DPDP Decoded: Consent and Breach Readiness

What should organisations be doing now that the Digital Personal Data Protection Rules, 2025 have been notified? In this episode of DPDP Decoded, Dr. Lalit Gupta, Senior Partner and Chief Delivery Officer, Mitigata, discusses what changed on 13 November 2025 and why full compliance by 13 May 2027 is closer than most organisations assume. The conversation explores the practical steps of a readiness programme — data discovery and data flow mapping, gap assessment and remediation, and preparing notices, privacy policies and consent records in the 22 languages of the Eighth Schedule. It examines what makes consent valid under the Act, why withdrawing consent must be as simple as giving it, the limits of the legitimate uses under Section 7, verifiable parental consent and the restrictions on tracking children, and how organisations must treat data collected before the Rules came into force. It also covers the Consent Manager framework and how it differs from a consent management tool, where liability sits across the vendor and processor chain, how everyday marketing practices will have to change, and what 72-hour breach reporting to the Data Protection Board demands of incident response and digital forensics teams. Watch the full episode for a practical action plan for organisations preparing for May 2027.