India’s DPDP Act to usher in a new era of accountable, trust-first data governance

India’s Digital Personal Data Protection Act (DPDP) is no longer an impending reform but an unfolding reality—and enterprises are only beginning to grasp the magnitude of the shift ahead. With the rules notified and the enforcement clock ticking, the Act has moved from policy discourse into boardroom strategy. According to Mayuran Palanisamy, Partner, Deloitte India, the first signals are already visible. The government’s rapid formation of the Data Protection Board indicates that this is not a symbolic exercise but a committed regulatory transformation. The true inflection point, he notes, will be the early actions of the Board—its first penalties, its approach to breach cases, and the tone set through public advisories. These will reveal whether the initial phase before May 2027 focuses on guidance and capacity-building or a sharper compliance drive.

The enforcement timelines themselves leave little room for ambiguity. Foundational provisions and ...