DPDP Act: Time for Indian cos to catch up?

The impending Digital Personal Data Protection (DPDP) Act in India is poised to reshape the landscape for both foreign and Indian adtech companies, presenting a complex array of challenges and opportunities. As the industry braces for this significant regulatory shift, experts weigh in on its potential impact and the varying implications for multinational corporations (MNCs) and homegrown tech providers.

The Act's divergence from global norms, such as the General Data Protection Regulation (GDPR), presents a unique challenge for MNCs. Goldie Dhama, Partner at Deloitte, highlights, “Unlike the GDPR, which many MNCs are familiar with, the DPDP Act introduces certain specific compliance requirements, such as data localization and explicit rules around children's data. The divergence from global norms may mean MNCs will need to adapt their existing systems significantly to align with India-specific requirements.”

However, this regulatory shift may level the playing field to some extent. Siddharth Devnani, Co-Founder and Director of SoCheers, observes, “Most local firms inherently don't care for user privacy - it is unfortunately not in our culture and nor is it in our business interest. That is why we see rampant use of email and SMS marketing databases being sold for peanuts.” He argues that while international big-tech firms have already adapted to global privacy norms, it's time for Indian companies to catch up.

The impact of the DPDP Act on smaller, homegrown tech companies is a matter of debate among experts. Ankit Sahni, Partner at Ajay Sahni & Associates, suggests, “For smaller, homegrown tech companies, navigating DPDP rules might appear less daunting initially due to their agility and local market understanding. However, the lack of financial resources and legal expertise to implement robust compliance measures, may expose them to a greater risk of non-compliance."

Conversely, Ankita Singh, Co-Founder of A&P Partners, argues, “Smaller, homegrown tech providers, on the other hand, might have more flexibility and agility to adapt quickly to local rules. However, they could be disadvantaged by fewer resources, which could make compliance harder to achieve.”

The Act's emphasis on data localization could have far-reaching implications for both foreign and Indian companies. Prakhar Srivastava, Financial Controller at White Rivers Media, suggests, “The emphasis on data localisation could prompt international platforms to expand their infrastructure in India, paving the way for meaningful collaborations and fresh innovation.”

Seher Ali, Partner at Antares Legal, provides a comprehensive view of the challenges faced by both MNCs and smaller tech providers. For MNCs, she notes, “DPDP mandates data localization for certain categories of personal data and limits cross-border transfers to countries deemed 'trusted' by the Indian government. This could require MNCs to establish local data centres in India.”

While MNCs have the resources to address these challenges, the scale and complexity of adapting large, global operations make compliance a significant hurdle. For smaller tech providers, Ali points out, “They may lack the ability to invest in local data storage solutions and
typically depend on global cloud platforms, which may or may not fully comply with Indian-specific regulations. Ensuring proper data classification, implementing user consent mechanisms, and meeting data protection officer requirements could also stretch their operational bandwidth.”

As the industry awaits further clarity on the implementation of the DPDP Act, both foreign and Indian AdTech companies are gearing up for a period of significant adaptation. The Act's impact will likely be felt across the board, with companies of all sizes facing unique challenges. However, it also presents an opportunity for innovation and the development of privacy-first solutions that could set new standards for the global AdTech industry.

Ultimately, as Devnani concludes, “Those who innovate beyond the current advertising standards will be rewarded from all sides.” The DPDP Act may well serve as a catalyst for a new era of ethical, privacy-conscious adtech solutions in India, reshaping the industry landscape for both foreign and domestic players.