India's DPDP Act is now real: engineering privacy before the audit

India's Digital Personal Data Protection Act moved privacy from a policy page to an engineering requirement: consent that's specific and logged, purpose limitation, data minimisation, breach notification and deletion rights. For SMEs, the practical question is what these change in the codebase.

Six practices carry most of the weight. Consent captured per purpose with a timestamped log. Role-scoped access so employees see only the data their function needs. Audit logs on sensitive record views, not just edits. Encryption at rest and in transit as defaults. A deletion workflow that actually purges on request. And data inventory — you can't protect what no one has listed.

None of these require enterprise budgets; they require decisions made early. Retrofitting audit logging after a breach is archaeology; building it in is one middleware layer. The same is true for consent records — retrofitting consent is legally awkward; capturing it at intake is trivial.

Where we see SMEs exposed most: shared admin logins, exported Excel reports circulating on personal WhatsApp, and test environments loaded with production customer data. All three are cheap to fix and are exactly what an auditor (or a breach) will find first. Privacy architecture is cheaper than privacy incidents — always has been.