Should businesses act now on DPDP Act compliance?

The passage of the Digital Personal Data Protection Act 2023 (“DPDP Act”) has ushered in a transformative era for privacy governance in India.

- KHUSHBU JAIN

Businesses now face a crucial strategic decision whether to commence compliance preparations immediately or wait for the government to formally notify detailed rules. The latter approach, often driven by uncertainty and the desire to defer change, is fraught with risks that can jeopardize regulatory standing as well as corporate reputation. With Presidential assent, the DPDP Act is already a binding framework.

The core demands of the DPDP Act are both wide ranging and complex. At the heart of its requirements is the mandate to map every instance of personal data handling within an organization for example, from collection points to erasure protocols ensuring visibility and accountability across the entire lifecycle of personal data. Alongside this, the Act requires businesses to establish robust mechanisms for obtaining, managing and revoking consent, as well as enabling and honoring the rights of individuals whose data is processed. Implementing these elements calls for a functional collaboration between IT, legal, Marketing, HR, procurement, sales and operations teams, a task that cannot be achieved overnight.