Cracking the code of privacy compliance for conglomerates

The Digital Personal Data Protection Act, 2023 ("DPDP Act") was passed by the Indian Parliament and received Presidential assent in August 2023.

- GAURAV GOSWAMI

It has been notified in the Gazette but has not yet come into force, as the Central Government has not issued the commencement notification under Section 1(2) of the Act. In the interim, the Ministry of Electronics and Information Technology (MeitY) had released the draft Digital Personal Data Protection Rules, 2025 for public consultation. These developments mark the transition of India's privacy regime from abstract principles to an impending statutory framework.

While the absence of an official enforcement date limits the legal applicability of the Act, it does not diminish the urgency of preparation. Businesses—particularly large corporate groups with multiple subsidiaries and verticals—now find themselves in a critical preparatory phase. The current period offers a strategic window for designing and implementing internal privacy governance systems aligned with the anticipated regulatory requirements.

For conglomerates comprising multiple subsidiaries and functional verticals, this is a valuable opportunity to build a robust privacy framework that is compliant by design. Proactive alignment of systems, policies, contracts, and controls with the framework of the DPDP Act will enable a smoother transition once the law becomes operational. The challenge, however, lies in designing a privacy program that balances centralized strategic oversight with decentralized operational autonomy.