The DPDP Board Member's Guide: 10 Questions Your Board Should Be Asking the CISO and DPO

The most expensive sentence in a boardroom is: "I assumed management had this covered."

Picture the last ten minutes of an audit committee meeting at a mid-sized Indian manufacturer with a growing customer app. An independent director, someone who has sat through the GST migration, a dozen RBI circulars and two cyber scares, asks: "Where do we stand on the data protection law?" The CISO says security is on track. The head of legal says a policy is drafted. The CFO says no budget is allocated yet. Nobody lies. Nobody answers, either.

That gap between "on track" and "provable" is exactly where the Digital Personal Data Protection Act, 2023 (DPDP Act) will be enforced. The Act does not reward intentions. It rewards evidence: who consented, to what, and when; which safeguards ran, and where the logs are; how quickly you told people when something broke.

Indian boards are used to this shift. Family-run groups, listed financial firms and MSME suppliers alike have learned that a new regime arrives first as a customer questionnaire, then as an audit finding, and only last as a regulator's notice. The ones that coped asked sharp questions early.

This guide gives directors ten questions to put to the CISO and the Data Protection Officer (DPO), the provision behind each, the real snags we see across Indian enterprises, and what a credible answer sounds like.

Why this belongs on the board agenda

The DPDP Rules, 2025 were notified on 14 November 2025, and the obligations commence in phases.

Date	What applies	Board takeaway
14 Nov 2025	Rules notified; provisions on the Data Protection Board in force	The regulator exists
Through 2026	No statutory deadline, but customers, banks and insurers ask for proof	The commercial clock is already running
13 Nov 2026	Consent Manager registration and obligations begin	Decide whether a Consent Manager matters to your model
13 May 2027	Notice, consent, rights, safeguards, breach reporting, retention, children, cross-border	Compliance must be business as usual

A word of caution. MeitY discussed compressing timelines for Significant Data Fiduciaries (SDFs) in January 2026, bringing their additional duties forward to twelve months. Confirm the current status with counsel before you plan around the later date.

The money matters, so look at it once. Penalties under the Schedule to the Act fall on the Data Fiduciary, meaning the company, and the Data Protection Board decides them after an inquiry, weighing gravity, duration, repetition and mitigation. Directors are not named in the Schedule, but they do owe the duty of due care under Section 166 of the Companies Act, 2013. Nobody wants to explain a ₹250 crore penalty by saying no one asked.

Notice where the largest number sits: security safeguards. That is also the most fixable item on the list, which is why the CISO is the first person your board should question.

Before the questions, settle who answers what. The CISO protects the data. The DPO governs how it is used. The board oversees both, and asks for proof.

The ten questions

1. What personal data do we hold, and where does it live?

Why it matters. The Act covers personal data in digital form, including data collected on paper and later digitised. You cannot protect, delete or report on data you cannot find. Every other answer depends on this one.

The real challenge. The core systems are rarely the problem. The surprises sit in exported spreadsheets, branch-level WhatsApp groups with thousands of customer numbers, old backups, biometric attendance machines and agency-bought marketing lists. Group structures add a layer: each legal entity is its own Data Fiduciary, even when the CRM is shared.

A good answer sounds like: "We have a system-wise inventory and a record of processing, every system has a named owner, and the shadow-data scan was done in the last quarter."

2. What is our lawful basis for each major activity?

Why it matters. Section 4 allows processing only for a lawful purpose, with consent or for the "certain legitimate uses" in Section 7. Those uses include employment purposes, compliance with law and medical emergencies.

The real challenge. Two opposite errors. Some companies seek consent for everything, including payroll, and create needless withdrawal risk, because a withdrawn consent forces erasure. Others stretch "legitimate use" to cover marketing, which it does not. Employee, applicant and visitor data is often treated as out of scope, although those people are Data Principals too.

A good answer sounds like: "Each activity in our record of processing is tagged consent or a specific Section 7 use, and Legal has signed off on the tagging."

3. Would our notices and consents survive scrutiny?

Why it matters. Section 5 requires a notice itemising the data, the purpose, how to exercise rights and how to complain, in plain language, with a choice of English or any language in the Eighth Schedule. Section 6 requires consent that is free, specific, informed, unconditional and unambiguous, given by clear affirmative action, with withdrawal as easy as giving it. Under Section 6(10), the burden of proving notice and consent sits with you.

The real challenge. Legacy. An eight-year-old customer database was built on assumptions that no longer hold. Section 5(2) expects a fresh notice for earlier consents as soon as reasonably practicable. Then there is language: a notice in English for a customer base that transacts in Tamil or Marathi is a finding waiting to happen.

