# DPDP Act compliance costs loom as CFOs race against May 2027 deadline 2026-11-10T05:38:03+00:00 | Governance | Indian Opinion Desk Corroboration: 1 independent outlet Indian companies are spending heavily on consent management and security systems to comply with the Digital Personal Data Protection Act, 2023, as the final enforcement deadline approaches on May 13, 2027. Phase two of the implementation cycle, voluntary registration of consent managers, begins on November 12, 2026, exactly a year after the law was notified. The remaining substantive provisions require companies to provide privacy notices, obtain valid consent, implement security safeguards and report data breaches, with non-compliance penalties of Rs 50 crore to Rs 250 crore. CFOs from Raymond Lifestyle and V-Mart Retail told the Economic Times that the overhaul has required significant expenditure on systems, insurance and supply-chain compliance. Raymond CFO EC Prasad said cyber insurance premiums are rising because insurers are sceptical about covering data losses. V-Mart Retail CFO Anand Agarwal said proving valid consent for millions of counter interactions is operationally complex, and called for government clarity on tamper-proof consent records and retention periods. A single aligned breach-reporting route across DPDP and CERT-In requirements is also needed. ## Indian Opinion Analysis The compliance push is landing on CFOs, not just IT teams, making it a direct boardroom cost centre. The November 12 consent-manager registration kick-off forces companies to make their first concrete move, but the main operational burden, overhauling legacy systems, consent flows and supply-chain contracts, hangs over the May 2027 deadline. Ambiguities on tamper-proof consent records, retention periods and breach-reporting routes leave CFOs pricing risk without full regulatory clarity, while insurers' reluctance on cyber cover adds another cost layer. The core test for India Inc will be whether the May 2027 deadline holds, or whether industry requests for more granular guidance push the government toward phased enforcement. ## Coverage - economictimes.indiatimes.com Leads with CFO cost and ambiguity concerns, not government readiness This brief was synthesised by AI from the source linked above. Tags: CERT-In, CFO, DPDP Act, Raymond, V-Mart Retail Canonical: https://indianopinion.org/dpdp-act-compliance-costs-loom-as-cfos-race-against-may-2027-deadline/ License: Summary and commentary (c) Indian Opinion, reusable with attribution. Facts belong to the linked sources. Cite: https://indianopinion.org/dpdp-act-compliance-costs-loom-as-cfos-race-against-may-2027-deadline/#story-in-brief How this brief was made: an AI model read the report linked above and wrote this summary and analysis, which were published automatically. Published briefs are sampled every hour by an automated quality check; the editor verifies its findings and approves corrections, and corrected briefs carry a dated correction line. We do no original reporting. Methodology: https://indianopinion.org/ai-use-policy/