Increase in Operational Costs for Data Fiduciaries

The cost of operations for companies dealing with user data in India is anticipated to rise over the next 18 months. This is due to the need for implementing new systems in compliance with the Digital Personal Data Protection (DPDP) Act, including data mapping, consent management tools, and data protection offices.

Implementation Timeline and Costs

• Data protection and consent management systems must be implemented by November 2026.
• Systems for data mapping or individualized consent are required by May 2027.
• European companies initially spent between $250,000 and $10 million for GDPR compliance in 2018.

Impact on Significant Data Fiduciaries

• Significant investments are needed in data mapping, process modification, and consent management tools.
• Establishment of a well-structured Data Privacy Officer organization is necessary.

Banking Sector Implications

• IT costs, currently 10-15% of total expenditure, are set to increase.
• Banks must conduct regular audits and monitor data flows continuously.

Compliance Challenges

• Annual data protection impact assessments and yearly audits are required for compliance.
• Continuous due diligence is needed to ensure technology does not pose risks to data principals' rights.

Broader Implications and Challenges

• Micro, small, and medium enterprises (MSMEs) may lack the capacity for comprehensive assessments and appointing Data Protection Officers.
• Data mapping is a resource-intensive process, hindered by data fragmentation and inadequate documentation.

Recommendations

• Enterprises should prioritize data discovery, classification, and data mapping exercises.
• Strengthening breach-response mechanisms and deploying technology-led governance tools is essential.

Key Concerns

• Data mapping across the organization.
• Setting up consent management and data protection offices.
• Annual data impact assessments and compliance audits.
• Potential fines for data breaches or unintentional retention.
• Legal complexities in cross-border data transfer and storage.