A good answer sounds like: "Every collection point has a standalone notice, consents are stored with timestamps and notice versions, and our legacy re-notification is prioritised by active customers."

4. Are our security safeguards adequate, and can we prove it?

Why it matters. Section 8(5) requires reasonable security safeguards, and failing to take them carries the Act's highest penalty, up to ₹250 crore. Rule 6 makes "reasonable" concrete: encryption, obfuscation, masking or virtual tokens; access control; logging, monitoring and review; backups for continuity; contracts that bind processors; and retention of logs and relevant personal data for at least one year.

The real challenge. One-year log retention is a storage and cost decision that must be made deliberately, and it sits beside CERT-In's 180-day log directive. A second trap is paper compliance: a policy exists, but the last access review was eighteen months ago and nobody has restored from backup this year.

A good answer sounds like: "Our controls are mapped to Rule 6, the evidence is dated, and the gaps have owners and deadlines."

5. Can we meet the breach clock?

Why it matters. Section 8(6) requires you to inform the Data Protection Board and each affected Data Principal of a personal data breach. Rule 7 expects intimation without delay, then a detailed report to the Data Protection Board within 72 hours, unless it allows longer. There is no materiality threshold in the definition: any unauthorised processing or accidental loss that compromises confidentiality, integrity or availability counts. A failure to notify carries a penalty of up to ₹200 crore.

The real challenge. The clock does not respect weekends. Add a vendor-originated breach you learn about late, a CERT-In report due within six hours, and sector rules from RBI, SEBI or IRDAI, and you have several clocks running on one incident.

A good answer sounds like: "We ran a tabletop exercise this quarter, we know who declares an incident, and we produced a Board-ready report in under 48 hours."

6. Can we honour rights requests and grievances on time?

Why it matters. Data Principals may seek a summary of their data and its processing (Section 11), correction and erasure (Section 12), grievance redressal (Section 13) and nomination of someone to act for them (Section 14). Under Section 8(9) and 8(10), you must publish a contact point and run a grievance mechanism. Rule 14 caps the response period at ninety days.

The real challenge. Requests rarely arrive on a form. They arrive as an angry email to a branch, a post on X or a call to a support agent who has never heard of the Act. Identity verification, and erasure across backups and processors, take real design effort.

A good answer sounds like: "One intake channel, every request ticketed, an internal turnaround well inside ninety days, and a monthly ageing report."

7. Do we control our processors?

Why it matters. Section 8(1) makes you responsible for processing done on your behalf, regardless of any contract. Section 8(2) permits processors only under a valid contract. Rule 6 expects safeguards written into those contracts.

The real challenge. Vendor sprawl. Business units buy SaaS tools on a corporate card, marketing agencies hold lead lists, and call centres sit offshore. Contracts signed before 2025 often carry no breach timeline, no sub-processor limits and no exit deletion.

A good answer sounds like: "A ranked vendor register, signed data protection terms with the top tier, and breach-notification timelines to us that are shorter than our own."

8. What do we keep, and what do we delete?

Why it matters. Section 8(7) requires erasure when consent is withdrawn or the purpose is served, unless law requires retention. Rule 8 adds time-bound erasure with advance notice for certain large e-commerce, online gaming and social media intermediaries.

The real challenge. Retention collides with other laws. The Companies Act, tax rules and sector regulators require you to keep some records for years, while the DPDP Act wants the rest gone. Without a schedule that reconciles both, teams default to keeping everything forever. The 2019 CV database of eleven thousand resumes is the example every HR head recognises.

A good answer sounds like: "A retention schedule for every data category, each tied to a legal or business reason, with deletion logs."

9. Where is our exposure on children's data and cross-border transfers?

Why it matters. Under Section 9, a child is anyone under eighteen. You need verifiable parental consent, and you may not track, behaviourally monitor or target advertising at children. Section 16 permits transfers abroad except to countries the government restricts, while stricter sectoral rules continue to apply.

The real challenge. Many firms hold children's data without knowing it: dependants in employee insurance, student records, paediatric patients, family accounts. Cross-border exposure hides in SaaS hosted in Singapore or Ireland and in offshore shared-service centres.

A good answer sounds like: "We know which systems hold children's data, and we have a list of vendors that move data outside India, by country."

