“Trust is becoming the new currency in the digital economy” 

India’s DPDP framework is pushing businesses to rethink how they collect, manage, and protect personal data. The real challenge lies in translating regulatory requirements into everyday operations, from tracking consent across interconnected systems to honouring withdrawals and holding third-party processors accountable.  

In this conversation, Abhinav Parashar, Co-founder and CEO of Digio, discusses the implementation gaps confronting Indian businesses, why consent must extend beyond a checkbox, and how embedding privacy into digital services can strengthen customer trust and create lasting competitive advantage. 

As Indian businesses move towards DPDP compliance, where do you see the biggest gap between understanding the rules and being ready to implement them? 

The biggest gap is between understanding the regulations and implementing them. Businesses often struggle to track where personal data sits, how it is used, and who has access to it. In many cases, organizations begin by assessing their existing processes, only to discover that personal data is spread across systems that are not always connected. This makes it difficult to establish a complete picture of data usage and identify what needs to change. Translating these findings into system-level changes can take considerably longer than anticipated, especially when multiple teams and external partners are involved.  

With 13 November 2026 marking an important milestone for Consent Manager registration under the DPDP framework, businesses need to ensure their systems can manage consent effectively. This requires mapping data flows, linking consent to specific purposes, and ensuring changes or withdrawals are reflected across systems and third-party providers.  

Another important aspect is accountability. Businesses must be able to demonstrate how consent was obtained, how it is being honored, and what action was taken when a customer changes their preferences. This calls for clear processes, audit trails, and coordination between technology, compliance, and business teams. At Digio, our work across digital onboarding, identity verification and payment workflows has shown us that DPDP readiness goes beyond updating privacy policies. It requires connected systems and processes that make responsible data use part of everyday operations. 

Consent is often treated as a one-time checkbox. What needs to change for businesses to manage consent properly throughout the customer relationship, including when someone withdraws it? 

Consent should not be treated as something a customer gives once and an organisation can rely on indefinitely. It needs to remain connected to the purpose for which the personal data was collected and how that data is used over time.  

For example, when a customer shares personal information to complete KYC, that does not automatically mean the information can be used for marketing. Similarly, authorising a recurring payment does not, by itself, permit an organisation to use the customer’s personal data for unrelated purposes. Businesses need to maintain a clear record of purpose-mapped consent; that is – what the individual agreed to and ensure that the consent is appropriate for the activity being undertaken. 

Withdrawal is where this becomes especially important. A customer might click a button to withdraw consent, but what happens next? Does the request reach the relevant downstream systems? Are third-party processors informed? Is further processing stopped where required? If these steps are not connected, the customer’s choice may be recorded without being properly acted upon. Businesses need to build processes that carry consent decisions through the customer lifecycle. This includes maintaining reliable records, communicating changes to relevant systems and partners, and being able to demonstrate what action was taken. The goal is to make consent meaningful in practice, not simply something that is captured during onboarding. 

A customer’s personal data can travel across several internal systems and third-party providers. How can businesses ensure that a change in consent is actually reflected across that entire chain? 

The first step is to know where the data goes. Businesses need to identify the systems that collect and process personal information, the teams that use it, and the external partners with whom it is shared. Without this visibility, it is difficult to know where a change in consent needs to be implemented. Once that picture is clear, businesses can connect consent records to the relevant systems and processing activities. If a Data Principal (DP) withdraws consent, the Data Fiduciary (DF) must ensure that the request is actioned across relevant systems and that its sub-processors are appropriately informed, as applicable. Organizations also need to track whether the necessary actions have been completed and identify instances where further intervention is required. 

This can be challenging for large organizations, particularly those working with legacy technology and multiple service providers. Coordinating consent-related changes across interconnected systems requires clear accountability and effective communication between the Data Fiduciary and its sub-processors. 

Our experience at Digio, where we help businesses connect identity verification, electronic signing and recurring payment workflows, reinforces the importance of making different systems work together. Consent management needs a similar approach. Recording a Data Principal’s decision is only the first step; the Data Fiduciary must ensure that the decision is communicated to the relevant systems and that appropriate action is taken by its sub-processors, where applicable. Ultimately, accountability means being able to demonstrate not just that a request was received, but also how it was actioned across the data-processing chain. 

Looking beyond the immediate compliance deadline, do you think DPDP will change how Indian businesses build customer trust and design digital services? What might the leaders in this area do differently? 

I believe DPDP will encourage businesses to think differently about the relationship between convenience, data use, and customer trust. As more services move online, customers should not have to choose between a seamless experience and a clear understanding of how their personal information is being used.  

Until now, many organizations have approached privacy primarily as a legal or compliance requirement. Going forward, it will need to be considered much earlier, when products and digital journeys are being designed. Businesses will need to think about what data they actually need, why they need it, how they explain that purpose to customers, and how they respond when customers change their preferences. 

Trust is becoming the new currency in the digital economy. Businesses that make privacy transparent and demonstrate that they respect customer choices can gain a competitive advantage, both in how customers perceive them and in the confidence they build over time. Progressive organizations will increasingly recognize that safeguarding personal information is not just about meeting regulatory requirements; it is also about strengthening customer relationships and differentiating their services in a competitive market.  

As consumers become more conscious of how their data is collected and used, their willingness to engage with a business will increasingly depend on the confidence they have in its data practices. This trust can influence customer acquisition, retention, and long-term loyalty, making privacy a business priority rather than solely a compliance function. 

The organizations that get this right will make privacy easier to understand and exercise, without introducing unnecessary friction into the customer experience. They will also invest in systems that help them honor customer choices consistently, rather than relying on manual processes or disconnected applications. Leaders in this space will look beyond simply obtaining consent and focus on ensuring that customer preferences are respected throughout the data lifecycle. This means creating greater transparency around data use, making it easier for customers to exercise their choices and ensuring that internal processes reflect those choices in practice. 

At Digio, we have seen how digital onboarding, identity verification and electronic signing can make business processes faster and simpler. The next step is to ensure that this convenience is supported by responsible data practices. Speed and ease of use matter, but so does giving customers confidence that their information is being handled appropriately.  

Over time, trust will depend on the difference between what a business promises and what it actually does. Organizations that build privacy and accountability into their services from the beginning will be better positioned to earn that trust, strengthen customer relationships and create lasting business value.