Talking to TechGraph, Abhishek Agarwal, President, Judge India & Global Delivery at The Judge Group, discussed how data privacy has evolved from a compliance obligation into a strategic business priority as enterprises struggle to maintain visibility over sensitive information across increasingly complex cloud and digital environments, and how this shift is driving organisations to embed governance into infrastructure rather than treat it as an afterthought.
Agarwal also spoke about how this changing mindset is reshaping enterprise technology strategies, with privacy increasingly influencing infrastructure decisions from the outset instead of being addressed only after digital systems and transformation initiatives are already underway.
Read the interview in detail:
TechGraph: As organisations become increasingly data-driven and cloud-dependent, the volume of sensitive information flowing through digital infrastructure has grown significantly. How is this shift changing the way enterprises think about data privacy, and what concerns are coming up most frequently in your conversations with customers today?
Abhishek Agarwal: The shift has been significant enough that data privacy is no longer a back-office conversation. It now sits in boardroom discussions, vendor evaluations, and product design reviews in ways that were simply not the case five years ago. What we hear most frequently from customers today is a growing anxiety around visibility.
As data flows across multiple applications, third-party integrations, and cloud environments, organisations are finding it increasingly difficult to answer a deceptively simple question: where exactly is our sensitive data, and who has access to it? The second concern that consistently surfaces is insider risk and access governance.
Expanding digital footprints mean more entry points, more user permissions, and more opportunities for data to be mishandled. Organisations are realising that perimeter-based security thinking is no longer sufficient for the environments they are actually operating in.
TechGraph: For a long time, data centres were largely evaluated on storage capacity, uptime, and operational efficiency. With modern workloads demanding continuous access to data and real-time processing, how do you see the role of data centres evolving in this new technology landscape?
Abhishek Agarwal: The data centre of ten years ago was largely a storage and availability play. What organisations needed was reliable uptime and enough capacity to handle peak loads. That definition has expanded considerably. Today’s workloads, particularly those involving AI inference, real-time analytics, and edge computing, demand infrastructure that is not just available but genuinely intelligent in how it manages data movement and processing latency.
Data centres are evolving into active participants in the technology stack rather than passive repositories. This means closer integration with network architecture, smarter workload distribution, and increasingly, a role in ensuring that data processed within the facility meets the privacy and sovereignty requirements of the organisation using it.
The infrastructure conversation and the data governance conversation are converging, and the data centre strategy needs to reflect that reality going forward.
TechGraph: Cloud adoption has improved scalability and accessibility, but it has also increased the movement of data across multiple environments and service providers. What are some of the privacy risks organisations still tend to underestimate as they expand their digital ecosystems?
Abhishek Agarwal: The risks that get underestimated most consistently are the ones embedded in complexity rather than in any single obvious vulnerability. When an organisation works with multiple cloud providers, dozens of SaaS applications, and various third-party data processors, the cumulative exposure across that ecosystem is rarely mapped with the same rigour applied to individual components. Data lineage becomes murky.
Consent frameworks designed for one environment do not necessarily translate cleanly into another. Shadow IT remains a persistent problem, where business units adopt tools independently without adequate security or privacy review.
There is also a tendency to assume that contractual data processing agreements with vendors provide more protection than they actually do in practice. Accountability for a data breach does not transfer simply because a contract exists. Organisations expanding their digital ecosystems need to treat third-party risk management as an ongoing operational discipline, not a one-time procurement checkbox.
TechGraph: Many organisations continue to view data privacy through a compliance lens, while the growing dependence on data is forcing businesses to think more carefully about governance, ownership, and accountability. Do you think enterprise attitudes towards privacy are evolving quickly enough to keep pace with this shift?
Abhishek Agarwal: Honestly, the evolution is happening, but the pace is uneven. The organisations moving quickly are largely those that have experienced a significant incident, faced regulatory scrutiny, or operate in sectors where customer trust is directly tied to commercial performance. For many others, privacy governance still lags behind the actual risk exposure the business carries. Part of the problem is structural. Compliance frameworks create minimum standards, and many organisations optimise to meet those standards rather than building genuinely robust governance.
