Compliance cost may rise for firms

The cost of operations for companies and data fiduciaries dealing with user data in India is likely to increase over the next 18 months as they implement new systems for data mapping, deploy consent management tools, and establish data protection offices, according to industry and legal experts. These new systems must be implemented to comply with the rules of the Digital Personal Data Protection (DPDP) Act.

- AASHISH ARYAN

The rules, notified on November 14, say that while companies have to implement a data protection and consent management system by November 2026, the systems for data mapping or seeking individualised consent must be put in place by May 2027.

Arun Prabhu, partner and co-head of the digital, technology, media and telecommunications practice at Cyril Amarchand Mangaldas, said companies in Europe initially spent between $250,000 and $10 million when the General Data Protection Regulation (GDPR) was rolled out in May 2018.

"Companies, particularly those that are notified as Significant Data Fiduciaries, will have to make extensive investments in data mapping, process modification, consent management tools, tools to enable Data Principal Rights, and establish a well-structured Data Privacy Officer organisation," Prabhu said.

The information technology (IT) cost of the commercial banks, which is around 10-15 per cent of their total expenditure, is also set to increase as they align their systems along the lines of the Act.