DPDP Rules: Firms get breathing space, but work begins now

The clock has started ticking for enterprises to align with the newly notified Digital Personal Data Protection (DPDP) Rules, with experts saying that the 18-month transition must be treated not as a grace period but as an execution runway. Although the phased rollout offers breathing room, companies will have to move fast on redesigning consent architecture, notices, governance structures, vendor contracts, breach-response systems and international data transfer flows to avoid bottlenecks as the deadline approaches.