DPDP Act implementation: No extension as startups face compliance deadline, says MeitY Secretary S. Krishnan

The government will not extend the implementation timelines for the Digital Personal Data Protection (DPDP) Act, 2023, MeitY Secretary S Krishnan said at an industry consultation in Bengaluru, urging startups to begin compliance preparations without delay.

Speaking virtually at a “Data Privacy Compliance Clinic” organised by Startup Policy Forum (SPF), Krishnan said the notified timelines would hold and that no extension was under consideration. He also urged companies to start their compliance work now rather than defer preparations.

Startups seek clarity on DPDP compliance

The consultation brought together around 30 SPF member companies, including Groww, Razorpay, Pine Labs, Meesho, CRED, Acko, SQ1 Security, Snabbit, Payglocal, Fam, Pronto, XFlow, Dezerv, Scaler, LenDenClub and Gullak, among others.

Krishnan said the DPDP framework has deliberately been designed around principles rather than prescriptive requirements. This approach allows companies to build compliance programmes based on the nature of personal data they process and the risks associated with such processing, he said.

The consultation was also addressed by Vikash Chourasia, Scientist 'D', MeitY, and Amar Patnaik, former Member of Parliament and a member of the Joint Parliamentary Committee that examined the data protection legislation. Patnaik provided context on the legislative process and the extent to which individual use cases were examined before the framework was finalised.

AI training, consent and breach reporting among key concerns

Startups sought clarity on several practical aspects of compliance, including the risk of “consent fatigue” and user drop-off during consent collection, the distinction between behavioural monitoring and legitimate processing, and the threshold for notifying personal data breaches.

The use of personal data for training artificial intelligence models also emerged as a key concern. Companies raised questions on implementing access and erasure requests at scale, whether account aggregators could act as consent managers and charge fees for such services, and how legacy data should be treated, including whether fresh consent would be required.

Shweta Rajpal Kohli, President and CEO, SPF, said the Ministry's message was clear that the timelines would hold and companies should start building their compliance systems now.

“The framework is principle-based, which gives our members room to design compliance that fits their business, but that flexibility only helps those who start early,” Kohli said.

Meanwhile, SPF will collate the issues raised during the consultation and take them up with MeitY as part of its ongoing engagement on the implementation of the DPDP framework. AP & Partners were knowledge partners for the session.