The Digital Personal Data Protection Act (DPDP) makes data a Day 1 integration issue — not a post-close compliance workstream.
For foreign tech investors, the legal question is no longer just privacy policy compliance — it is cross-border transfer architecture, consent chain validity, AI model training datasets, and cloud localisation.
Domestic
For consumer tech and fintech businesses, DPDP compliance readiness is now directly priced into valuations.
Foreign
- Cross-border transfer architecture
- AI model training provenance
- Customer data ingestion rights
- Employee surveillance frameworks
- Cybersecurity incident reporting
- Health data segregation
Enforcement timeline — this is live now
The phased commencement is as follows:
- Phase 1 (effective 13 November 2025): Data Protection Board constitution, penalty framework, and procedural provisions (Sections 2, 18–26, 35–43, and Section 44(1) & (3)).
- Phase 2 (effective 13 November 2026): Consent Manager obligations and Significant Data Fiduciary designation (Section 6(9) and Section 27(1)(d)).
- Phase 3 (effective 13 May 2027): All substantive obligations — lawful basis for processing, consent, data subject rights, breach notification, security safeguards, and cross-border transfer restrictions (Sections 3–17, remaining provisions of Section 27, and Sections 28–34). Penalties under the Schedule run up to ₹250 crore per contravention.
Critically, India’s cross-border transfer regime takes a ‘negative list’ approach: data may flow to any country unless the government specifically restricts that jurisdiction, with no requirement to provide justification and no need for SCCs or adequacy decisions. No jurisdictions are currently blacklisted — but the government holds broad, unreviewable discretion.
For technology, fintech, and healthcare targets, DPDP compliance posture is now a deal-relevant diligence item, not a future concern.