By Abilash Soundararajan, Founder & CEO of PrivaSapien
India’s digital economy isn’t a side story to the country’s growth anymore – it’s fast becoming the main one, contributing close to a fifth of GDP as consumer journeys, credit decisions, and B2B SaaS workflows keep moving online. The Digital Personal Data Protection (DPDP) Act 2023 recognises something important about that shift: individuals have rights over their data, but businesses also need to process that data lawfully to operate at scale. Read that way, DPDP isn’t a restriction on India’s digital economy. It’s what makes compliant, large-scale data processing a licensed right to operate within it – not an IT checkbox, but a precondition for doing digital business in India at all.
Here’s what most conversations around DPDP miss: India isn’t building this consent-driven model from scratch. It’s formalising something the country has already proven works at a scale no one else has attempted. NITI Aayog’s Data Empowerment and Protection Architecture laid the groundwork for consent-based data sharing through independent Consent Managers, and RBI’s Account Aggregator framework put that model into production for financial data.
The Ayushman Bharat Digital Mission took the same architecture into healthcare – over 100 crore digital health records now linked, shared only with explicit patient consent, at a scale most health systems in the world couldn’t attempt. ONDC has extended the same open, consent-driven thinking to commerce. When DPDP Rules mandate registered Consent Managers as the backbone of lawful data sharing, they’re not inventing a new mechanism – they’re generalising one India has already stress-tested in production, across finance and healthcare, for years.
That matters enormously for how businesses should read this moment. The notified DPDP Rules 2025 make governance concrete – detailed expectations on notices, consent, security, retention, and breach reporting mean “how you govern data” is now a regulated capability, not internal hygiene. And here’s a detail most boards miss: DPDP’s own penalty structure puts technical safeguards, not consent paperwork, at the top of the risk table – failing to implement them draws penalties up to Rs 250 crore, higher than the penalty for consent or impact-assessment lapses. The law itself is telling businesses that architecture matters more than documentation.
That reading just got official backing from an unexpected direction. RBI released a draft Guidance on Regulatory Expectations for Data Governance this week, applicable to banks, NBFCs, and other regulated entities, and it treats data the same way: as a Board-level accountability, not an IT function. It calls for a Board Data Governance Committee, named Data Owners and Stewards for every data domain, a documented “single source of truth” with full lineage tracking, and governance extended contractually to every third party a regulated entity shares data with – and it states outright that all of this must comply with the DPDP Act and Rules. When a financial regulator makes data architecture a Board responsibility in the same breath as citing DPDP, that’s a signal to every other sector too.
None of this should be read as India playing catch-up with global privacy regimes. It’s closer to the opposite. India already has digital public infrastructure cooperation agreements with more than twenty countries, and UPI now operates in multiple overseas markets. The same story is playing out with the consent-driven architecture underneath DPDP, with RBI’s new guidance now extending that discipline to how regulated entities manage and trace data internally. Other countries are still debating how to operationalise “consent” beyond a checkbox on a website. India has been running consent-based data-sharing infrastructure in production for years, at a scale of hundreds of millions of users, and is now building the board-level governance architecture to match it.
That’s exactly why this is a business imperative rather than a legal one. Enterprises that invest early in technical safeguards, consent management, and data lineage aren’t just avoiding penalties of up to Rs 250 crore once full DPDP enforcement lands in May 2027. They’re aligning with the trust-driven model that’s already made India’s digital public infrastructure a global reference point – and that’s what lets them serve global clients and participate in AI ecosystems without fragmentation, while less-prepared competitors are still explaining data provenance to auditors instead of closing deals.
So the practical path forward, in the order regulators are actually prioritising it: build the technical safeguards first, since that’s where both the largest DPDP penalty exposure and RBI’s new architecture expectations sit. Map where personal data actually moves through your business, establish clear data ownership, and only then formalise the consent and retention paperwork around it. Treat the DPDP soft-enforcement window before May 2027 not as a countdown to a deadline, but as the moment India’s digital businesses either build on the trust infrastructure this country has already pioneered, or fall behind the ones that do.