Privacy Governance Is Not About Company Size. It’s About the Data You Handle.

A business can have 20 employees or 20,000.

It can operate from one office or across multiple countries.

It can have a single website or a complex technology estate with hundreds of applications.

But there is one question that matters more than company size:

What personal data does the organization collect, use, store, share and retain—and how is that data governed?

This is the question businesses should be asking as India moves from the Digital Personal Data Protection Act, 2023 toward operational implementation of the DPDP framework.

The Digital Personal Data Protection Act recognizes both an individual’s right to protect personal data and the need for organizations to process personal data for lawful purposes. The Act was enacted on 11 August 2023.

The notified DPDP Rules, 2025 were published in November 2025 and establish a phased commencement framework. Rules 1, 2 and 17–21 took effect on publication; Rule 4 takes effect one year after publication; and Rules 3, 5–16, 22 and 23 take effect 18 months after publication.

That does not mean every organization has the same compliance obligations.

It means organizations should understand which obligations apply to their processing and build appropriate governance around the personal data they handle.

Data responsibility applies equally to both — a startup office and a corporate HQ.

The misconception: “Privacy is an enterprise problem”

Privacy programs are often associated with large organizations.

• a Data Protection Officer
• privacy counsel
• a CISO
• security engineers
• compliance teams
• data-governance teams
• enterprise GRC platforms
• dedicated privacy budgets

That can make privacy governance appear complicated and expensive.

But the underlying problem can exist in a much simpler environment.

Consider an organization with:

• one website
• a contact form
• WhatsApp enquiries
• Google Analytics
• Google Ads or Meta Ads
• a newsletter
• a CRM
• spreadsheets
• cloud hosting
• a payment gateway
• customer-support email
• recruitment forms

Ask one question:

How many places does personal data enter, move through or remain stored in this organization?

The answer may be surprisingly large.

The data journey may not be simple.

A website enquiry could travel through several systems:

What does DPDP mean for a business?

The DPDP framework uses specific roles and concepts, including the Data Principal, whose personal data is being processed, and the Data Fiduciary, which determines the purpose and means of processing personal data.

For a business, the practical question is not simply:

“Am I a large enough company to care about DPDP?”

A better question is:

“What personal data am I processing, why am I processing it, and what governance do I have around that processing?”

That is a much more useful starting point.

Start with your Personal Data Footprint

One of the most useful ways to think about privacy governance is the Personal Data Footprint.

What is a Personal Data Footprint?

A Personal Data Footprint is the collection of places, systems, people, vendors and processes through which personal data enters, moves, is stored, used and eventually deleted or retained by an organization.

For example:

Now consider what happens when that customer asks:

“What information do you have about me?”

Or:

“I want to withdraw my consent.”

Or:

“Please delete my personal data.”

The organization needs enough visibility to understand what data exists and where it has gone.

That is why privacy governance starts with visibility.

Your website may be your first privacy control point

For many organizations, the website is where the privacy journey begins.

A website can collect personal data through:

Contact forms

Name, email address, phone number and enquiry details.

Registration forms

Account information and identifiers.

Newsletter subscriptions

Email addresses and communication preferences.

Recruitment forms

CVs and employment-related information.

Analytics

Information about how visitors interact with digital services.

Advertising and tracking

Third-party tags and pixels can introduce additional data flows.

Chat and support

Customer conversations can contain personal information that was never anticipated when the original system was designed.

The important question is not whether each technology is inherently good or bad.

Do you understand what is being collected, for what purpose, where it goes and how the organization governs it?

A consent banner is not a privacy program

Consent can be an important component of privacy governance, but a consent banner is only one layer.

The DPDP Rules require a notice to be clear and understandable independently of other information and to include, among other things, an itemized description of personal data and the specified purpose or purposes of processing. The Rules also address mechanisms for withdrawal of consent, exercise of rights and complaints.

So the real privacy journey looks more like:

A banner is part of that journey.

It is not the whole journey.

What happens after someone submits a form?

This is where privacy becomes an operational issue.

Imagine someone submits:

Name + Email + Phone + Enquiry

on your website.

What happens next?

The complete data journey: visitor to backup.

At each stage, the organization should understand the relevant processing.

This is why privacy governance is not simply a legal-document exercise.

It is a data-flow management problem.

Know your vendors

Modern businesses rarely process all personal data themselves.

• cloud providers
• CRM platforms
• email services
• marketing platforms
• payment providers
• customer-support systems
• analytics providers
• HR platforms
• accounting systems
• hosting providers

The question becomes:

Who is processing personal data on your behalf?

And:

What information are they receiving?

And:

Why are they receiving it?

And:

What controls and contractual arrangements govern that relationship?

This is why privacy governance should connect data discovery with processor governance rather than treating vendors as a separate spreadsheet.

You don’t need to solve everything on Day One

One of the biggest mistakes organizations make is approaching privacy as a giant transformation program.

