You cannot protect data you have not found: ComplyDPs Vipul Abhishek on building Indias answer to GDPR era compliance tools

Why Data Discovery Comes First

Vipul Abhishek of ComplyDP has argued that organisations cannot safeguard information they have not yet located, framing this as the central challenge of privacy compliance in India. His remarks, reported by TheWire.in on 19 October 2026, position data discovery as the foundation on which any credible compliance programme must be built. The observation is straightforward: protective measures, however sophisticated, are ineffective if a business does not know where its data resides or in what form.

The Context Of Compliance Tools

Abhishek's comments come as Indian enterprises increasingly prepare for a privacy regime widely compared to Europe's GDPR. ComplyDP is described as building compliance tools aimed at this emerging environment. The company's focus reflects a broader shift in the market, where software is being developed to help organisations map, classify and manage personal data rather than simply store it. The reference to GDPR-era tools signals that Indian businesses are expected to adopt practices similar to those followed in jurisdictions with mature data protection frameworks.

Why This Matters For Businesses

For companies handling personal data, the practical implication is that compliance begins with visibility, not paperwork. Regulators and auditors typically expect an organisation to demonstrate knowledge of its data holdings before it can show that safeguards are adequate. A business that cannot identify where data sits may struggle to respond to access requests, breach notifications or retention obligations. This has knock-on effects for legal, tax and compliance teams, who are often asked to certify processes they do not fully control. The rise of dedicated discovery and mapping tools suggests vendors see sustained demand from Indian firms seeking to close this gap.

What To Watch Next

Readers should track how Indian privacy rules evolve and whether enforcement priorities emphasise demonstrable data mapping. De…