DPDP Rules: Firms get breathing space, but work begins now

The clock has started ticking for enterprises to align with the newly notified Digital Personal Data Protection (DPDP) Rules, with experts saying that the 18-month transition must be treated not as a grace period but as an execution runway. Although the phased rollout offers breathing room, companies will have to move fast on redesigning consent architecture, notices, governance structures, vendor contracts, breach-response systems and international data transfer flows to avoid bottlenecks as the deadline approaches. Probir Roy Chowdhury, Partner, JSA Advocates & Solicitors, said that with the Data Protection Board getting operational first, and staggered compliance kicking in, the next year and a half will be crucial for shifting from planning to on-ground execution while balancing user rights with business practicality. Read more