Seven assumptions now demand reconsideration: Consent alone establishes compliance; data should be retained indefinitely; cybersecurity ends at the perimeter; a privacy policy constitutes governance; vendor compliance belongs to the vendor; cross-border data flows are merely technical decisions; and platforms are neutral intermediaries.
For two decades, Indian businesses optimised for speed, scale and convenience. They collected data wherever it could create value and distributed it across email, CRM, HR and SaaS platforms, cloud repositories, messaging channels and third-party databases. Growth, efficiency and digital transformation took priority. Today, regulation is challenging the assumptions behind those practices. The critical task is not simply to learn new rules, but to unlearn old habits.
The central question is no longer, "Can we use this data?" It is, "Can we demonstrate that we were entitled to use it, protected it appropriately, governed it throughout its lifecycle and accounted for what happened to it?" This reflects a broader transition from informal digital operations to accountable digital governance.
The following seven assumptions illustrate the broader habits businesses must now unlearn. Each reflects a shift away from informal, document-led compliance and towards demonstrable accountability across the data lifecycle.
If we have consent, we're compliant
Many organisations still treat consent as the foundation of privacy compliance. Yet consent is only one part of a broader governance framework. Businesses must also be able to explain why they collected data, whether its use serves a legitimate purpose, who can access it, how long it is retained, how it is protected and what happens when it is no longer required.
Privacy is becoming a matter of accountability rather than paperwork. Organisations that focus only on obtaining consent may overlook their broader responsibilities as data stewards. The emerging expectation is not merely permission to process data, but the ability to justify, govern and audit its use throughout its lifecycle.
Data is an asset we can keep indefinitely
The prevailing assumption was that more data was always better. As storage costs fell and analytics capabilities expanded, organisations accumulated information in anticipation of future value. That logic is becoming increasingly difficult to defend.
Businesses should reconsider indefinite retention, excessive duplication, broad employee access, unnecessary data collection and the proliferation of sensitive information across multiple repositories. Many organisations cannot accurately determine what data they possess, where it resides, or whether it remains necessary. The challenge of the next decade may not be insufficient data. It may be excessive, duplicated, and poorly governed data.
Effective governance increasingly depends on disciplined retention practices, controlled access, clear distinctions between business records and personal information, and the ability to delete data when there is no legitimate reason to keep it. Data minimisation is becoming as important as data acquisition.
Cybersecurity ends at the firewall
Traditional cybersecurity focused on defending the perimeter — a model built for a world in which systems, users, and data largely remained inside the organisation’s network. Modern business no longer operates within those boundaries. Critical information moves across cloud environments, remote devices, SaaS platforms, third-party ecosystems and distributed workforces. Cybersecurity, therefore, cannot be reduced to technical controls managed by IT.
Effective cyber resilience requires strong identity and access management, privileged access controls, endpoint protection, secure cloud configuration, ransomware preparedness, backup integrity, incident response capabilities and business continuity planning. It also requires managing risks introduced by vendors, contractors and external platforms.
Most importantly, organisations must be prepared to demonstrate resilience. Stakeholders increasingly expect evidence that a business can detect incidents, respond effectively, preserve evidence and continue operating under adverse conditions. The conversation is shifting from prevention alone to preparedness, response and recovery.
A privacy policy equals privacy governance
Many companies can point to a carefully drafted privacy policy; far fewer can map and explain their actual data flows. A policy may not reveal what information the organisation holds, where it is stored, who can access it, which vendors process it, how long it is retained or whether it crosses national or jurisdictional boundaries. Nor may it explain what happens when an individual exercises a privacy right or when a breach occurs. This gap between documented commitments and operational reality is becoming a material governance risk.
For CEOs and boards, privacy governance increasingly requires visibility into how data moves through systems, business processes and third-party relationships. A policy may communicate intent, but governance is demonstrated through operational control and verifiable evidence.
Our vendors' compliance is their problem
Few organisations operate in isolation. Sensitive data routinely passes through cloud providers, payroll processors, recruitment platforms, CRM systems, marketing vendors, outsourced service providers and emerging AI tools. Strong internal controls are insufficient when critical data is handled elsewhere. The real challenge is not vendor onboarding, but continuing accountability: Organisations must understand how vendors process information, what security controls they maintain, whether subcontractors are involved, how incidents are reported and which obligations apply throughout the relationship.
Third-party data risk is rapidly becoming one of the defining governance issues of the digital economy. Businesses inherit exposure through the partners, platforms and key service providers. Managing that exposure requires continuous oversight rather than periodic compliance checks.
Cross-border data is an IT architecture decision
For multinational organisations, operational efficiency and global technology standards have often determined where data is stored. That approach is no longer sufficient. Cross-border data movement now implicates regulatory requirements, contractual obligations, cloud architecture, multinational governance frameworks, jurisdictional risk and vendor ecosystems. Where information is stored and processed can, therefore, carry significant legal, operational and reputational consequences.
Data transfers should therefore be treated as governed business decisions, not as technical consequences of adopting global platforms.
Platforms are neutral intermediaries
Businesses increasingly depend on digital marketplaces, social networks, payment systems, cloud infrastructure, advertising platforms and AI services to reach customers and operate at scale. These platforms create opportunity, but also dependency. Platform governance is becoming a critical component of enterprise risk management. Companies must understand not only the benefits platforms provide, but also the vulnerabilities and exposures they create.
From Compliance by Document to Compliance by Evidence
The defining shift of India’s digital regulatory decade is from
compliance by document to compliance by design and ultimately to compliance by
evidence. Policies remain necessary, but they are no longer sufficient.
The
author is Founder and CEO of Fios Compliance. Views expressed are personal.