In November 2025, Digital Personal Data Protection (DPDP) Rules were notified, and since then our feeds have been flooded with summaries, expert opinions about the 18-month timeline, the penalties, and the new grievance forms etc.
With the government setting a staggered timeline leading up to May 2027 for compliance, the consensus in many boardrooms is that we have a comfortable cushion.
People often think, "Why worry now when we have 18 months?"
This can be a major strategic blunder. Although privacy regulations are new to India, under other privacy regulations like General Data Protection Regulation (GDPR), cumulative fines have exceeded ₹500,000 crore, with an average penalty of up to ₹25 crore per violation. DPDPA has provisions for fines of up to ₹250 crore.
