Q1. With India’s Digital Personal Data Protection Act (DPDPA) raising the bar for personal data handling, what are the most critical operational shifts enterprises must prioritize today? How should CISOs and Privacy Officers structure their implementation roadmaps to move beyond checkbox compliance?
The decisive shift is from documentation to data. Most enterprises can produce a privacy policy; very few can produce an itemised inventory of what they collect at each touchpoint, and Rule 3 of the DPDP Rules, 2025 makes that inventory a precondition — a notice cannot be itemised if the collection is not known. The second shift is lawful basis. The Act offers consent and a short list of legitimate uses, with no legitimate interest ground, so every activity currently justified on reasonableness must be re-based or re-consented. The third is that retention stops being a principle and becomes an enforceable timetable under Rule 8. On roadmap structure, I would sequence by data flow rather than by section of the Act. Discover and map first; then assign basis, purpose by purpose, and plan the re-notice of legacy data required by Section 5(2); then instrument the controls — consent records, rights workflow, retention jobs, breach clocks. Working backwards from 13 May 2027, the mapping must complete in the first third of the programme, because everything downstream depends on it. The test of whether a programme is real is simple: can the organisation reproduce, for a named individual on a named date, the exact notice that was displayed at the moment consent was taken. An organisation that can do that has built a system. One that cannot has bought a policy.
Q2. The DPDPA heavily emphasizes explicit consent mechanisms and the rights of Data Principals (such as right to withdrawal and erasure). What technical architectures or automation strategies do you recommend for seamlessly managing user consent and processing data principal requests at scale?
Consent has to be treated as infrastructure, not as a form. Architecturally that means four
components. A purpose registry, holding every processing purpose as master data with a stable identifier. A consent ledger, append-only, recording the decision against the purpose identifier together with the notice version, the language displayed, the timestamp and the mode of capture. A single preference centre as the only write path, so that consent state cannot diverge between the app, the call centre and the counter. And a policy decision point, so that no downstream system reads personal data without first checking consent state — enforcement in code rather than enforcement by memo.
Withdrawal is where most designs fail. It must propagate outward, on an event, to every internal system and every processor, with a measured latency and a confirmation back to the individual. Latency of propagation is the metric worth reporting.
For rights requests, the difficult part is not the workflow but identity resolution — the same
person exists as a subscriber, a loyalty member, a guest and a caller. Build the identity graph before automating the request pipeline, or the responses will be incomplete. Automate discovery and acknowledgement; keep human review on erasure, because statutory retention frequently overrides the request and the answer must say so. Consent Manager registration opens in November 2026 and the ledger should be built to interoperate with it from the outset.
Q3. Under DPDPA, Data Fiduciaries bear primary liability for data breaches, even if caused by third-party Data Processors. How can organizations effectively strengthen third-party risk management and vendor governance to mitigate supply chain privacy risks?
Because liability does not travel with the data, governance has to. I would concentrate on four things.
● Enumerate the real processor population. Most registers capture technology vendors
and miss the ones that matter most — printers, delivery contractors, call centres, event
photographers, promotion agencies, background verification firms. These hold the data
and are rarely reviewed.
● Contract for the fiduciary’s clock, not the vendors. A processor breach notice arriving in
five days is useless when the Board must be informed within seventy-two hours of the
fiduciary becoming aware. The contractual window has to be measured in hours, with a
named contact and a rehearsed route.
● Verify rather than survey. An annual questionnaire evidences nothing. Tier vendors by
data sensitivity and volume, and for the top tier require evidence — access logs, deletion
certificates, right of audit exercised at least once.
● Control the boundaries. No personal data leaves without a signed data protection
addendum, no production data enters a test environment, access is least-privilege and
time-bound, and exit produces a certificate of deletion rather than an assurance.
Q4. While cybersecurity focuses on preventing breaches, cyber resilience assumes
breaches will happen and focuses on business continuity. How do you define a truly resilient enterprise architecture, and what key metrics best measure an organization’s recovery capability?
A resilient architecture is one designed to degrade gracefully rather than to fail cleanly. In
practice that means segmentation so that a compromise in one division cannot traverse into another; identity treated as the control plane, since most modern intrusions are authentication events rather than malware events; immutable and offline backup copies for tier-one systems; and recovery paths that have actually been executed, not merely documented. The important reframing is that resilience is measured at the level of the business process, not the server. For a broadcaster the question is whether playout continues; for a financial services business, whether the collection cycle completes; for a hotel, whether guests can check in. Restoring a virtual machine while the process remains down is not recovery. The metrics I rely on are deliberately few:
● Recovery time and recovery point actually achieved in the last exercise, against the
stated objective — measured, not policy values.
● Mean time to detect and mean time to contain, trended rather than compared to
industry averages.
● Restore success rate and time to restore for tier-one systems, tested on a schedule.
● Proportion of critical services with a failover tested in the last twelve months.
● Dependency mapping coverage, because an untested dependency is where recovery
plans break.
Q5. Rapid breach notification mandates create intense pressure on incident response teams. How can leadership build response playbooks that ensure quick detection, containment, and transparent compliance reporting without disrupting ongoing forensic analysis?
Separate the tracks and give each an owner under a single incident commander. The forensic track establishes what happened; the regulatory track reports what is known at the time. They run in parallel, and the second must never wait on the first.
In India three clocks run at once, and the playbook should show them as three timed lanes: six hours to CERT-In for a reportable cyber incident, intimation to affected Data Principals without delay, and detailed particulars to the Data Protection Board within seventy-two hours under Rule 7. The critical point for leadership to internalise is that the DPDP regime applies no risk threshold — the trigger question is whether a personal data breach occurred, not whether it was serious. Teams accustomed to a materiality assessment will under-report.
