Cyber Resilience & India's DPDP Act: A CEO's View

𝐁𝐞𝐲𝐨𝐧𝐝 𝐂𝐨𝐦𝐩𝐥𝐢𝐚𝐧𝐜𝐞: 𝐁𝐮𝐢𝐥𝐝𝐢𝐧𝐠 𝐂𝐲𝐛𝐞𝐫 𝐑𝐞𝐬𝐢𝐥𝐢𝐞𝐧𝐜𝐞 𝐢𝐧 𝐭𝐡𝐞 𝐄𝐫𝐚 𝐨𝐟 𝐈𝐧𝐝𝐢𝐚'𝐬 𝐃𝐏𝐃𝐏 𝐀𝐜𝐭 – 𝐀 𝐂𝐄𝐎'𝐬 𝐏𝐞𝐫𝐬𝐩𝐞𝐜𝐭𝐢𝐯𝐞
By Dheeraj K Sharma

As India's digital ecosystem expands, cybersecurity is becoming a business priority. Evolving threats and regulations are compelling organisations to rethink how they protect data, manage risks and ensure operational continuity.
With over two decades in information security and auditing, I believe cybersecurity must go beyond compliance. India's DPDP Act, 2023, strengthens data accountability, but the challenge lies in translating its requirements into effective security practices.

Passing an audit does not necessarily mean an organisation is prepared for a cyber incident. Compliance establishes a baseline, while resilience depends on consistent implementation and monitoring of security practices.

Organisations must understand where their data resides, who accesses it and how it is protected. With data moving across cloud platforms, applications and third-party vendors, clear ownership, restricted access, encryption and monitoring are essential.

My experience across 1000+ security audits in banking, manufacturing, FMCG and aviation reinforces the importance of moving beyond documentation-driven compliance. Frameworks such as ISO 27001, PCI DSS and SOC 2 provide valuable security structures, but their effectiveness depends on regular assessments and implementation.

Incident preparedness is equally important. Organisations need proactive threat monitoring, security testing and defined response mechanisms. Simulated breach scenarios help leadership teams assess readiness and strengthen recovery processes.

Third-party risk also requires attention. Outsourcing operations does not eliminate security responsibilities. Data handling, access permissions and incident reporting expectations must be established across the partner ecosystem.

Cyber resilience requires an organisational culture built around awareness and accountability. Regular employee training and responsible data-handling practices are essential.

From a CEO's perspective, cyber resilience is linked to business continuity, reputation and stakeholder confidence. A data breach can disrupt operations, create financial exposure and damage business relationships. Cybersecurity must therefore be part of strategic planning, not merely an IT function.
The DPDP Act offers Indian businesses an opportunity to strengthen data governance. Organisations must look beyond compliance checklists and build accountable security practices.

I look forward to sharing my perspectives on the evolving cybersecurity landscape, regulatory compliance and how Indian organisations can strengthen their cyber resilience. The goal is to build organisations that are compliant, prepared and capable of maintaining trust.