Data has quietly become one of the most valuable assets of almost every organisation. A hospital stores patient records and diagnostic reports, a university maintains years of student and applicant information, an NBFC processes KYC and financial information, while even a small business may have employee records, customer details, CCTV footage and thousands of contacts stored across its ERP, CRM, emails and Excel sheets. The Digital Personal Data Protection Act 2023, commonly referred to as the DPDP Act 2023, brings a new level of accountability to the way organisations collect, use, store, share and eventually erase digital personal data. For organisations operating in Delhi, Gurugram, Noida, Faridabad, Ghaziabad and the wider NCR, this is particularly relevant. Delhi NCR has a very high concentration of schools, universities, hospitals, financial institutions, IT companies, manufacturing businesses and service organisations. Delhi alone reported 5,556 recognised schools with around 44.91 lakh students in 2024-25. The Economic Survey of Delhi 2025-26 also reports 1,181 private hospitals and nursing homes as of December 2025. Add the education and healthcare ecosystems of Noida, Gurugram, Faridabad and Ghaziabad, and the volume of personal data being processed across NCR becomes enormous. This is why DPDP Act compliance in Delhi NCR deserves management attention today, rather than being treated as something that can be addressed when a problem arises. What is the DPDP Act 2023 and Why Does It Matter? The Digital Personal Data Protection Act provides India’s legal framework for processing digital personal data. At its heart, the idea is fairly straightforward: organisations may legitimately need personal data to conduct business and provide services, but the individuals to whom that data relates also have a right to protection of their personal data. Think about an ordinary company. It may have employee names, addresses, photographs, PAN information, salary details and bank accounts. Its sales team may have thousands of customer names, email addresses and mobile numbers. HR may have CVs of people who applied for jobs several years ago. CCTV systems may contain employee and visitor footage. Marketing teams may maintain old databases of prospects, while information may also exist with payroll providers, cloud platforms, CRM vendors and other service providers. The important question under the DPDP Act for businesses is therefore not simply whether the company has a privacy policy. The bigger question is whether the organisation actually understands its personal data. What are you collecting, why are you collecting it, where is it stored, who can access it, whom are you sharing it with, how are you protecting it, how long do you need it and what happens when you no longer need it? These questions form the foundation of a practical DPDP compliance framework. Why Delhi NCR Organisations Should Start Early It would not be correct to claim that the Government has officially announced that Delhi NCR will be the first region targeted for DPDP audits. There is no need to make such a claim either. The scale of personal-data processing in the region provides enough reason for organisations to prepare. Delhi NCR combines a large population with a dense concentration of educational institutions, healthcare facilities, corporate offices, financial-services companies, technology businesses and manufacturing units. Many of these organisations have also been operating for decades, which means the challenge is not restricted to the data being collected today. There can be years of historical personal data sitting across old applications, servers, backup systems, emails, laptops, spreadsheets and third-party platforms. The longer an organisation waits, the larger this data estate can become. DPDP Act compliance is therefore easier to approach as a planned exercise than as an emergency project initiated after a complaint, security incident or regulatory requirement. Education and healthcare illustrate this particularly well. Education: A Simple Example That Explains the DPDP Challenge Consider a university in Delhi NCR receiving 25,000 applications for 3,000 available seats. During the admission process, applicants may provide their name, photograph, date of birth, mobile number, email address, residential address, parents’ information, marksheets, identification documents, entrance examination information and payment details. The university eventually admits 3,000 students. The obvious question is: what happens to the personal data of the remaining 22,000 applicants? Some of it may remain in the admission portal. An Excel export may have been downloaded by the admission team. Documents may exist in employee email accounts. A cloud backup may contain another copy, and the technology provider operating the admission system may also hold data. Three years later, if someone asks why the university still possesses their documents, will the institution know exactly where that person’s information exists and why it is still being retained? This is where DPDP moves from being a legal subject to a management issue. For students who actually join the university, the situation becomes even more complex. Their information moves through admissions, academics, accounts, examinations, hostel administration, library systems, transport, learning-management systems, internship programmes and placement departments. After graduation, some information may move into alumni databases. A relationship that started with one admission form can create a trail of personal data across multiple departments and applications for many years. Schools have another important consideration because they routinely process children’s personal data. The DPDP framework contains specific provisions concerning children’s personal data, including requirements relating to verifiable parental consent, subject to the applicable provisions, Rules and exemptions. For schools, colleges and universities, delaying DPDP Act implementation can therefore make the eventual exercise harder. Every new academic session adds another batch of applicants, students, parents, documents, photographs, results, backups and digital records. The institution is not reducing its compliance problem by waiting; in many cases, it is increasing the volume of data that will eventually need to be understood and governed. A sensible starting point for an educational institution is a DPDP readiness assessment. Start with admissions, identify what information is collected and then follow that information through the organisation. The exercise often reveals data in places that senior management did not even know existed. Healthcare: Consider a 100-Bed Hospital Now consider a 100-bed multi-speciality hospital
