⁠India's data law has HDFC Bank, Amazon, Paytm, and others shopping for consent

Snigdha Sharma (0:00)

If you use WhatsApp, you have probably received messages from companies. Delivery updates, payment reminders, promotional offers. Sometimes it's a brand that you remember interacting with, sometimes it isn't. The messages though still arrive and most of the time, you ignore them or you delete them without much thought.

But behind those messages sits a growing legal question in India. When is a company allowed to contact you, and what permission did you actually give them to do so?

That question has become harder to answer since India's Digital Personal Data Protection Act became operational in November last year. The law reshapes how companies can collect, store and use personal data, including something as basic as your phone number. Consent now has specific requirements. It has to be free, informed, specific and unambiguous. Users can ask companies what data they hold, correct it, delete it or withdraw consent entirely. And companies are required to build systems that make these rights usable, not theoretical. For businesses, this has changed how everyday communication works. Even something as familiar as a WhatsApp promotion can trigger internal debates about compliance. Founders and compliance teams are spending hours discussing who initiated a conversation, what permissions exist and how those permissions are recorded.

One of the people fielding these questions is Gaurav Mehta, the founder of Concur, a startup working in compliance management. Since the law took effect, his role has involved translating legal language into operational decisions that companies can follow across teams and platforms. And the deadline for full compliance is mid 2027 But preparations are already underway. Companies are investing significant sums to avoid penalties that can run into hundreds of crores of rupees. At the same time, an entire industry seems to be forming to help businesses manage consent at scale. Now, as that industry grows, a larger issue is slowly coming into focus. The systems being built today will decide how much control users really have over their data, including who gets to speak to them and under what terms.

Welcome to Daybreak, a business podcast from The Ken. I'm your host, Snigdha Sharma, and I don't chase the news cycle. Instead, every day of the week, my colleague Rachel Varghese and I will come to you with one business story that is worth understanding and worth your time.

Once the Data Protection Law became operational, companies quickly realized that compliance was not going to be a simple checklist. It required new systems, new rules and new budgets. Enterprises began asking what compliance actually looks like on the ground, and many of those questions started landing with a new class of startups.

One of them is Concur, which I mentioned earlier, founded by Gaurav Mehta. His work involves translating the law into something that companies can execute across teams and technologies. That translation has value. For large enterprises, compliance services can cost up to 18 crore rupees in the first two years and about 10 crores every year after that.

Penalties for non-compliance, meanwhile, can go up to 250 crore rupees with higher exposure when children's data is involved. Raghuveer Kancherla, the co-founder of Governance and Compliance at firm Sprinto, spoke to my colleague, the Ken reporter, Inderpal Singh, and he compared compliance to finance. In the same way that finance teams maintain accounts, compliance teams now have to manage consent frameworks and privacy obligations. And this shift has helped create a market that Shashank Karinjati, the co-founder of consent management startup Redacto, estimates to be worth at least 2000 crore rupees in India.

Still, building the space is not straightforward. Consent, at some point, stops becoming a legal question and becomes a systems problem. It has to work across channels, vendors and internal teams, and it also has to be enforced through technology.

Large enterprises often gravitate towards established players. Some work with Indian KYC companies like IDFEE, while others rely on multinational governance companies that bring experience from Europe's GDPR regime. Platforms such as Privy by IDFEE integrate consent and data governance directly into enterprise systems. But what happens as a result is attention around definitions. The law specifies that a consent manager must be incorporated in India and avoid conflicts of interest with data fiduciaries. Startups like Concur and Redacto argue that this excludes KYC firms and foreign headquartered companies, and KYC firms do not agree.

If the market cannot resolve this disagreement, it will fall to the Data Protection Board of India, which is expected to begin registering consent managers in November. Until then, companies are still moving ahead, even as the rules continue to take shape. For more on this, stay tuned.

Some of the risks that the law is trying to address are already visible. For example, in early 2025, a large trading platform hired the data security firm matters.ai to audit its systems. The audit uncovered something quite troubling. A former employee who had left 3 years earlier had set up a script that siphons sensitive information to a telegram channel.