Speed is being treated as a sign of seriousness. It's worth asking what accelerated DPDP timelines actually reveal about how the law will be enforced and interpreted.
February 2026 · 5 min read
Most of the commentary around DPDP's compressed timelines has been celebratory — speed treated as evidence of seriousness, urgency read as progress. We chose to hold off, not to be contrarian, but to let the applause settle before asking the harder question underneath it: what does this direction actually signal about how the law will be interpreted and enforced going forward?
What follows isn't a reaction to a timeline. It's how we read the Act's trajectory as both a constitutional and an operational framework.
It didn't read as consultation. It read as expectation-setting. The closed-door session with large technology companies on January 22 appears to have served one clear purpose: normalising compressed timelines as the default going forward, not an exception for a special case.
Foreign multinationals were the first audience, and that choice matters. Once urgency is accepted at that scale, it rarely stays contained to that group — banking, healthcare, telecom, and the rest of the regulated sectors tend to follow. This looks less like a one-off exception and more like deliberate sequencing, with urgency positioned as the baseline behaviour everyone will eventually be held to.
What stands out is what the government is choosing to operationalise first: state access, data retention, traffic logs, exemption frameworks, cross-border controls. Meanwhile, the safeguards that actually protect citizens remain structurally behind — the Data Protection Board itself is still missing, even as enforcement accelerates around it.
A rights-based law can't credibly front-load state-side powers while its own adjudicatory mechanism isn't yet in place. In India, rights protections have often survived because courts and citizens act as a corrective when the system moves too fast. That corrective weakens precisely when enforcement outpaces the institutions meant to check it.
The claim that accelerated provisions don't require significant change from organisations isn't just technically questionable — it's revealing in what it implies. When compliance gets framed as something absorbable with minimal effort, the implicit message to industry is that the law doesn't warrant deep attention. Less time isn't the same thing as urgency; it can just as easily read as an invitation to find the easiest path through, rather than the right one.
Data protection done properly involves deliberate choices — about retention, about access, about who's accountable for what. Those aren't choices organisations can make responsibly under compressed timelines without real trade-offs. When a law gets positioned as "easy to comply with," the actual risk isn't infrastructure strain. It's shallow engagement — and at scale, that produces superficial implementations, checkbox compliance, over-retention as a defensive habit, and systems built to pass scrutiny rather than to actually uphold the rights the law was written to protect.
When speed becomes the headline signal, seriousness quietly gets deprioritised — and that weakens the law well before any technical failure ever does.
The real risk isn't the compressed timeline on its own. It's ecosystem fragility. India's privacy ecosystem is still forming — interpretations are fluid, tooling is maturing, and even the solution providers building for this law are learning in real time as they go.
Blanket data-retention mandates sit directly at odds with privacy-by-design and purpose limitation. Requiring year-long retention of personal data and traffic logs pushes organisations toward keeping everything "just in case" — the opposite of what the underlying principles were meant to encourage. Once that happens, principles stop guiding behaviour and start functioning as decorative language: optional in practice, while enforcement stays anything but. That's the moment a rights-based law starts drifting into a procedural regime, hollowed out by its own operational priorities.
Privacy can't function as a fundamental right in theory and a scaled-down obligation in practice. Proposed exemptions for startups may look pragmatic on paper, but they introduce a real structural contradiction — different expectations, different risk thresholds, different standards of accountability, based on company size rather than the sensitivity of the data being processed.
Over time, that fragments the regime. A rights framework depends on being universal. Once privacy obligations start varying primarily by organisational size or convenience, the law starts to resemble a compliance menu more than a constitutional commitment — and that undercuts the DPDP Act's credibility as regulation and as a rights framework alike.
These observations are offered in the spirit of strengthening the DPDP framework as it moves from intent into implementation. A more measured pace now could help the law achieve what it set out to do, without unintended dilution along the way.
Whatever the pace of rulemaking, the practical response is the same — our DPDP gap assessment tells you where you actually stand today, independent of what happens next.
30 minutes to talk through your specific data footprint — no obligation.
Book a Consultation