Ask most compliance teams where their risk evidence lives and the honest answer is “in a lot of spreadsheets.” That answer is about to get expensive.
On 13 May 2027, the core obligations of India’s Digital Personal Data Protection Rules become enforceable, with penalties of up to ₹250 crore. Banks and NBFCs already operate under the RBI’s IT governance directions, and SEBI’s cyber resilience framework now covers market intermediaries. The message from every regulator is the same: show us, don’t tell us.
A market growing at double digits
Organisations are responding with investment. Grand View Research values the global enterprise GRC market at about USD 72.4 billion in 2025 and expects it to reach USD 203.7 billion by 2033, growing 13.7% a year. It also expects India to grow faster than any other country.
Asia-Pacific is set to roughly double, from USD 3.94 billion in 2025 to USD 7.87 billion by 2030, according to MarketsandMarkets. India’s GRC solutions market is forecast to nearly double too, from USD 0.30 billion in 2024 to USD 0.59 billion by 2030 (Frost & Sullivan, via SEBI).
Four forces behind the shift
- Evidence over policy. A policy document no longer satisfies an inspector. Regulators expect named risk owners, tested controls and a clear audit trail.
- Cyber risk is business risk. A single ransomware attack is an IT outage, a regulatory reporting event and a board crisis all at once.
- Third parties carry hidden risk. You can outsource cloud, payments or customer support. You cannot outsource the accountability.
- Silos waste effort. When audit, risk and compliance each keep their own records, the same control is tested three times and no one sees the whole picture.
What this looks like in practice
Consider a mid-sized NBFC. A customer-data leak at its loan-processing vendor would trigger DPDP breach reporting, an RBI third-party risk review and questions from its board. With connected GRC, the team can see in minutes which vendor was involved, which controls covered it, when they were last tested and who owns the response. Without it, the same answers take days of email chasing, while the reporting clock keeps running.
AI moves from insight to action
GRC tools now use AI to map controls to new regulations, link related risks and flag control failures from live data, rather than waiting for the annual audit. But AI is only as good as the risk model underneath it, and every model used in business decisions needs its own owner, controls and audit trail.
Where to start
Assess where your obligations, risk owners and evidence actually sit today. Agree one risk and control framework before choosing any tool, then roll out in phases, starting where regulatory pressure is highest.
Five questions for your leadership team
- Who owns each of our top 20 risks, and which controls cover them?
- When were our key controls last tested, and where is the evidence?
- Which vendors handle our customers’ personal data?
- If a breach happened tonight, who would report it to the Data Protection Board, and how?
- Which AI models make business decisions, and who approved them?
If any answer takes more than a day to find, you have a GRC gap to close before May 2027.
Ready to close it? Timus Consulting helps organisations assess GRC maturity, prepare for DPDP, and implement and integrate GRC platforms that fit how they actually manage risk. Talk to our GRC team.
FAQs: Six Months to DPDP – Why GRC Is a Board-Level Priority
1. What is the DPDP Act, and why is it important for businesses?
The Digital Personal Data Protection (DPDP) Act, 2023, is India’s data protection law. It establishes requirements for collecting, processing, storing, and protecting personal data, making privacy compliance a critical business responsibility.
2. Why is DPDP compliance becoming a board-level priority?
DPDP compliance affects regulatory risk, customer trust, business continuity, and corporate reputation. Boards must ensure that organizations have effective data governance, risk management, and accountability frameworks in place.
3. What is the role of GRC in DPDP compliance?
Governance, Risk, and Compliance (GRC) helps organizations establish clear policies, assess privacy risks, monitor compliance obligations, maintain audit trails, and demonstrate accountability.
4. How can GRC solutions help organizations prepare for DPDP compliance?
GRC solutions can help organizations centralize compliance requirements, identify data privacy risks, automate assessments, manage incidents, track remediation activities, and generate compliance reports.
5. What are the key DPDP compliance challenges for enterprises?
Common challenges include identifying personal data across systems, managing consent, controlling access, responding to data breaches, maintaining accurate records, and coordinating compliance across departments.
