DPDP Rules is an Opportunity for Startups to Innovate, Attract Pro Privacy Clients Apart from lack of transparency in the consultation process, issues related to vagueness, over-reliance on discretionary powers, weak accountability mechanisms, and unclear exemptions exist.

The recent release of the long-awaited Digital Personal Data Protection Rules, 2025 (DPDP Rules) for public consultation, could be a massive opportunity for startups to innovate and implement robust data management and consent mechanisms which in turn could attract privacy-conscious customers.

"The DPDP Act introduces a structured framework for data protection, which will require startups to implement robust data management and consent mechanisms. This may initially increase operational complexity and costs, particularly for startups that rely heavily on data-driven models. However, this also presents an opportunity for startups to differentiate themselves by prioritizing privacy and security, thereby building trust with customers and stakeholders. Startups that successfully integrate these practices can leverage them as a competitive advantage, potentially attracting privacy-conscious consumers and partners," said Tisha Bhambry, Director Analyst at Gartner.

There is an opportunity for innovation in developing new tools and solutions that help other businesses align with the Act, opening avenues for startups in the data protection and privacy tech space, said Bhambry.

Analysts have however pointed out that the draft rules under the DPDP Act leave several areas ambiguous, particularly for startups. "One key area is the potential exemptions for startups. While the Act suggests that certain provisions may not apply to startups, the criteria and scope for these exemptions are not clearly defined in the draft rules, creating uncertainty as startups plan their strategies," Bhambry said.

Another area of ambiguity, she said, is related to cross-border data transfers. The draft rules do not clearly outline the specific requirements or restrictions for transferring data outside India, which is crucial for startups that rely on international data flows and partnerships. Understanding which countries might be restricted and what measures are necessary remains unclear.

Additionally, while the draft rules mention the role of "Consent Managers" and the need for robust consent mechanisms, the specifics of how startups should implement these systems are not fully detailed, leaving room for interpretation, Bhambry said.

According to the Internet Freedom Foundation, apart from lack of transparency in the consultation process, issues related to vagueness, over-reliance on discretionary powers, weak accountability mechanisms, and unclear exemptions exist.

Further, the requirement for Verifiable Parental Consent (VPC) for children's data is contestable on multiple levels. "There seems to be no internet-wide age gating and only individuals who identify themselves as children require VPC. Hence, if the government requires age verification (rather than self-declarations) to check if a user is a minor, it may in future require every online user to verify their age through Government credentials. This holds the potential for mass surveillance with government IDs linked to every user's online credentials. These provisions also violate principles of data minimization or retention limitations and risk over-collection and prolonged storage of personal data," Internet Freedom Foundation said in a statement.

Social impact consultancy Space2Grow believes more transparency is required in Section 9 for protecting children's data.

"The DPDP rules have been much awaited. Speaking of specifically Section 9—protecting children's data—the rules are not very prescriptive and gives enough freedom, for platforms to choose options and processes. This flexibility demands higher accountability from platforms. Without easy and accessible mechanisms for verifiable parental consent from parents, many children may resort to falsifying their age to bypass this or will increase the digital divide. Shifting the burden of proof from parents to platforms is important, and for this, the platforms must prioritise accessible and reliable consent processes to truly uphold children's data privacy and safety online," said Chitra Iyer, Co-founder and CEO, Space2Grow.