10. Who is accountable, and what do we measure?

Why it matters. If you are designated an SDF, Section 10 requires an India-based DPO who is responsible to the board of directors or similar governing body, an independent data auditor, and periodic impact assessments. Rule 13 makes the DPIA and audit annual, with a report to the Data Protection Board. Even if you are not an SDF, Section 8(9) requires a published contact, and a voluntary undertaking under Section 32 can end proceedings, but only if you can show a credible programme.

The real challenge. Structure. A DPO buried under Legal with no budget, or a CISO doubling as DPO and marking their own homework, both signal weak accountability. Privacy and security should cooperate, not collapse into one role.

A good answer sounds like: "One accountable owner, an independent reporting line to the board, a quarterly dashboard, and a dated evidence file."

How to use these questions in the room

Do not try to cover all ten in one sitting. Take two or three per quarterly meeting, rotate through the list, and ask for the answer in writing a week ahead, so the discussion starts from evidence instead of improvisation.

Three habits separate useful boards from decorative ones. First, accept artefacts, not adjectives: "compliant" and "in progress" are not answers, a dated register is. Second, ask what changed since last quarter, because a new vendor, campaign or system quietly invalidates last quarter's data map. Third, test the process yourself. Have a director submit a rights request as a customer, or sit in on the breach drill, and see where it stalls.

Your board scorecard

#	Question	Primary owner	Evidence to request
1	Data held and location	DPO with IT	Inventory with system owners, record of processing
2	Lawful basis	DPO and Legal	Activity-to-basis mapping
3	Notice and consent	DPO and Product	Notice versions, timestamped consent logs
4	Security safeguards	CISO	Rule 6 control map, access reviews, restore test
5	Breach readiness	CISO and DPO	Incident plan, tabletop report, breach register
6	Rights and grievances	DPO and Support	Request register, ageing report
7	Processors	Procurement and CISO	Vendor register, signed terms
8	Retention and erasure	DPO and IT	Retention schedule, deletion logs
9	Children and cross-border	DPO	Children's data list, transfer map
10	Accountability	Board sponsor	Mandate, DPIA, dashboard

Ask for six numbers every quarter.

Metric	Why it matters	Healthy sign
Systems with a named data owner	Question 1	Moving towards 100%
Consent records with timestamp and notice version	Question 3	Every new collection point
Rights requests past internal deadline	Question 6	Zero
Top-tier vendors with signed data protection terms	Question 7	All of them
Drill time to a Board-ready breach report	Question 5	Comfortably under 72 hours
Data categories with an enforced retention period	Question 8	Rising each quarter

Where Indian enterprises struggle most

Challenge	Where it bites	What helps
Shadow data	Spreadsheets, chat groups, old backups	Discovery scan, then owner sign-off
Legacy consent	Pre-commencement customer databases	Prioritised re-notification
Overlapping regulators	RBI, SEBI, IRDAI, CERT-In	One playbook, several clocks
Vendor sprawl	SaaS bought outside procurement	A procurement gate for personal data
Thin privacy talent	Few experienced practitioners	Process first, specialists at the edges

How VaultDef can help

Directors should be wary of anyone who says software alone delivers compliance. Ownership, policy decisions and vendor contracts remain human work. But once the process exists, the hard part is proving it, continuously, to a board, an auditor or a customer.

VaultDef is built by practitioners with hands-on experience across offensive security, defensive security and compliance, including RBI and CERT-In regimes. Its platform maps onto the ten questions: automated data discovery and classification, a record of processing and data mapping (Questions 1 and 2), consent, notice and cookie consent management (Question 3), data principal rights handling (Question 6), a breach workflow (Question 5), DPIA, vendor and cross-border tracking (Questions 7 and 9), and a tamper-evident evidence trail (Question 10). It does not replace your security stack. It makes the evidence visible, dated and ready. Start with the questions where you cannot yet show proof; that is where a platform earns its keep.

For a practical starting point, read VaultDef's DPDP audit readiness checklist. When you want to see it working, book a 45-minute demo, where a live scan runs on a sample schema and you leave with a gap assessment.

The closing thought

Boards that handled the last decade well asked simple questions repeatedly and insisted on evidence. They did it with GST, with RBI's cyber frameworks and with CERT-In's directions. The DPDP Act calls for the same habit, and the organisations that struggle in 2027 will not be the ones with small budgets. They will be the ones that waited for perfect clarity before asking the first question. Clarity arrives through the work. Print the ten questions, put them on the next audit committee agenda, and ask for dated proof.

This article is for general information and is not legal advice. Confirm current dates and obligations against the Act, the Rules and counsel's guidance.