Industry and policy experts have raised serious concerns over the government’s proposal to compress compliance timelines under India’s Digital Personal Data Protection (DPDP) Rules, warning that the move could place heavy pressure on startups, strain smaller businesses and create new challenges for large enterprises.
Speaking at a media briefing organised by InGovern Research Services, experts acknowledged the importance of strong data privacy safeguards but cautioned that rushing implementation could lead to unintended economic consequences. They pointed out that reducing the transition period from the originally proposed 18 months to 12 months, and in some areas introducing immediate enforcement, could significantly increase operational costs and weaken investor confidence at a time when India’s startup ecosystem is seeking stability and growth.
Participants emphasised that businesses are not resisting compliance but are seeking realistic timelines to implement complex changes. According to speakers, meaningful compliance requires more than policy updates. It demands major upgrades to technology infrastructure, governance systems and internal processes, all of which require time, resources and clear regulatory guidance.
Shriram Subramanian, Founder of InGovern Research Services, said that while data protection is necessary, the framework must avoid penalising companies through impractical execution timelines. He noted that mandatory requirements such as extended data and log retention create recurring financial burdens that large organisations may struggle to absorb and that early-stage companies may find even harder to manage. If not carefully calibrated, he warned, the new rules could favour scale over innovation.
Legal and operational challenges were also highlighted during the discussion. Shreya Suri, Partner at IndusLaw, pointed out that obligations such as one-year mandatory data retention and audit readiness would require extensive re-engineering of IT systems and contractual arrangements. She added that even where exemptions are available, the compliance workload remains significant and called for a phased, risk-based rollout to ensure the law achieves its intended goals without disrupting business growth.
Startups were identified as the most vulnerable segment. Experts said young companies often lack the storage capacity, compliance teams and financial flexibility required to meet new regulatory demands at short notice. Additional spending on data storage, cybersecurity and breach management could divert limited capital away from hiring, product development and market expansion.
Investors are also watching the situation closely. Lloyd Mathias, Angel Investor, said regulatory cost structures play a critical role in funding decisions. He noted that uncertainty around compliance expenses and penalties can affect startup burn rates and reduce investor appetite, potentially slowing innovation across the broader ecosystem.
Another key concern raised at the briefing was the lack of clarity around the classification of Significant Data Fiduciaries (SDFs). Without knowing whether they fall under this category, companies face difficulties in budgeting, workforce planning and governance design. At the same time, proposed shorter timelines for SDF-related obligations such as audits and data protection impact assessments add to the uncertainty.
Experts also expressed caution about enforcement readiness. With the Data Protection Board expected to operate digitally and individuals able to file complaints easily, premature enforcement could trigger disputes and compliance anxiety, especially among smaller firms without dedicated legal teams. Speakers noted that even public institutions will require time to adapt to the new framework due to the scale of operational changes involved.
The briefing concluded with a call for a more predictable and proportionate rollout. Participants urged authorities to retain the original 18-month transition period and introduce phased, threshold-based compliance requirements. They also referenced international examples such as the European Union’s GDPR, which allowed organisations two years to prepare before enforcement began, supported by extensive regulatory guidance and stakeholder engagement.
Experts agreed that India has the opportunity to emerge as a global leader in digital data protection. However, they stressed that this leadership will depend on thoughtful implementation that protects citizens’ privacy while preserving the momentum of the country’s fast-growing digital economy.
Subscribe Deshwale on YouTube
