When India's Digital Personal Data Protection Act came into force in 2025, it marked the end of a long era in which Indian enterprises could treat data governance as a compliance checkbox rather than a strategic function. The DPDPA introduces meaningful obligations around consent, data localisation, purpose limitation, and breach notification.

The immediate pressure fell on sectors that hold the most personal data: banking, insurance, healthcare, and e-commerce. But the secondary pressure is landing everywhere. Any enterprise that stores customer names, contact details, transaction records, or behavioural data is now subject to obligations they may not yet have the infrastructure to meet.

The enterprises that will navigate DPDPA most effectively are the ones with centralised data infrastructure — a single source of truth, documented data lineage, role-based access controls, and automated retention policies.