India’s micro, small and medium enterprises (MSMEs) and early-stage startups are warning that a faster-than-expected rollout of the Digital Personal Data Protection (DPDP) Act 2023 could disrupt operations, deter foreign investment and strain already stretched compliance capacities, according to Empower India.
The government’s reported intention to compress the implementation timeline of the DPDP Act has raised concerns among small players that have structured business models, technology investments and fundraising plans around an assumed 24-month compliance runway. Industry representatives say any abrupt change risks imposing fresh costs and uncertainty at a time when MSMEs are already seeking regulatory relief ahead of budget 2026-27.
Startups, particularly smaller firms with limited legal and compliance teams, say they have invested heavily in preparing systems, processes and contracts in line with the originally expected timeline. A shortened runway could force rushed adjustments, diverting resources away from growth, hiring and innovation.
According to Empower India, the timing is especially sensitive because Indian startups are expected to attract more than USD 20 billion in funding over the next 12 months, based on industry reports and market analyses cited by the organisation. These investments, coming from both domestic and international investors, are premised on regulatory stability across sectors such as technology, fintech, e-commerce and healthcare.
“Any sudden changes in critical regulations, such as the Digital Personal Data Protection Act, 2023, could disrupt these investment plans and hinder the progress of the startup community,” said K Giri, Director General, Empower India. He added that compressed implementation timelines could have a cascading impact on small businesses that lack the scale and buffers of larger firms.
Small enterprises, Empower India said, require adequate time to adapt internal systems, align operational processes and understand how regulatory changes affect their market visibility, customer reach and daily operations. Without sufficient transition periods, MSMEs risk non-compliance, penalties and loss of business confidence.
Giri said a phased and consultative approach, backed by structured feedback mechanisms, would allow smoother transitions and reduce disruption for smaller players. “This can help ensure more effective compliance without destabilising the broader ecosystem,” he said.
Empower India also flagged knock-on effects from accelerated compliance on relationships between large firms and their smaller partners. During rapid implementation phases, larger companies tend to prioritise stabilising core compliance systems, which can temporarily slow onboarding, support services and feature rollouts that MSMEs depend on for continuity.
The organisation warned that immediate enforcement of specific provisions under the DPDP framework could further complicate matters. Rule 23, which allows the central government to seek information from data fiduciaries, could introduce operational uncertainty and additional compliance burdens for startups. Rule 16, which provides exemptions for research and statistical purposes, while beneficial in principle, adds interpretational complexity for smaller firms with limited legal clarity.
“These abrupt changes create uncertainty, hindering startups’ ability to plan, invest and scale effectively,” Empower India said, adding that regulatory predictability is critical to protecting innovation, employment generation and the resilience of India’s small business economy.
For MSMEs already navigating tight margins, rising compliance costs and volatile market conditions, industry representatives say regulatory shocks risk undermining competitiveness and long-term growth. |
