How founders can review privacy risk in thirty minutes

A founder does not need a thirty-page report to discover that everyone can download the customer database. They need a focused conversation, a working screen and someone who knows how the business actually operates. Thirty minutes can reveal a serious gap and assign a useful next action. It cannot establish that an organisation complies with every applicable requirement.

As of 22 October 2026, the main DPDP business obligations are scheduled to commence on 13 May 2027 under the commencement notification. A short review is a preparation method, not a statutory substitute for an audit or impact assessment.

Minutes one to five: choose one consequential journey

Review a specific journey such as a first purchase, a job application or a support complaint. Trying to discuss every database usually produces general assurances. Ask the journey owner to show the collection screen, the resulting record and the tools receiving it.

Suppose a hypothetical furniture seller takes measurements and delivery details through a messaging service. Those details enter a shared spreadsheet, an order system and a delivery partner’s application. The founder can now ask concrete questions about four locations instead of approving a vague statement that customer data is secure.

Write down the purpose of each copy. A second copy may support dispatch; a third may merely survive because an employee once exported it. The distinction determines what to investigate next.

Minutes six to twelve: test the permission story

Ask what the customer was told and why the business believes each use is permitted. If the answer is consent, request the actual notice and the record connecting the person’s action with that notice. If the answer is another legal basis, ask which provision and what facts satisfy it.

The Act’s sections 4, 6 and 7 distinguish consent from enumerated certain legitimate uses. They do not create a general permission to process anything commercially useful. A founder should resist explanations such as “it is in the terms” or “customers expect marketing” without checking the underlying purpose and conditions.

Choose one uncomfortable example. Can a customer buy without joining the promotional list? What happens after withdrawal? Does a new analytics vendor receive fields that the original explanation never mentioned? These questions make purpose boundaries visible.

Minutes thirteen to nineteen: examine access and dependence

Ask the administrator to show who can export the chosen records. Include former staff, shared accounts and vendor support access. A current list is more useful than a policy saying access is reviewed regularly.

Then select the vendor holding the most consequential copy. Who can instruct it to correct, export or erase information? Where is the contract? Who receives its incident alerts? Under sections 8(1) and 8(2), future accountability and processor contracting cannot be replaced by assuming that a large supplier handles everything.

Avoid turning this segment into a debate about brands. A well-known tool configured with a public link can create a more immediate problem than a modest tool with controlled access. Review the actual arrangement and the organisation’s ability to change it.

Minutes twenty to twenty-five: rehearse one failure

Say that the spreadsheet link has reached an unknown recipient. Ask who would restrict access, preserve useful evidence, identify affected people and decide which notifications apply. Name individuals and backups rather than departments that do not exist.

The future Rules 6 and 7 address security safeguards and personal data breach information. Existing incident obligations, including CERT-In requirements where applicable, need their own assessment. This exercise should expose missing contacts and permissions before an event forces hurried decisions.

Also ask what happens if the journey owner is absent. A response plan that depends on one person’s memory has an obvious operational weakness even before any legal analysis begins.

Minutes twenty-six to thirty: decide, do not merely score

Finish with no more than three actions. Give each an owner, a date and evidence of completion. “Improve access control” is too broad. “Remove five obsolete accounts and save the approved access list by Friday” can be checked.

Use severity to order work, but describe why. An exposed live customer file deserves immediate attention. A confusing internal document title can wait. Where the team lacks facts, assign discovery rather than pretending that uncertainty is a low risk.

Keep a one-page decision record: the journey examined, evidence viewed, unresolved questions, actions and next review date. If the same issue returns next month, discuss what blocked the fix. The value of this meeting comes from decisions that survive beyond the conversation, not from giving the business a reassuring colour on a dashboard.