According to the India Cyber Threat Report 2026, India’s cybersecurity maturity score averages 6.3* out of 10 across organisations, based on analysis of over 180 businesses. It is a baseline measurement that points to specific, addressable gaps in how Indian enterprises govern data and respond to incidents. With the DPDP Act’s enforcement architecture now taking shape, those gaps carry direct legal consequences.
Data governance: Where execution falls short of policy
Most organisations have data classification frameworks in place, but there exists weak access provisioning and inadequate secure data disposal practices. Under the DPDP Act, this distinction matters. Section 8(1) requires Data Fiduciaries to implement reasonable security safeguards to prevent personal data breaches. Regulators evaluating compliance will look past the existence of a policy to whether it was operationally enforced. An access control framework that is documented but inconsistently applied does not constitute a reasonable safeguard. Practically, organisations should focus on three things:
- Ensuring access provisioning reviews are tied to actual role changes rather than scheduled audits
- Implementing automated controls for data disposal aligned to defined retention schedules
- Running least-privilege access as a live enforcement mechanism rather than a configuration assumption.
Incident response: The legal obligation is specific
Approximately 27% of organisations currently lack a formal incident management process. Section 8(6) of the Act requires Data Fiduciaries to notify both the Data Protection Board of India and affected Data Principals in the event of a personal data breach, without undue delay. Rule 7 of the DPDP Rules 2025 specifies that a detailed report must be submitted to the Board within 72 hours of becoming aware of the breach. The phrase “without undue delay” for individual notification means that a post-breach triage process that runs for days before users are informed will be difficult to defend. Alongside this, Indian Computer Emergency Response Team (CERT-In’s) existing directions under Section 70B of the IT Act require notification of qualifying cybersecurity incidents within six hours of detection. Both obligations apply to the same underlying event.
An organisation that structures its response around CERT-In’s technical reporting window and treats DPDP notification as a subsequent step is misreading its legal position. The two frameworks run in parallel, not in sequence. Practically, this means incident response plans need to be structured with dual-track obligations built in from the outset. Notification language for the Data Protection Board and for affected individuals should be legally reviewed in advance. Detection timelines should be logged systematically, since the 72-hour window is measured from awareness, and the ability to demonstrate when awareness occurred is itself a governance requirement.
What do the penalties actually look like?
The DPDP Act’s Schedule sets monetary penalties of up to ₹250 crore per instance for failure to implement reasonable security safeguards, with separate penalties for notification failures. The Data Protection Board determines the exact amount based on the gravity of the breach, duration of exposure, data sensitivity, and whether the organisation exercised due diligence.
To be in a defensible position, organisations need three things in place before an incident occurs:
- Continuous monitoring of privileged access and sensitive data stores
- Log management that is independently validated and forensically reliable
- Notification workflows that have been legally reviewed and rehearsed, covering both the Board report required under Rule 7 of the DPDP Rules and individual notice to affected Data Principals.
For global businesses with Indian operations
Organisations operating across jurisdictions face additional complexity. The DPDP Act adopts a permissive model for cross-border data transfers under Section 16, allowing transfers unless the government specifically restricts particular jurisdictions. However, when a breach involves data stored or processed internationally, the notification and governance obligations under the DPDP Act apply to the Indian operations regardless of where the data sits. Incident response frameworks need to account for this, ensuring that cross-border incidents do not create delays in meeting Indian statutory timelines.
For organisations already managing GDPR obligations, the structural differences are worth noting. GDPR ties financial exposure to global turnover; the DPDP Act applies fixed monetary ceilings per contravention. Both frameworks evaluate proportionality, intent, and safeguard adequacy, so breach response maturity needs to satisfy both approaches. Organisations that default to the GDPR playbook and assume it translates directly to DPDP compliance risk developing blind spots in relation to notification timelines and how penalties are calculated, as well as gaps in the governance evidence regulators expect to see.
This is where a Data Protection Officer (DPO) with working expertise across both frameworks becomes operationally valuable. A DPO who understands the structural distinctions between GDPR and DPDP can identifywhere existing processes transfer, where they need to be adapted, and where Indian-specific obligations require a distinct response before those gaps are exposed..
Practical next steps
For organisations that have not yet stress-tested their position against these requirements, the starting point is a structured gap analysis across four areas: data classification and access controls, incident response and notification procedures, log integrity and detection capability, and privacy notice accuracy. A DPO with cross-jurisdictional expertise should help with the process, ensuring the analysis is benchmarked against DPDP requirements specifically and not just undertaken through a GDPR lens.
HewardMills works with organisations operating in India on DPDP compliance readiness, incident response frameworks, and data governance assessments. Contact our team to discuss your organisation’s current positionand see how we can support you.
* Source: https://ciso.economictimes.indiatimes.com/news/cybercrime-fraud/cybersecurity-gaps-persist-in-data-privacy-and-incident-response/130406649
