DPDP Act compliance costs loom as CFOs race against May 2027 deadline

Indian companies are spending heavily on consent management and security systems to comply with the Digital Personal Data Protection Act, 2023, as the final enforcement deadline approaches on May 13, 2027. Phase two of the implementation cycle, voluntary registration of consent managers, begins on November 12, 2026, exactly a year after the law was notified. The remaining substantive provisions require companies to provide privacy notices, obtain valid consent, implement security safeguards and report data breaches, with non-compliance penalties of Rs 50 crore to Rs 250 crore.

CFOs from Raymond Lifestyle and V-Mart Retail told the Economic Times that the overhaul has required significant expenditure on systems, insurance and supply-chain compliance. Raymond CFO EC Prasad said cyber insurance premiums are rising because insurers are sceptical about covering data losses. V-Mart Retail CFO Anand Agarwal said proving valid consent for millions of counter interactions is operationally complex, and called for government clarity on tamper-proof consent records and retention periods. A single aligned breach-reporting route across DPDP and CERT-In requirements is also needed.