The DPDP Act’s rollout comes at a time when data privacy laws worldwide are becoming increasingly stringent. India’s law has been compared to the EU’s GDPR, and in many ways, DPDP is aligning India with global standards (strict consent, rights to individuals, hefty fines). Companies that operate internationally will find some synergy in their compliance efforts. Additionally, developments such as the EU’s
actions on Big Tech privacy violations and US state privacy laws have indirectly influenced expectations in India. Notably, large tech companies and industry bodies have been lobbying the government for sufficient transition time – reports suggested some Big Tech firms sought a 12–18 month window to comply fully. While the government is unlikely to grant that long formally, this does indicate that
multinationals are preparing for DPDP seriously. In the coming months, we anticipate more guidance through government FAQs, possibly sector-specific rules (since the Act allows different commencement dates/provisions for various sectors), and the emergence of compliance solutions (consent managers, advisory services) in the market. Companies should actively follow updates from MeitY (e.g., notifications on the meity.gov.in site or Gazette releases) and reputable law firms’ analyses for the latest interpretations.
Updates