If a customer asked what personal data your business holds about them, how many systems would you check? For most companies it is several: the ERP, the CRM, the helpdesk, the HR system, the online store and the integrations connecting them.
India’s Digital Personal Data Protection (DPDP) Act, 2023 makes that question matter. This guide explains what the Act means for NetSuite, Zoho and Odoo users, and how Integs Cloud helps them prepare.
What the DPDP Act Requires
The Act governs how organisations process digital personal data in India and, in specified cases, outside India when offering goods or services to people in India. In business applications, that covers customer contacts, employee records, vendor contacts, purchase histories, support tickets and marketing leads.
| Obligation | Where it shows up in your apps |
|---|---|
| Notice and consent (certain legitimate uses also apply) | Web forms, lead capture, customer onboarding |
| Purpose limitation and accuracy | How teams use and maintain CRM and ERP records |
| Security safeguards | Roles, permissions, audit logs, backups, integrations |
| Retention and erasure | Old leads, inactive contacts, archives |
| Individual rights | Finding, correcting and erasing records across systems |
| Breach management | Incident response, escalation, system logs |
| Accountability | Ownership, policies, periodic reviews |
When It Applies, and Why to Start Now
The DPDP Rules, 2025 were notified in November 2025 with a phased start:
- November 2025: Institutional provisions, including those establishing the Data Protection Board of India, came into force.
- Mid-November 2026: Consent Manager provisions commence.
- May 2027: Most substantive obligations for businesses are scheduled to commence.
Data mapping, access reviews and integration changes take months, and other laws and customer contracts may already require strong security. Timelines can be amended, so confirm dates against the official MeitY notifications.
Oracle NetSuite: Access, Exports and Integrations
NetSuite holds financial data, customer and vendor records, employee information and transactions. We review roles and administrator rights, personal data in records and custom fields, CSV exports and saved searches, audit logs, and retention balanced against accounting and tax rules.
Integrations need special attention. When Shopify orders sync through Celigo into NetSuite and on to a CRM, a reporting tool and a marketing platform, one customer’s details can sit in five places, plus integration logs and error queues. Our Integration Data Flow and Privacy Assessment maps what each integration transfers, removes unnecessary fields, tightens API permissions and checks that corrections and erasure reach downstream copies.
Zoho: Consistency Across Apps
Personal data spreads across Zoho CRM, Forms, Campaigns, Desk, People, Books and Analytics, so privacy practices need to be consistent across the whole environment.
Take a business with 20,000 leads in Zoho CRM sending promotional emails through Zoho Campaigns. Where did the leads come from? Is consent recorded where it is the basis? Does a withdrawal reach every connected tool? Who can export contact lists? A consent checkbox alone is not compliance, so we help design workflows covering collection, preferences, access and retention.
Odoo: Connected Records and Custom Modules
Odoo combines CRM, accounting, HR, eCommerce, helpdesk and marketing in one database, often with custom modules and add-ons. Deleting a contact from the CRM may still leave personal data in invoices, tickets, attachments, backups and connected apps. We map these links, review administrator and database access and test copies of live data, and design erasure workflows that respect statutory retention.
Celigo: Integrations That Carry Personal Data
Celigo connects NetSuite and other business systems with e-commerce, CRM, HR and marketing apps, so it moves large volumes of personal data every day. We review each flow’s field mappings to stop unnecessary personal data from syncing, and restrict who can access connections, credentials and flow settings. We also check how error records and logs handle personal details, and make sure updates and deletions in one system are reflected in the others. The exact options depend on your Celigo plan and configuration.
Five Common DPDP Myths
| Myth | Reality |
|---|---|
| “DPDP is an IT project.” | Legal, HR, finance, marketing and management all have a role. |
| “Our ERP makes us compliant.” | Compliance depends on configuration, processes and how the software is used. |
| “Everything needs consent.” | Certain legitimate uses also apply, depending on the activity. |
| “We can just delete everything.” | Accounting and tax records often must be kept by law. |
| “An assessment is a certification.” | An assessment identifies gaps; it is not official DPDP certification. |
Five Questions to Check Your Readiness
If you are unsure about two or more, a structured review is worth it.
- Have we mapped where personal data is stored across our applications?
- Have we reviewed who can view, export and modify it?
- Do we know how it moves between our systems?
- Do we have a documented retention and erasure process that respects legal retention?
- Is someone responsible for coordinating DPDP readiness?
How Integs Cloud Can Help
Our DPDP Readiness & ERP Data Governance Assessment turns privacy requirements into practical changes in NetSuite, Zoho, Odoo and Celigo. It moves through discovery, data mapping, and access, process and integration reviews, and ends with a prioritised action plan with clear owners.
| Package | What it covers | Best suited for |
|---|---|---|
| Readiness Review | Discovery, data mapping, access review, gap assessment | Understanding where you stand |
| Implementation Support | Readiness review plus ERP, CRM, integration and workflow fixes | Closing identified gaps |
| Governance Support | Periodic reviews, documentation upkeep, agreed remediation | Ongoing support |
Scope depends on the number of applications and integration complexity. Legal interpretation should come from qualified privacy counsel; we focus on technology and operations.
Start Your DPDP Readiness Journey
The businesses that start now will reach May 2027 with clear data maps, tighter access and integrations they understand. Those that wait will be making the same changes under pressure.
In a free 30-minute discussion, our NetSuite, Zoho and Odoo specialists will look at how personal data moves through your applications and help you identify your first three priorities.
Contact Integs Cloud to book your DPDP readiness discussion
Disclaimer: This article is general information, not legal advice, a formal compliance assessment or a certification. Consult qualified legal professionals about your obligations, and verify software capabilities against your edition, plan and licensing.
