For years, the unspoken rule across Indian tech and corporate IT was simple: hoard everything, just in case.
Every mobile number collected at a retail checkout counter, every Aadhaar scan sitting unencrypted on an office desktop, every behavioral event tracked across an e-commerce catalog was treated as free data collateral. Nobody cared because there was no financial consequence for being careless.
The Digital Personal Data Protection Act (DPDPA) effectively ends that era.
With penalties reaching up to ₹250 crore per violation, data privacy is no longer a footnote buried inside a 40-page terms-of-service agreement that nobody reads. It is now an operational hazard if handled poorly and a massive competitive advantage if handled right.
The Reality Check: What the Law Actually Asks For
Forget the legal jargon for a second. The DPDPA boils down to three straightforward rules that break almost every legacy system built in India over the past decade:
- You only take what you need right now. If an app delivers food, it does not need 24/7 background location or contact list access.
- Consent must be itemized and withdrawable. Pre-ticked checkboxes and blanket “by continuing you agree” banners are invalid. The user has to be able to revoke consent as easily as they gave it.
- When the purpose ends, the data goes. If a user deletes their account or stops using a service, keeping their profile around “for analytics” exposes the company to direct regulatory action.
How the Fallout Looks Across Different Sectors
The impact is not uniform. Different industries are running headfirst into entirely different architectural headaches:
1. Fintech and BFSI
Fintech startups face a direct conflict between the DPDPA and sectoral regulators like the Reserve Bank of India (RBI).
- The tension: Under DPDPA, a user has the right to demand erasure of their personal data. But under PMLA (Prevention of Money Laundering Act) and RBI guidelines, banks must retain customer KYC and transaction logs for at least five to ten years.
- The practical fix: Financial institutions have to isolate operational identity data from regulatory audit trails. You might delete the marketing profile, but you cannot legally purge the transaction ledger.
2. E-Commerce and D2C Brands
Direct-to-consumer brands rely heavily on behavioral tracking, pixel retargeting, and aggressive WhatsApp outreach.
- The tension: The DPDPA cracks down hard on “dark patterns”—subtle interface tricks that nudge users into sharing more data than they intend.
- The practical fix: Marketing teams can no longer scrape phone numbers from abandoned checkouts and blast users on WhatsApp without explicit opt-ins. Consent strings must now be logged alongside time stamps in an auditable database.
3. Healthtech and Diagnostics
Health data is arguably the most sensitive asset in play, especially when digital prescription platforms share records with partner pharmacies and pathology labs.
- The tension: The supply chain of patient data is often fragmented across multiple third-party vendors, many of whom run on insecure legacy infrastructure.
- The practical fix: Under the DPDPA, the Data Fiduciary (the consumer-facing app) remains on the hook even if the breach happens at the partner lab. Every vendor contract needs immediate re-negotiation to enforce end-to-end encryption and audit rights.
4. IT Services and SaaS Providers
Global clients are already rewriting vendor contracts. If an Indian SaaS product or IT service provider handles client data, foreign partners expect contractual indemnities aligned with both the GDPR and the DPDPA.
What Implementation Actually Looks Like (Hint: It’s Not Buying Software)
Too many leadership teams think compliance is a box to check by purchasing an enterprise privacy tool. In reality, privacy is an engineering and operational overhaul:
- Conduct an honest Data Audit: Find out where data actually lives. More often than not, customer data isn’t just in the production database; it’s sitting in staging environments, old Google Sheets, Slack channels, and marketing dashboards.
- Clean up the Vendor Chain: Your security is only as strong as your sloppy third-party API integration. Audit every analytics script, customer-support widget, and payment gateway tied to your platform.
- Build a true Data Disposal Pipeline: Most companies know how to write data to disk; almost none have automated systems to safely prune it. Building automated retention and deletion scripts is where the real engineering hours go.
- Train Frontline Staff: A ₹100 crore breach rarely starts with a zero-day exploit; it starts with an employee sending an unencrypted customer database over an unauthenticated email or falling for a basic phishing lure.
The Bottom Line
Companies that treat the DPDPA as an annoying legal checklist will spend the next few years fighting fines, regulatory inquiries, and PR crises.
The companies that treat it as a fundamental discipline—refining architectures, purging zombie databases, and earning customer trust—will build cleaner, faster, and far more resilient businesses.
Comment down below and share your views as well!