They imagine they need to discover every system, document every process, build a huge ROPA, appoint a large team, implement multiple enterprise tools, and redesign every application before they can begin.

That is not the only approach.

A better approach is progressive.

SEE — Understand what personal data you collect.

MAP — Understand where it goes.

GOVERN — Define appropriate purposes, access, retention, responsibilities and controls.

EXECUTE — Operationalize consent, applicable Data Principal rights and privacy workflows.

PROVE — Maintain evidence of what has been implemented and what actions have been taken.

WATCH — Continuously monitor changes in your website, vendors, systems and data flows.

Privacy governance can therefore mature with the organization.

The 10-question privacy health check

1. What personal data do we collect? Names? Email addresses? Phone numbers? Customer information? Employee information?

2. Where does it enter the organization? Website? Mobile application? Sales team? Customer support? HR?

3. Why do we collect it? What purpose does each important data collection activity serve?

4. What does our website collect? Forms, cookies, analytics, advertising and third-party scripts?

5. Where does submitted data go? CRM? Email? Spreadsheet? Cloud storage? SaaS applications?

6. Which vendors or processors receive it? And what information do they receive?

7. How do we manage consent and notices? Are users given appropriate information and appropriate mechanisms where required?

8. How long do we retain information? Do we have sensible retention and deletion practices?

9. What happens when an individual exercises an applicable right? Who receives the request? How is identity verified? Who searches for the relevant information? How is the action documented?

10. Can we prove what we did? Can the organization produce evidence of its privacy controls and actions?

If several answers are “I don’t know,” that is not necessarily a reason to panic.

It is a reason to start mapping the gap.

Does an organization need a dedicated privacy team?

Not necessarily. The right governance model depends on the organization’s size, activities, risk and applicable obligations.

But every organization should establish accountability.

Someone should know:

• what personal data is being collected
• why it is being collected
• where it goes
• which systems and vendors are involved
• what privacy controls exist
• who handles privacy requests
• where evidence is maintained

For a growing organization, this may initially be part of an existing IT, security, legal, compliance or operations role.

The important thing is not the title.

The important thing is ownership.

Where technology changes the equation

Privacy governance becomes difficult when everything is maintained manually.

A spreadsheet can document a data source.

But what happens when:

• a new website tracker is added?
• a new CRM integration is introduced?
• a new database is created?
• a new vendor starts receiving customer information?
• an employee exports data to a spreadsheet?
• a customer submits a rights request?

This is where privacy technology becomes useful.

The objective isn’t to replace judgement. It is to reduce repetitive work and create visibility.

Automation can help organizations:

• discover personal data
• identify cookies and trackers
• manage consent records
• map processing activities
• manage Data Principal requests
• track vendors
• manage privacy workflows
• maintain evidence
• monitor changes

Start where your organization is

This is the philosophy behind Consiva.

You do not have to begin by implementing a complex enterprise privacy architecture.

You can begin with your website.

Understand what it collects.

Understand the cookies and trackers operating on it.

Review forms and consent.

Understand where customer information goes.

Then progressively expand into:

Consiva provides a cloud-based platform designed to help organizations build these capabilities progressively.

The Free option provides a low-friction way to begin.

Organizations that need broader capabilities can move to Consiva Pro at ₹6,000 per month or ₹60,000 per year.

Consiva does not make an organization legally compliant simply because it uses the platform.

Compliance remains an organizational responsibility.

Consiva provides technology, visibility and operational capabilities that can help an organization establish, manage and evidence appropriate privacy practices.

Privacy governance is a business discipline

The strongest privacy programs are not built because someone is afraid of a regulation.

They are built because an organization recognizes something fundamental:

When customers give you their data, they are giving you a responsibility.

That responsibility exists whether the organization has ten employees or ten thousand.

Whether it operates one website or a hundred applications.

Whether it has a dedicated privacy team or one person coordinating the function.

The sophistication of the program can be proportional to the organization’s needs.

The principle should remain constant:

• Know the data.
• Understand the purpose.
• Control how it is used.
• Respect the rights attached to it.
• Keep evidence.

The right place to start

You don’t have to solve your entire privacy program on Day One.

Start with the data you already handle.

Start with your website.

Start with your forms.

Start with your vendors.

Start with your consent mechanisms.

Start with understanding your Personal Data Footprint.

Then build from there.

Because privacy governance is not about being a large enterprise.

It is about being responsible with the data entrusted to you.

Start where you are. Know your data. Govern it properly. Build from there.

Quick-start checklist

SEE — What personal data do we collect?

MAP — Where does it go?

GOVERN — Why do we have it and who is responsible?

EXECUTE — What happens when consent changes or a relevant rights request arrives?

PROVE — Can we demonstrate what we did?

WATCH — What has changed since the last review?

That is privacy governance in practice.