DPDP for Company Secretaries: the governance mandate nobody assigned
The market filed DPDP under "IT problem." It is a governance statute — penalty exposure sits with the Board, breach notification is a board event, and the compliance calendar is secretarial territory. That makes it a CS opportunity.
Why DPDP landed in the wrong inbox
Because the visible artefacts are technical — consent banners, encryption, DSAR portals — DPDP was routed to IT and legal ops. But look at where the Act actually places accountability: the Data Fiduciary (the company), penalties adjudicated against the entity with quantum influenced by governance evidence under Section 33(2), and — for Significant Data Fiduciaries — a DPO reporting not to the CTO but to the Board of Directors. The Act is written in the language of oversight, not of software.
Every element of that maps to the Company Secretary's existing toolkit: annual compliance calendars, board and committee agendas, statutory registers, policy adoption workflows, disclosure discipline, and minuted evidence of oversight.
The in-house CS: seven agenda items to own
1. Put DPDP on the board calendar
A standing agenda item — quarterly until readiness, half-yearly after. The minutes themselves become mitigation evidence: a Board that discussed, resourced, and tracked DPDP reads very differently to the Data Protection Board than one that never heard of it.
2. Anchor the policy suite
Privacy policy, retention policy, incident response plan, vendor data-processing standards — drafted by specialists, but adopted through proper board or committee resolution and reviewed on a cycle. Unadopted policies are opinions; adopted ones are governance.
3. Maintain the registers
A processing-activities register, a consent-records regime, a breach register, a Data Principal request log, and a processor/vendor register with contract status. CS professionals have maintained statutory registers for decades; these are the new ones.
4. Own the compliance calendar
Notice refresh dates, consent re-papering milestones before May 2027, DPIA and audit cycles for SDFs, vendor contract renewal gates, training cadence. One calendar, one owner, dated evidence.
5. Wire the breach escalation path
The 72-hour notification to the Data Protection Board is a disclosure event with board dimensions — directors must hear of a material breach from management, not media. The CS drafts the escalation matrix: who informs the Board, when, and what gets minuted.
6. Manage the DPO interface
In SDFs, the DPO's board reporting line runs through the machinery the CS operates: agenda access, reporting templates, committee routing (audit or risk committee), and independence protections analogous to internal audit.
7. Fold DPDP into director duties briefings
Directors are asking what DPDP means for them personally. The honest answer: penalties attach to the company, but board minutes showing indifference are what convert a "process gap" narrative into a "wilful neglect" one. Brief them accordingly.
The CS in practice: a new advisory line
For practising Company Secretaries, DPDP is the largest new compliance surface since the Companies Act 2013 — and the professional channel is wide open. CA firms have started packaging DPDP readiness reviews for their audit clients; the CS equivalent is arguably more natural, anchored in governance rather than financial audit. Services that fit the CS practice model: DPDP governance gap assessments, policy suite drafting and adoption support, register setup and annual maintenance retainers, board briefings and director training, secretarial-audit-adjacent DPDP compliance certificates, and standing "privacy compliance calendar" retainers for mid-market clients who will never hire a DPO.
The mid-market client base that already trusts its CS for ROC filings and board support does not want a Big-4 engagement — it wants its known advisor to add this to the stack. That is the same dynamic powering CA-firm DPDP partnerships, and it prices the same way: fixed-fee assessments leading to annual retainers.
Building a DPDP service line in your practice?
See how professional firms are packaging DPDP readiness for their clients — assessment templates, pricing models, and delivery workflow. Built for CA firms; the CS play is identical.
See the professional-firm playbook →Where to start this quarter
In-house: get DPDP onto the next board agenda with a one-page readiness snapshot (data inventory status, consent posture, breach preparedness, vendor exposure), propose the policy adoption calendar, and open the registers. In practice: pick five clients with obvious exposure — anyone processing customer data digitally at scale — and offer a fixed-fee governance gap assessment. The May 2027 enforcement deadline does the selling; the compliance calendar does the retaining.
Frequently asked questions
Can a Company Secretary be appointed as the DPO under DPDP?
For Significant Data Fiduciaries, the Act requires a DPO based in India who reports to the Board — it does not prescribe a professional qualification. A CS with privacy upskilling is a credible DPO candidate in governance-heavy organisations, though in data-intensive companies the role often pairs better with a technical deputy. For non-SDFs, a formally-titled DPO is not mandatory, but a named grievance officer is — a role a CS can hold or govern.
Does DPDP compliance fall under secretarial audit?
Secretarial audit under Section 204 covers compliance with applicable laws, and DPDP is now an applicable law for most companies processing digital personal data. Practising CS professionals should expect DPDP to enter secretarial audit checklists — and can get ahead of it by offering standalone DPDP governance reviews today.
What should appear in board minutes about DPDP?
Evidence of informed oversight: readiness status reviewed, budget and ownership assigned, policies adopted with review dates, breach escalation path approved, and progress against the May 2027 milestones tracked. Under Section 33(2), documented mitigation efforts and governance directly influence penalty quantum — minutes are the cheapest insurance the Act offers.