DPDP Readiness: Where to Start

A consent notice or privacy policy can be drafted in a day. It means little if the organisation cannot first answer what personal data is actually processed, for what purpose, and by which systems and vendors.

This is why DPDP readiness should begin with a data processing and consent inventory, not a policy rewrite. Without it, consent mechanisms are built against an assumed data flow, and gaps surface later, usually via a data principal request the organisation is unprepared to answer.

Once the inventory exists, readiness becomes a gap assessment against specific obligations: consent, purpose limitation, data principal rights, breach notification, ranked by exposure rather than addressed alphabetically.