The shift from compliance thinking to accountability thinking requires treating data as an asset with defined ownership, clear stewardship responsibilities, and consequences when those responsibilities are not met.
That cultural and operational change takes longer than deploying a new tool. It requires leadership commitment, cross-functional coordination, and a willingness to build privacy considerations into business decisions rather than applying them retrospectively.
Word count: 148 words
TechGraph: There is growing discussion around data sovereignty, particularly as businesses become more conscious about where critical information is stored and processed. How do you see this influencing infrastructure and cloud decisions over the next few years?
Abhishek Agarwal: Data sovereignty has moved from a regulatory talking point to an active infrastructure criterion in procurement decisions, particularly for enterprises in regulated industries and for public sector organisations. The core concern is straightforward. Businesses want assurance that their critical data is stored and processed within jurisdictions where they understand the legal framework and where foreign government access provisions do not create unexpected exposure. This is influencing cloud decisions in several practical ways.
Multi-cloud strategies are being designed with geographic data residency requirements built in from the start rather than added later. On-premise or private cloud components are being retained specifically for the most sensitive workloads, even where public cloud is adopted broadly. Vendor selection increasingly involves detailed scrutiny of where data actually resides across the full service chain, not just where the primary provider’s servers are located. Sovereignty is reshaping what infrastructure flexibility actually means in practice.
TechGraph: Judge India Solutions works closely with enterprises across cloud, digital transformation, and emerging technology initiatives. As organisations modernise their infrastructure and move more critical workloads to digital environments, what shifts are you seeing in the way they approach data management and privacy?
Abhishek Agarwal: The most meaningful shift we are observing is the move toward treating data management and privacy as foundational design requirements rather than implementation considerations. Organisations that are modernising thoughtfully are building data classification, access controls, and privacy architecture into their infrastructure from the ground up. That is a different approach from the pattern of the previous decade, where digital transformation moved quickly and governance caught up slowly and imperfectly afterward.
We are also seeing stronger cross-functional ownership of data decisions. Chief Data Officers, legal teams, and security functions are collaborating earlier in technology initiatives rather than being consulted at the point of deployment.
At Judge India Solutions, our role in these conversations is to help organisations connect their transformation ambitions with the governance structures those ambitions require, ensuring that speed and accountability move together rather than in sequence.
TechGraph: The conversation around digital transformation is often centred on innovation and efficiency, yet resilience is becoming just as important as organisations grow more dependent on connected systems. How do you see the relationship between privacy, resilience, and business continuity evolving in the years ahead?
Abhishek Agarwal: These three areas are converging in ways that make it increasingly difficult to address any one of them in isolation. Resilience used to be primarily an uptime and disaster recovery conversation. Business continuity was about keeping operations running through disruption. Privacy was about protecting personal data and meeting regulatory obligations.
What is becoming clear is that a significant privacy failure is itself a business continuity event. The reputational damage, regulatory consequences, and customer trust erosion that follow a serious data breach can be as operationally damaging as a system outage. Organisations building resilient infrastructure now need to account for privacy incidents in their continuity planning, not as a separate workstream but as an integrated scenario.
This also means that the teams responsible for these functions need to work from shared frameworks and shared risk assessments rather than maintaining the organisational silos that have historically kept them apart.
TechGraph: Looking ahead, as enterprises become increasingly reliant on digital infrastructure, do you see data privacy emerging as a competitive differentiator rather than just a regulatory requirement? And where do you see Judge India Solutions contributing to that evolution?
Abhishek Agarwal: Privacy as a differentiator is already a reality in certain sectors, and it will become more broadly true as customer awareness and regulatory pressure both intensify. Organisations that can demonstrate responsible data stewardship, not just compliance but genuine accountability and transparency, are building a form of trust that translates into commercial advantage.
This is particularly visible in financial services, healthcare, and enterprise technology, where the cost of losing customer confidence around data handling far exceeds the investment required to get governance right. Judge India Solutions contributes to this evolution by helping organisations build the infrastructure, processes, and advisory frameworks that make privacy a genuine operational capability rather than a periodic audit exercise.
As enterprises grow more dependent on digital infrastructure, the ability to say credibly and verifiably that data is handled with integrity will matter more, not less. That is a capability worth building deliberately and early.
