Insights

For months, the Digital Personal Data Protection (DPDP) Act has been discussed largely as a legal or IT issue. Policies, notices, consent banners, checklists. That framing misses a core point.

DPDP is not asking businesses to “update documentation.” It is forcing them to confront how seriously they take governance, accountability, and operational discipline.

In that sense, DPDP is less about data, and more about maturity.

Indian businesses have scaled fast over the last decade. Data growth has outpaced governance in many organisations. Access models evolved quickly, while oversight mechanisms often lagged.

DPDP brings renewed focus to closing that gap.

It introduces a simple but uncomfortable question for leadership: Do we actually know who accesses personal data, why they access it, and whether that access is justified?

For many organizations, the honest answer is “no”.

Ignorance is bliss. No more.

There is a temptation to treat DPDP like older regulatory waves – produce policies, appoint a role, run a training session, and move on.

That approach will fail.

Remember GDPR?

When GDPR was first introduced in Europe, it was met with the same reactions now echoing across Indian boardrooms – confusion, resistance, delay, and quiet hope that enforcement would be slow.

That hope didn’t age well.

Within a few years, GDPR stopped being a regulation companies “prepared for” and became something they built around. Data protection moved into the organizational DNA – impacting product design, contracts, access models, vendor onboarding, and even how employees think about data.

My sense, India’s DPDP Act is on the same trajectory.

And the real question is not to be or not to be, it is who will adapt early and who will pay the price later.

Why?

Because now accountability is explicit.

The INR 250 crore penalty clause is not symbolic. It exists to force a mental reset.

For leadership teams, this means:

• Data risk is enterprise risk
• Compliance failures are board failures
• Ignorance is no longer a defence

Once the first few enforcement actions land, DPDP will stop being debated and start being embedded.

For mid-sized, growth-stage businesses, the risk is real.

Large enterprises already have legal teams, compliance budgets, and layered controls. Startups often build privacy-aware products from day one.

The most exposed segment is mid-sized, growth-stage companies.

These businesses typically:

• Handle large volumes of customer, employee, or partner data
• Scale operations faster than governance
• Rely on shared access, legacy systems, and third-party vendors
• Are actively fundraising, acquiring, or expanding

For them, DPDP is not just a compliance issue, it is a growth constraint or growth enabler, depending on readiness.

For them:

• A INR 250 crore penalty is existential
• Weak DPDP readiness can derail transactions
• Data risk becomes valuation risk

Implementation? That’s another story.

Here’s the uncomfortable truth: implementation will lag intent.

India currently faces:

• Limited operational clarity at execution levels
• Over-reliance on policy-heavy, process-light approaches
• A skills gap between legal interpretation and technical enforcement
• Fragmented ownership between business, IT, legal, and security teams

This creates a dangerous illusion of compliance, where documents exist, but control does not.

GDPR taught Europe a hard lesson: regulators do not reward effort, they reward outcomes.

DPDP enforcement is likely to follow a similar logic.

Bottomline. Embed data governance into business.

Companies that navigated GDPR successfully did one thing right, they embedded data governance into operating models, instead of treating it as an external obligation.

For Indian businesses, especially mid-market companies, this means:

• Designing access controls around roles and purpose
• Creating clear ownership for data decisions
• Ensuring traceability without slowing operations
• Aligning compliance with growth, not against it

DPDP is India’s moment of reset on data responsibility.

For businesses serious about scale, credibility, and longevity, DPDP is not optional, it is the new operating baseline.