CXO Guide
The board's guide to DPDP readiness
India's Digital Personal Data Protection Act, 2023 is not an IT compliance exercise. It is a board-level governance obligation with personal liability provisions. This guide explains what every CXO needs to know — and what Discovery+ does about it.
The DPDP Act
What the Act actually requires
The Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 establish a comprehensive framework for the processing of personal data in India. The obligations are not aspirational — they are enforceable, with penalties of up to ₹250 crore per instance.
Lawful processing with valid consent
Every piece of personal data must be collected for a specific, clear purpose with the data principal's free, informed, and unambiguous consent. Bundled or pre-ticked consent is invalid. Consent must be as easy to withdraw as it is to give.
Purpose limitation and data minimisation
Personal data may only be used for the purpose for which it was collected. Using customer data collected for one product to market another — without fresh consent — is a violation. Data minimisation requires collecting only what is necessary.
Data principal rights
Every individual whose data you hold has the right to access it, correct it, erase it, and nominate someone to exercise these rights on their behalf. You must respond within 72 hours. Failure to do so is a separate, penalisable offence.
Reasonable security safeguards
The Act requires 'reasonable security safeguards' to prevent personal data breaches. The standard is not defined — it will be set by the Data Protection Board through adjudication. The penalty for failure is up to ₹250 crore.
Breach notification
A personal data breach must be notified to the Data Protection Board and to affected data principals 'in the prescribed manner'. The draft Rules suggest a 72-hour window. The penalty for failure to notify is up to ₹200 crore.
Data processor obligations
If you share personal data with a third party for processing, you remain responsible for their compliance. Your contracts must require them to meet the same standards. You must maintain a live register of processors and their sub-processors.
Board Accountability
Why this is a board matter
Personal liability for significant data fiduciaries
Organisations designated as Significant Data Fiduciaries must appoint a Data Protection Officer who reports directly to the board. The board is accountable for the DPO's findings.
Audit committee scrutiny
DPDP compliance will become a standard item on audit committee agendas. Boards that cannot demonstrate a systematic compliance programme will face questions from institutional investors and regulators alike.
Reputational exposure
The Data Protection Board's orders are public. A ₹250 crore penalty — or even a ₹50 crore penalty — will be reported. The reputational damage to a listed company could far exceed the financial penalty.
Cross-border data transfer restrictions
The Act restricts the transfer of personal data outside India to countries notified by the Central Government. Organisations with global operations must map every cross-border data flow and ensure it is compliant.
LeigoSapien Discovery+
What Discovery+ does for your board
Automated personal data discovery
Discovery+ scans your entire data estate without requiring manual tagging. It finds personal data in databases, file servers, email archives, cloud storage, and SaaS applications — including data you did not know you had.
Consent inventory and gap analysis
The platform maps every personal data element to the consent record that authorises its processing. It identifies data held without valid consent and generates a prioritised remediation plan.
Rights fulfilment automation
When a data principal submits a rights request, Discovery+ locates all relevant data across your systems, prepares the response, and tracks the 72-hour deadline. No manual triage required.
Board compliance dashboard
A real-time dashboard gives the board a single view of your compliance posture across all DPDP Act obligations. It is designed to be presented at board meetings without translation by the IT team.
On-premise deployment
Discovery+ is deployed entirely within your data centre. Your personal data never leaves your perimeter. There is no cloud dependency, no SaaS subscription, and no data residency risk.
Audit-ready evidence
Every compliance action is logged with a timestamp and an audit trail. When the Data Protection Board asks for evidence of your compliance programme, Discovery+ generates the documentation automatically.
Sylestal Digital
Your exclusive India partner
Sylestal Digital is the exclusive partner and distributor for LeigoSapien Discovery+ in India. We deploy the platform on your infrastructure, configure your sector-specific compliance pack, train your DPO and IT teams, and provide ongoing support. We do not resell a product — we deliver a compliance outcome.
- Exclusive India partner & distributor for LeigoSapien
- On-site deployment and configuration
- Sector-specific compliance pack setup
- DPO and IT team training
- Ongoing support and compliance monitoring
Request a board-level briefing
We offer a 60-minute briefing for CXOs and board members that covers the DPDP Act obligations, the penalty exposure, and a live demonstration of Discovery+ in a sandboxed environment. No commitment required.