Practically: pre-draft the filings so that the first hour is spent gathering facts rather than drafting; agree the escalation thresholds before the incident, not during it; preserve evidence before containment where the two conflict, and record the decision either way; retain logs to the CERT-In standard so that reconstruction is possible at all; and file supplementary reports as understanding improves rather than delaying the first. Rehearse with legal and corporate communications in the room — a playbook first used live will fail at the handoffs, not at the technical steps.
Q6. As threat actors leverage generative AI for more sophisticated vector attacks, how should organizations modernize their SOCs and defense strategies? Where do you see AI offering the greatest advantage in strengthening resilience?
What generative AI has changed for the attacker is cost and credibility, not technique. Phishing now arrives in fluent regional language with accurate local context; voice cloning makes a familiar voice on a telephone call worthless as an authenticator; and the interval between disclosure and weaponisation of a vulnerability continues to compress.
The defensive response is less about new tooling than about moving detection to identity.
Session and token abuse, impossible travel, consent grants to unfamiliar applications and
privilege changes are now more informative than file-based signatures. Alongside that, out-of- band verification must become procedural for any instruction involving payment, credentials or account recovery — the control that defeats a cloned voice is a callback on a known number, not a better filter. Organisations with public-facing personnel need a synthetic media response route as well, and for media businesses the labelling obligations introduced by the 2026 amendment to the IT Rules make this a compliance question and not only a reputational one. On the defensive side, the clearest advantage is in triage and enrichment: collapsing the time between an alert and the context needed to judge it, summarising large log sets, drafting detection logic, and identifying coverage gaps against a known technique framework. I would keep containment decisions with a human. The gain is analyst leverage and reduced dwell time, not autonomy.
Q7. Reflecting on your extensive career in information security, how do you successfully
align cybersecurity priorities with core business growth goals and foster a security-first
culture across cross-functional teams?
Alignment begins with speaking in the currency of the division rather than the currency of the function. In a broadcasting business the stake is air time and credibility; in financial services it is regulatory standing; in food manufacturing it is recall exposure; in hospitality it is guest trust.
The same control, described in the language of the business it protects, moves from an overhead to an investment. The second element is timing. Security invited at the design stage is inexpensive and shapes the outcome; invited at go-live it becomes a veto, and a function that is experienced as a veto is routed around. I would rather be consulted early and say yes with conditions than be consulted late and say no.
Culture follows accountability rather than awareness campaigns. Named owners within each division, a small set of measures reported consistently, and a reporting environment in which raising an issue is never penalised will do more than any volume of training. The organisations that handle incidents well are the ones where people report early because they are confident they will not be blamed for it.
Q8. Looking back at your professional journey, what has been one of the most challenging cyber risk or compliance transformation projects you led, and what were your key takeaways from managing it?
Building a security and privacy function from a greenfield position across a diversified group has been the most demanding, precisely because a conglomerate is not one organisation.
Broadcasting, publishing, financial services, food manufacturing, retail and hospitality sit under different regulators with genuinely different obligations, and a single control set imposed uniformly across them satisfies none of them.
Four takeaways have held up. Sequence by dependency — nothing can be secured, reviewed or recovered until it has been enumerated, so inventory precedes control every time. Governance documents become real only when they carry forms, registers and named owners;a narrative policy is an intention. Divisional leadership must be engaged as co-owners rather than as recipients of a mandate, because they hold the operational detail that determines whether a control is workable. And early, visible wins buy the credibility needed for the slower structural work that follows.
Q9. Translating technical cyber risks into executive business terms remains a common challenge. How do you communicate security posture, DPDPA compliance costs, and cyber resilience value to the Board of Directors?
Three numbers, consistently reported, are worth more than thirty. Where the exposure sits in rupees, where the organisation stands against the position it has agreed to reach, and what the next tranche of expenditure buys in reduced exposure. A heat map with no money attached to it invites discussion but does not support a decision.
On the Act specifically, the framing that lands is that the penalties are fixed rupee ceilings rather than a percentage of turnover, running to two hundred and fifty crore rupees for the most serious categories. A fixed ceiling does not scale down for a smaller division, which makes the exposure disproportionate for exactly the businesses that assume the Act is aimed at larger ones. Scenarios communicate resilience better than architecture diagrams: the takeover of an official channel, the compromise of a subscriber database, the loss of a core operational system during a peak period — what each would cost, how long recovery would take, and what the current investment changes about that answer. I would report a small, stable metric set half-yearly so that the Board is reading a trend rather than a fresh presentation each time.
Q10. Given the rapidly evolving regulatory landscape in India and globally, what essential advice or core skillsets would you recommend for the next generation of security executives navigating DPDPA and emerging threat vectors?
Read the primary text. Summaries and vendor commentary are useful for orientation and
unreliable for decisions; a great deal of poor implementation traces back to a rule that nobody in the programme had actually read. Beyond that, four capabilities compound over a career.
● Understand the business you are protecting well enough to describe how it earns
money. Security judgement that is not grounded in operational reality produces controls
that are quietly bypassed.
● Data literacy. The ability to inventory, classify and trace data across systems is now the
foundational skill of the privacy-facing security role, ahead of any tool-specific expertise.
● Written and verbal clarity. At the executive table this is the differentiator, and it is the
skill most often left undeveloped in technically strong professionals.
● Proportionality. Knowing which risks to accept, and being able to defend that decision
on the record, matters more than the ability to identify risks — which is comparatively
easy.
