DPDP Insights › Questions › What should the board of directors ask management about DPDP

Question

What should the board of directors ask management about DPDP?

Short answer: Five plain questions, asked every quarter

Directors do not need technical detail. They need to know who is accountable, how the organisation would handle a breach, which outside parties hold data, and whether the plan to May 2027 is on track with evidence.

What the law says

The Act places duties on the Data Fiduciary, the organisation itself. Directors oversee whether management has put those duties into practice.

Section 8(1)–(2): The organisation that decides why and how data is used (the Data Fiduciary) stays responsible, even when a vendor (Data Processor) does the work. A processor may be engaged only under a valid contract.
Section 8(6) · Rule 7: On becoming aware of a personal data breach, tell each affected person and the Data Protection Board without delay. Send the Board a detailed report within 72 hours, or a longer period if the Board allows on request.
Section 10 · Rule 13: The government may notify organisations as Significant Data Fiduciaries based on the volume and sensitivity of data and the risk involved. They need a DPO based in India, an independent data auditor, and a yearly impact assessment and audit. None had been notified when this page was last reviewed.

Steps

Ask who is accountable for personal data, by name.
Ask when the breach plan was last rehearsed and what was learnt.
Ask for the list of vendors holding the most personal data.
Ask how many requests and complaints came in, and how fast they were answered.
Ask for the plan to May 2027 with evidence, not colours.

Evidence to keep

Quarterly note to the board
Minutes showing the questions asked
Management responses

Common mistakes

Discussing DPDP once and then never again
Accepting 'IT is handling it'
No date for the breach rehearsal

How it plays out by sector

Banking, financial services and insurance: Ask how DPDP fits into the existing IT strategy and risk committee reports.
IT, ITeS, BPO and GCC: Ask about client incident terms and sub-contractor numbers.
Central government: ministries and departments: Ask for the scheme register and the last rehearsal date.
Public sector undertakings and utilities: Ask about partner coverage and the State-provisions note.
Healthcare and hospitals: Ask about downtime, wrong sends and vendor lists.

From each seat

Director: Ask the five questions every quarter, and record the answers in the minutes. The answers will improve when management knows the questions are coming.

What a good answer from management sounds like

“DPDP is a standing quarterly item. Management brings a short note with names, numbers and evidence.” Effort and time: Light · one agenda item every quarter.