According to a recent EY survey of nearly 150 professionals across sectors, India Inc remains significantly underprepared to manage privacy risks from third-party vendors, processors and partners embedded within enterprise systems. As reported by EY, over 80% of organizations have not updated their privacy governance structures or policies, while more than 83% have not initiated DPDP implementation across processes and systems including vendor controls. Third-party privacy risk assessments, periodic audits and contract remediation remain among the least adopted compliance activities across sectors.
Under the Digital Personal Data Protection (DPDP) framework, companies classified as Data Fiduciaries are fully responsible for how their vendors process personal data. This includes IT service providers, cloud platforms, SaaS vendors, BPO partners and analytics firms. As noted by EY, even though Data Processors are not directly regulated, any lapse on their part becomes the fiduciary's legal and reputational liability. The DPDP Rules were notified in November 2025 with an 18-month compliance clock now underway.
EY's survey reveals significant gaps between awareness and execution, with around 30% of respondents reporting moderate to low awareness of the DPDP Act, with even larger gaps at operational levels. Sectors with complex vendor ecosystems, including healthcare, manufacturing, education, shipping and metals, show lower readiness than financial services and technology sectors. Nearly 71% of respondents cited difficulty in adopting privacy technology in legacy environments, while almost 59% flagged a lack of subject-matter expertise as a key barrier to compliance.
According to EY's analysis, vendor exposure is particularly acute under DPDP mandates, which include strict breach-reporting timelines requiring notification to the Data Protection Board and affected individuals within 72 hours. Vendors must also support one-year log retention, security safeguards and grievance redressal - obligations many are currently unequipped to meet. Despite this, many organizations have only identified vendors handling personal data without validating whether they can actually meet DPDP requirements in practice.
EY warns that delayed action on vendor governance could translate into penalties, operational disruption and reputational damage as the compliance deadline approaches. The report emphasizes that privacy is no longer a contractual checkbox but an operational control, with vendor risk now enterprise risk. With the DPDP Rules notified and the compliance clock underway, EY stresses the urgent need for organizations to address third-party privacy governance to avoid potential regulatory and reputational consequences.
