Chapter 24 — Investment Case, Staffing, Metrics and Ongoing Operations

1. The line item that protects revenue

Every preceding chapter has described work that costs money: people to run the rights services, engineers to build the deletion plane, auditors for the SDF cycle, tools for discovery and consent, drills for the breach playbook. Chapter 23 sequenced that spending; this chapter answers the three questions every CFO eventually asks — how much, who, and how will we know it worked?

The chapter begins by refusing the two cheapest answers. The first is the fine‑avoidance narrative – a framing that reduces the whole programme to a probability‑weighted penalty calculation and invites the board to gamble on never being caught. The second is the buy‑compliance myth – the procurement fallacy that a platform purchase substitutes for the evidence discipline no platform can supply (Part V, Chapter 25 – 30). Both shortcuts cripple the budget narrative because they hide the real driver of value: demonstrable control effectiveness.

Fund the work needed to meet applicable duties and maintain service, then test whether the chosen mechanisms operate as intended. These are separate from the economic claim that a programme causally reduced breaches or saved money. The latter needs a baseline, exposure and outcome measurements, an attribution method and uncertainty. A control log or a green fixture alone supplies none of those.

Section 33(2)(e) makes action to mitigate a breach, and its timeliness and effectiveness, relevant to penalty assessment; it provides no pass-rate discount or multiplier (ACT:827–846).[1] The programme’s funding floor must not depend on a wager about that outcome. Investment comparisons belong among lawful designs that meet the required scope, including a decision not to offer processing that cannot be responsibly supported.

2. The tension: visible cost versus invisible avoided exposure

The tension that makes privacy funding hard is structural, and naming it precisely is half the battle in the budget meeting.

• Visible cost. Salaries, allocated existing time, licences, integration, external review, operations and incident readiness consume real capacity. Internal allocation is not free merely because the payroll already exists.
• Uncertain benefit. Improved workflows may reduce handling effort or harm, but an avoided event is not automatically observed. A budget must distinguish stipulated benefits, measured outcomes and unquantified obligations.

Under-investment can leave a named owner without hours; over-investment can duplicate tooling or buy unused modules. The useful answer is a costed operating model with explicit demand, rates, scope and uncertainties. A dashboard makes gaps legible, not impossible. It should let the sponsor ask which legal and operational gates survive a proposed change, rather than treating expenditure or test counts as effectiveness by definition.

3. Building the investment case, in four parts

3.1 Legal floors, operational indicators and loss scenarios

A Schedule ceiling is a statutory maximum subject to the applicable provision and adjudication, not the expected loss of a failed fixture (ACT:827–846,1010–1045).[1] This chapter withdraws the former calculation “ceiling × (1 − pass rate)”. Test failures are useful control evidence, but their sampling mechanism has no established relationship to annual incident probability, severity or penalty. Summing those products compounds the error and may double-count related events.

A separate loss scenario can list interruption duration, affected systems, response work, customer remediation and uncertain legal consequences. Do not attach probabilities or avoided-loss totals without a defensible evidence model. Compare scenarios qualitatively where that is all the evidence supports. The budget below needs no invented breach probability to justify keeping applicable rights, safeguards and incident operations funded.

3.2 What has, and has not, been measured

No pilot record supports the previous claims of a 70-to-under-five-day detection improvement, ₹2 crore daily breach cost, supplier discounts or ₹3 crore annual savings. Those claims are removed, not relabelled “conservative”. The Chapter 23 case is a hypothetical migration design; its local state tests are not enterprise telemetry.

To establish an operational benefit later, retain a measurement plan before the change: population and time window, units, case types, excluded/failed outcomes, comparable baseline, system version and concurrent changes. Report manual hours and unresolved work as well as throughput. A reduction in average handling time may simply reflect automation of easy cases leaving harder cases to staff. Do not call that evidence that every service became faster. A supplier discount needs an actual quote or contract and a comparable scope; a proposed discount is a negotiating assumption.

3.3 A sized, hypothetical operating case

COST-001 uses the fixed fictional Company: 200 employees, 100,000 adult registered customers and 20,000 active loans. It remains not_designated as an SDF. The base workload is 600 incoming rights cases/month, 35% fully automated, 45 minutes of manual effort per remaining case, 120 productive case hours per FTE/month and a 1.5 peak multiplier. These are Q01 teaching parameters, not measured demand or legal targets. Privacy engineering, security, legal and vendor work are separately allocated rather than hidden inside case handling.

Manual cases = 600 × (1 − 0.35) = 390. Monthly manual hours = 390 × 45 / 60 = 292.5. Raw capacity = 292.5 / 120 = 2.4375 FTE; rounding up funds three case operators. Peak hours are 438.75, or 3.65625 FTE, rounded up to four. These calculations are executed in out/remediation/Q05/economics.py and recorded in cost-model.json and cost-model.xlsx. They do not establish a latency percentile or a statutory response outcome.

