Business2 min
India's Data Protection Law Could Cost Small Firms More Than They Earn
An analysis of the DPDPA argues its compliance and marketing rules could hit start-ups and smaller businesses far harder than the bigger players.
India's Digital Personal Data Protection Act, known as the DPDPA, is drawing criticism for more than its limits on journalism. An analysis published on ThePrint argues that the law's obligations could impose heavy costs across nearly every sector, and that small businesses would bear the worst of it.
The law is an omnibus framework, so it reaches far beyond newsrooms. Compliance means companies must map where they collect, store and share personal information, build notice and consent processes, and create tools that let people correct or delete their data. Industry estimates cited in the analysis put first-year costs at Rs 10 lakh to Rs 1.5 crore for start-ups and SMEs, Rs 35 lakh to Rs 2.5 crore for mid-sized firms, and Rs 1.5 crore to Rs 18 crore for large companies.
For smaller companies, those numbers are steep. The analysis points to a survey of 330 firms in Shivamogga, Karnataka, where average first-year revenue came to about Rs 12.2 lakh. Even the lowest compliance estimate would consume more than 80 per cent of that revenue. That is a bigger problem than a line item on a budget: it could decide whether a young company survives its first year.
The hidden cost is opportunity. Engineers and product teams who would normally build features or improve existing products would instead spend months on compliance systems. For start-ups with thin budgets, that trade-off can slow innovation just when it matters most.
The analysis also says the law lacks a standard carve-out found in many privacy regimes, one that would let routine business activity continue without fresh consent. Marketing is the clearest example. A business needs a phone number or email address just to reach a prospective customer, yet under the DPDPA it cannot use that data for marketing until consent is secured. The result is a catch-22 that could make direct-to-consumer online marketing much harder to run, especially for smaller brands trying to find their first customers.
The government has the power to exempt MSMEs and start-ups from serving consent notices, but the analysis notes it is unclear whether that relief would also cover the opportunity costs created by the missing consent exemptions. Lawmakers, it argues, need to answer that question before the rules take effect. The full argument is available at ThePrint.
