What IDfy and MIT’s Research Reveals About Enterprise Privacy & DPDP Rules

As India’s Digital Personal Data Protection (DPDP) framework moves from interpretation to day-to-day enforcement, enterprises are discovering a hard truth: privacy readiness is tested in operations, not documentation.

Privacy no longer ends with policy approval or a compliance checklist. It shows up after hours. It shows up when a product team pauses a release because data flows are unclear. When a board asks whether the organization is truly DPDP-ready. When leaders realize that what looked complete on paper feels fragile in execution.

This is the gap where most organizations struggle. Policies exist, the intent is clear, but translating privacy into everyday decisions across systems, teams, and vendors is where leadership judgment is truly tested.

To understand how enterprises are navigating this shift, this whitepaper draws on evidence and insights from 75+ senior leaders across highly regulated, data-intensive industries. Developed jointly by MIT Sloan Management Review India and IDfy, this is not an opinion piece, but a research-backed examination of how privacy is being operationalized inside India’s largest enterprises.

What Enterprise Reality Looks Like

The research focuses on how privacy is actually being operationalized inside large organizations today. The respondents represent enterprises where privacy failures carry material consequences:

• 87.5% report annual revenues above USD 1 billion
• 75% employ more than 20,000 people
• Industries include BFSI, e-commerce, healthcare, and TMT

These are organizations with mature compliance functions and prior exposure to global regulations. Yet even here, privacy maturity is far from uniform.

The takeaway is not that enterprises are unprepared. It is that maturity is uneven, and confidence often runs ahead of capability. Looking for detailed insights? You can download the white paper here.

The Hidden Line Between Privacy Friction and Privacy Advantage

One of the clearest patterns in the research is where privacy starts to break down.

Privacy maturity weakens when organizations stop at consent and fail to govern the full data lifecycle. Beyond consent, enterprises must manage data discovery, classification, impact assessments, and rights fulfillment across increasingly complex environments.

The gaps are visible in the data:

• Data inventory and classification: 50% have a mature data governance program
• DPIAs: Only 37.5% reach an Optimized state
• Data Subject Rights fulfillment: Largely procedural, with 62.5% Established and 37.5% in nascent stage

Only a small subset of organizations reaches “Optimized” maturity across any of these domains.

Why does this matter? Because this is the line between privacy, feeling like friction, or advantage.

• When controls are manual or fragmented, privacy slows teams down.
• When controls are embedded and automated, privacy fades into the background and enables speed, trust, and confidence.

This is where privacy stops being a blocker and starts becoming infrastructure.

Strong Systems, Weak Signals: The Measurement Problem

Technically, many enterprises look ready. However, fewer than 10% of applications require manual intervention for individual-level data deletion.

But this operational capability is not matched by financial visibility:

• 75% of organizations have no dedicated privacy budget or visibility into privacy spend
• 75% do not calculate avoided breach or compliance costs

Among the minority that do measure value, the impact is significant. Avoided costs range from USD 100,000 to over USD 5 million annually.

Yet for most organizations, this value remains invisible. Privacy continues to be framed as risk avoidance rather than a measurable business asset. Board discussions stay qualitative. Investment decisions lack hard comparisons. The result is a familiar paradox: strong systems, weak signals.

What It Takes to Operationalize Privacy at Scale

The whitepaper makes one thing clear: the challenge is no longer awareness or intent. It is execution at scale. This is where Privy by IDfy plays a role.

Privy is designed to help enterprises move from policy-driven privacy to operational, technology-led privacy by:

• Embedding privacy checks directly into engineering and data workflows
• Continuously inspecting systems to surface privacy risks early, not after incidents
• Translating regulatory requirements into executable, automated controls
• Reducing manual reviews, rework, and operational friction

Instead of treating privacy as a one-time compliance activity, Privy helps make it a repeatable, scalable capability that works quietly in the background while teams move faster with confidence.

A Benchmark for Leaders Who Think They Are Ready

Privacy now operates after hours because uncertainty operates there.The most dangerous assumption today is not non-compliance. It is untested confidence in maturity. Many organizations are compliant enough, but few can clearly explain how resilient their privacy programs are under pressure.

This whitepaper provides benchmarks that help leaders distinguish:

• Capability from consistent execution
• Intent from measurable impact
• Baseline compliance from real maturity

If privacy is already a board-level concern in your organization, this research will feel uncomfortably familiar.

Download the whitepaper to understand where your organization truly stands in India’s evolving privacy landscape.

If you want to discuss what these findings mean for your enterprise or how to operationalize privacy at scale, reach out to us at shivani@idfy.com to continue the conversation.