India Inc is incurring high compliance expenditure while also dealing with certain ambiguities as it prepares to implement the Digital Personal Data Protection (DPDP) Act, 2023. Over the past six to nine months, chief financial officers have been busy onboarding enterprise consent management software while also strengthening their existing security systems to avoid heavy penalties for non-compliance.
Phase two of the implementation cycle, which involves the voluntary registration of consent managers, begins on November 12, 2026, exactly a year after the law was notified in 2025. Under the Act, consent managers will provide a single, transparent and interoperable platform through which a data principal may give, manage and withdraw consent.
The remaining substantive provisions of the DPDP Act and Rules are scheduled to come into effect from May 13, 2027, requiring companies to provide clear privacy notices, obtain valid consent for processing personal data, implement reasonable security safeguards and establish mechanisms for reporting data breaches.
The provisions also introduce stricter requirements for processing children’s data, impose additional compliance obligations on Significant Data Fiduciaries and provide individuals with rights to access, correct, update and seek erasure of their personal data. Companies will also have to review data retention practices, third-party data processing arrangements and grievance redressal mechanisms to ensure compliance. Non-compliance with these provisions can lead to fines ranging from Rs 50 crore to Rs 250 crore.
“This involves significant expenditure for the business. We have to ensure a higher level of security not just within our own systems but also across the extended organisation, including our distribution network, so that there are no data leakages at their end,” said EC Prasad, CFO, Raymond Lifestyle.
That said, increasing cyber insurance premiums are also adding to costs, as insurers are sceptical about providing coverage for cyber-related data losses, having incurred substantial losses in this area over time, Prasad explained.
“Given the requirements under the DPDP framework and the potential penal provisions, the level of cyber insurance coverage needs to increase substantially. If a data breach or other incident occurs, the financial outflow could be significant,” Prasad said.
CFOs say the consent management process is already underway, with companies having begun taking consent from customers.
“We have been working on the implementation of the DPDP framework for almost nine months. It has required us to overhaul our entire customer database, consent management systems and data archival systems,” said Anand Agarwal, CFO, V-Mart Retail.
Agarwal explained that this is a huge exercise for a retail company dealing with millions of records. The core challenge lies in its omnichannel scale, as customer data flows across stores, digital channels, loyalty, HR, supply chain and external partners.
Legacy systems, which were designed to share data, now have to stop its use when consent is withdrawn.
“At a large retail scale, proving valid consent for millions of quick counter interactions is operationally complex. Government clarity is needed on what constitutes an adequate, tamper-proof consent record and its retention period. Retailers need practical guidance on whether a mobile number collected at billing is legitimate use, and how assisted in-store consent should work,” Agarwal said.
Moreover, CFOs said a single and aligned breach-reporting route is needed across DPDP and CERT-In requirements.
The retention question
One of the main concerns for CFOs are related to the timeline for data retention and the level of detail that needs to be retained. Under the DPDP Act, the core rule for data retention is “purpose limitation”. Companies are legally required to erase personal data as soon as the specific purpose for which it was collected has been fulfilled.
“Clear rules are required to balance data-erasure requests with tax and other statutory record-keeping obligations, and to define liability for partner lapses,” Agarwal said.
Managing supply chain compliance
Another critical challenge is managing the extended supply chain and taking responsibility for the systems through which customer data may flow. Under the DPDP Act, the primary company (the Data Fiduciary) remains wholly and solely responsible to the regulator for any data breach, even if it happens entirely at the supplier’s (the Data Processor’s) end.
“Where the stores are owned by us or operate under our exclusive model, it is relatively easier to ensure that the required systems and controls are in place. But in multi-brand outlets, we cannot directly implement our own systems. If a data leak occurs at their end, our control is limited. Accordingly, we are obtaining declarations from these partners that their systems are adequately protected and taking written assurances and indemnities to mitigate the associated risks,” said Prasad.
CFOs also said that while the high penalties for a data breach will ensure initial compliance, they still need rationalisation.
“The implementation and the consequences of a default need to be rationalised. There should be a strong mechanism for companies to safeguard personal information, but if a breach or default occurs, the response should reflect the actual circumstances,” said Sanjeev Jha, CFO, PERSOL India.
Jha added that DPDP enforcement will not depend on consumer awareness and that as people become more aware of their rights and understand what they can do if their data is misused, the framework will gain greater traction.
CFOs agreed that timely notifications on Significant Data Fiduciary thresholds and cross-border restrictions, plus guidance-led early enforcement and safeguards against frivolous complaints, will make implementation more workable.
“We have also submitted requests through the appropriate forums seeking clarifications on certain aspects and highlighting areas where some relaxations may be required. There will continue to be ambiguities as companies move closer to execution and finalisation,” said Agarwal.
