule is up to 150 crore rupees.

What the first phase should deliver

A working area as the deliverable

Measure the first phase by whether one area of the programme now runs properly. Running means the records for that area exist and have been confirmed by their owners, the duties in it have become assigned work with dates, exceptions are visible, and evidence builds up as the work happens.

Organisations that measure the first phase by how much of the company has been mapped tend to be disappointed, because mapping a whole company takes longer than any first phase should. Organisations that measure it by whether one area now runs get a truer picture, and a platform doing real work while the rest is brought in.

A clear list of what remains

The phase should end with a written view of what is left: areas not yet set up, systems with no owner, gaps in knowledge, and the scope of the next phase. That list is the real plan. It is better than any plan written before the work began, because it draws on experience of the work itself.

Owners are part of the deliverable

A phase that delivers records without owners has delivered half of what it should. A duty with nobody assigned to it does not get performed, and the platform will show it as unassigned indefinitely.

Naming owners is an organisational decision, and it belongs with leadership. The platform can show where ownership is missing. It cannot decide who should hold it.

Most organisations find this step harder than the technical work, because someone has to accept a responsibility they may not have known was theirs. The head of collections may not have thought of himself as the owner of a purpose. The IT manager may not have expected to own erasure in the core system. It is far easier to settle these questions during a planned phase, with the scope of each responsibility clear, than in the middle of an incident.

Working through the remaining areas

Sequencing what follows

After the first area, dependencies set most of the order. Purposes and notices need the inventory. Consent needs purposes. Retention needs purposes and the inventory. Rights requests need the inventory and get much faster once systems are connected.

Breach readiness can run in parallel, since it rests more on logging, monitoring and a response plan than on the other records. Processor oversight can also run in parallel, because it depends mainly on procurement and contracts, with little internal configuration.

Evidence is not a separate phase. Each area produces its own records as it runs, so an organisation that has run three areas for six months already has six months of evidence for those three, without doing anything extra to produce it.

Keeping momentum between phases

A phased approach carries one real risk: the first phase completes and the second never starts. The people who contributed go back to their other work, the platform runs for the area it covers, and everything else stays where it was.

What prevents that is treating the sequence as one programme with dates, where each phase follows from the last. Each phase has a start, a scope and an end, and the next one is scheduled before the current one finishes.

The management view helps here too. Give management a simple count of duties still outside the system. That count gives the privacy lead a reason to ask for time, and it gives the board a reason to keep asking about progress.

Starting the conversation

What to bring to an assessment

You can shorten an assessment considerably by gathering a few things beforehand:

• Whatever system list exists, however partial.
• The current privacy notice and any retention schedule.
• A list of the outside services you pay for, which finance or procurement can usually pull from the ledger in an afternoon.
• Any existing processor contracts or data processing terms.

Access to people matters more than any document. Book short slots with a system owner, business owners for two of the main services, someone from technology who understands the architecture, and someone who handles customer contact, such as the support lead or the branch operations head.

None of this needs formal preparation. The assessment needs an accurate picture, and an accurate picture put together quickly is worth more than a polished one put together slowly.

What comes out of it

The assessment produces the sequence, the owners, the priority gaps, the technical dependencies and a first phase with a defined scope. From there the work has edges, and you can state what you are doing and how far you have got.

That position is worth having for its own sake. An organisation that can describe its programme, its sequence and its current stage can answer an enterprise customer's questionnaire, a board question or a regulatory enquiry from what it knows, and knowledge is most of what any of those readers is really asking for.

The dates in the Rules are set, and the work takes as long as it takes. An organisation that starts with a scoped assessment and a first phase is moving. One waiting until the position is clear enough to plan everything is likely to still be waiting when May 2027 arrives.

How TrustOS fits

TrustOS is built to be adopted one area at a time. You can set up the inventory, the request queue or processor reviews on their own, and each turns duties into assigned work with an owner, a due date, a completion state and the evidence behind it. Areas you add later connect to what is already there, so the inventory you built in phase one is the same record that requests search and retention rules act on in phase three. The management view shows what is in place and what is still outside, which keeps the next phase realistic.

TrustOS is where the compliance work runs and where the records of that work are kept. The judgement and the effort stay with your teams.

Checklist before you start

• Gather whatever system list exists, however partial.
• Collect the current privacy notice and any retention schedule.
• Ask finance or procurement for a list of outside services you pay for.
• Book short slots with a system owner, two business owners, someone who understands the architecture and someone who handles customer contact.
• Agree who in leadership will decide ownership questions.
• Pick the first area using exposure and current pain, then write down what "running" will mean for it.
• Set a date for the end of phase one and the start of phase two.

The gap assessment is the quickest way to get your own sequence on paper.