Productive case hours already exclude assumed leave, training and non-case activity; do not subtract the same allowance twice. The “fully automated” share must mean cases completed without manual work, not merely routed automatically. Human review of automated cases, reopens and exception handling belong in the measured effort or in a separate allocation. An arrival peak and a backlog accumulated over previous months are different inputs. For a live service, size the surge queue, skills, shifts and completion windows rather than rely on monthly averages.

3.4 Capacity and cost ownership

All rates and non-case allocations are authored assumptions, not typical salaries or a market benchmark. Existing allocated capacity is four FTE costing ₹126 lakh; incremental capacity is 3.5 FTE costing ₹84 lakh at those loaded rates. Together they total 7.5 FTE and ₹210 lakh (₹2.10 crore), not the former unsupported 17-FTE claim or an overfilled ₹12-crore bucket. Fractional allocations are hours to reserve from named existing people; they are not fractions of a person who can independently cover an on-call shift.

The privacy lead is voluntary in the base Company, with the conditional SDF DPO requirements separately mapped in Chapter 19. The business sponsor remains accountable for processing decisions; DPO/privacy advice does not substitute for that accountability. The audit liaison prepares evidence and cannot simply be declared the independent data auditor. Section 10(2) specifies the DPO features, independent auditor and recurring measures for an SDF; it does not prescribe this staffing roster (ACT:418–438).[1]

3.5 Metered external costs and the funding envelope

The licence assumes 20 seats for twelve months; scanning assumes 2,000 GB each month; notice units include retries; storage assumes 600 GB average occupancy over twelve months. A seat-month, scan GB, message attempt and stored GB-month are not interchangeable. No supplier is represented by these prices. External connector maintenance is supplier work separate from internal BAU engineers. The voluntary review line is not an actual audit engagement or proof that its scope meets a future SDF requirement.

External recurring cost totals ₹29.02 lakh. Added to staffing, recurring resource cost is ₹239.02 lakh (₹2.3902 crore). One-off external integration is 1,200 hours at ₹2,500/hour, or ₹30 lakh. Year-one resource cost is therefore ₹269.02 lakh (₹2.6902 crore). A hypothetical 10% contingency yields a ₹295.922-lakh funding envelope (₹2.95922 crore). Contingency is unallocated reserve, not a known expense; the build/recurring distinction is not an accounting determination of capitalisation.

For a narrower incremental-funding view, ₹84 lakh of new allocated staff cost plus ₹29.02 lakh external recurring and ₹30 lakh build gives ₹143.02 lakh, or ₹157.322 lakh with the same reserve. This is a planning proxy, not audited cash flow: loaded rates include overhead, existing staff may need backfill and supplier payment timing differs from expense recognition. Report both resource and incremental views so neither free-existing-capacity nor double-counting can hide in the headline.

GST/tax, financing, incident loss, core infrastructure, dedicated 24×7 coverage and as-yet-unscoped sector increments are excluded. No lawful obligation is waived by that exclusion: if applicability adds scope, cost it before launch or restrict the service. The model is a transparent worked decision, not a universal price for DPDP implementation.

3.6 Demand and rate sensitivity

The low scenario assumes 400 cases, 45% fully automated, 35 minutes manual handling, 130 productive hours and 1.3 peak. The high scenario assumes 900 cases, 20% automated, 60 minutes, 110 hours and 1.8 peak. Low/high also apply 0.8/1.2 rate factors to all staff, external-unit and build rates. All are hypothetical; these are stress combinations, not confidence intervals or probabilities. Other estate/meter volumes are held fixed so the reader can see exactly what changes.

The table excludes contingency and annualises peak staffing for a full year. It is not the expected cost of a short seasonal surge. Recalculate a temporary arrangement using actual duration, availability and ramp-up effort before approving it. The high case shows why “three operators” is not a legal or operational staffing norm. Also test single-parameter changes: a vendor price rise changes cost without changing workload, while a lower automation success rate changes both work and the capacity needed to contain backlog.

The workbook is a clearly labelled static calculated snapshot, not a live formula workbook. To change it, edit cost-inputs.json and run python out/remediation/Q05/build_cost.py; the script regenerates both JSON and XLSX and rereads every populated cell. The runnable arithmetic, input assumptions and output totals are supplied together. No Excel/LibreOffice recalculation or visual workbook rendering is claimed.

4. The metrics: the BAU dashboard

The dashboard separates obligation status from service performance and cost. These are recommended operating views, not statutory tolerances.

Sections 11–12 and Rule 14 do not prescribe the former blanket access/correction/erasure SLA. Section 13/Rule 14(3) concern a published reasonable grievance-response period not exceeding ninety days (ACT:441–487; RULES:1294–1318).[1][5] Rule 7 requires affected-person and initial Board intimations without delay on awareness, with detailed Board information within 72 hours or an allowed longer period on written request (RULES:1112–1139).[5] Keep these legal clocks separate from chosen internal response or escalation targets. A missed internal target is a management finding; whether a statutory requirement was breached needs its own facts and source mapping.

