India's data privacy push is creating demand for a new breed of technology professionals who can translate regulations into working systems, as companies grapple with increasingly complex data environments and rapid adoption of artificial intelligence (AI). According to reports from The Times of India, privacy has traditionally been handled by legal, compliance and cybersecurity teams, but as the Digital Personal Data Protection (DPDP) Act moves towards implementation, companies are finding that having policies on paper is very different from making technology comply with them.
The challenge is that organisations are moving from legal and advisory work to putting structured policies and controls in place. As reported by The Times of India, Sachin Salian, senior VP and global business and delivery head at Writer Information, explained that this is moving from regulatory compliance to more of a technical compliance. Srinivas L, joint CEO and joint MD of 63SATS Cybertech, confirmed there is definitely a supply gap, with most people offering advisory services - gap assessments, creating policy documents and telling you how ready you are for DPDP. However, what is very scarce is engineering.
The challenge becomes clear when companies try to implement requirements such as allowing customers to withdraw consent. According to The Times of India, Srinivas noted that you have built these networks for the last 15 or 20 years and there is a system of data flow happening. There is no consent mechanism built into that data, making consent withdrawal and data erasure work across production systems require companies to rebuild complex data flows.
For Allcargo Group global CITO Kapil Mahajan, AI has changed the privacy question itself. As reported by The Times of India, AI can combine multiple legitimate data points to infer information a customer never explicitly provided. Mahajan explained that the whole privacy question was, who can access this data? That, to him, shifted. The new question is: what are we permitted to infer from it? He emphasized that the architecture now has to evolve from protecting data to governing intelligence, stating that just because technology can know something doesn't mean an enterprise should know it.
Companies are also struggling to demonstrate that privacy controls work across their systems. According to The Times of India, Salian noted that if tomorrow you ask whether you have deleted the data, you need to show the evidence. While tools for consent, cookie management and data mapping are emerging, Salian confirmed it is a journey. Legacy technology adds to the challenge, with mainframes and COBOL-based databases not designed for modern consent and data-lifecycle requirements.