5. The ongoing operations loop

The funded operating loop recommends monthly capacity/meter review and quarterly sponsor review, with immediate escalation for a known mandatory failure. These cadences are internal design choices. For an SDF, Rule 13 supplies DPIA and audit once per twelve-month period from designation/class inclusion, significant-observations reporting and additional measures; this is not a rule for “bi-annual high-risk obligations” (RULES:1276–1293).[5]

The BAU handoff names a responsible operator and backup for every control, access and runbooks, case backlog, evidence location and disposal owner, review calendar and known restricted paths. The business sponsor approves capacity. An independent auditor evaluates within the required role; no regulator-callable drill endpoint is claimed or necessary to explain this operating model. A proposed dashboard service is not a shipped production capability.

A role assignment without protected hours is an unfunded obligation in practice. Reconcile the four existing FTE allocations with the relevant managers, including what work moves or is backfilled. Protect operator training and escalation time from being consumed by average-case throughput targets. If a processor queue is repeatedly unresolved, the answer may be a better adapter and contract/evidence process rather than another case handler.

6. Two funding decisions, with different answers

A constraint-year decision. Suppose the sponsor asks for a 20% reduction. This is a hypothetical request, not a measured client result. The team first partitions mandatory scope, optional enhancements and discretionary rollout. It may defer an unapproved training use, buy fewer unused modules, reduce duplicate scanning where coverage is preserved, or commission a narrower integration. It may not delete lower-penalty obligations from the register. Before recording savings, recalculate the changed units and ensure that retention, rights and incident paths remain covered.

If no lawful design fits the reduced envelope, the responsible answer is to increase funding or stop/re-scope the affected processing. A risk signature does not fund an unfunded control, and “generic” penalty category is not a legal exemption. The cost model provides scenario arithmetic, not an assertion that a particular 20% cut is feasible.

A peak-capacity decision. At base assumptions, three funded rights FTE cover average workload but four are needed under the peak factor. That does not automatically require a permanent fourth hire. The sponsor can reserve cross-trained surge capacity, purchase a bounded overflow service with appropriate access/processor controls, or change a lawful workflow to reduce effort. Each option needs availability and evidence; a name on a roster does not prove it will absorb peak work.

The cost workbook shows an annualised base peak year-one resource cost of ₹2.8102 crore versus ₹2.6902 crore normal, before contingency. A temporary surge would have a different cost. The decision is not “hire two because privacy says so”, but “supply the additional peak capability, retain ownership, and verify the service under realistic arrivals”. None of the local arithmetic demonstrates a production response percentile.

7. What remains for the reader and the reviewer

The worked budget is complete as a hypothetical calculation. Before applying it, replace assumed volumes, effort, rates, licence terms and non-case allocations with actual estate evidence; confirm sector increments and any SDF designation; and validate queue performance and staffing availability. Those are implementation inputs, not undisclosed observed benefits. Rule 14’s grievance period and Rule 13’s cycle are already read above; no future transfer-tag amendment or missing basic Rules reading is used to defer the cost model.

The question that hands the book its next chapter

With the operating model staffed, funded, and measured, the programme can finally answer the question Part V exists for — what should we buy, from whom, and how will we know it works? — with the full discipline of twenty‑four chapters behind the answer. Chapter 25 opens Part V — Solutions, Accelerators and Build‑versus‑Buy with The DPDP Solution Landscape: the evidence ledger that keeps every vendor claim in its place.

References (sources retained)

• DPDP Act 2023 (Section 8(9), Section 10, Section 13) — research/legal/evidence/01_dpdp_act_2023_gazette.txt.
• Rules GSR 846(E) (Rule 14, Rule 15) — research/legal/evidence/05_gsr_846e_dpdp_rules_2025.txt.
• Operating-model templates: out/templates/operating-model/OPERATION_TEMPLATE.md; engineering workpaper: out/templates/engineering/ENGINEERING_EVIDENCE_TEMPLATE.md; scorecard: out/templates/procurement/RFP_SCORECARD_TEMPLATE.xlsx.
• Chapters 6 (scenario bands), 22 (the grid the metrics read), 23 (the spend sequenced), 36 (the loop this chapter funds).

Source keys and evidence limits

Line locators use newline-based retained text, not PDF page numbers. Primary sources were reread locally; no complete live legal-update search or entity-specific opinion is asserted. Vendor passages are documented claims, not observed capabilities.

• COMM: research/legal/evidence/02_gsr_843e_commencement.txt.
• RULES: research/legal/evidence/05_gsr_846e_dpdp_rules_2025.txt.
• CORR: research/legal/evidence/06_gsr_892e_corrigendum.txt.
• ACT: research/legal/evidence/01_dpdp_act_2023_gazette.txt.

Sources

[1] https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf — Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) [2] https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf — G.S.R. 843(E), DPDP Act commencement notification [5] https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf — Digital Personal Data Protection Rules, 2025, G.S.R. 846(E) [6] https://www.meity.gov.in/static/uploads/2025/12/3c7ebbae0e5456f493f486e6845df86b.pdf — Corrigenda to G.S.R. 846(E), G.S.R. 892(E)

Contents · Reader guide and citation conventions · Artifact index