Daybreak - ⁠India's data law has HDFC Bank, Amazon, Paytm, and others shopping for consent

Episode Date: September 13, 2026

India’s new data protection law is reshaping how companies talk to customers on WhatsApp. Messages that once felt routine now carry legal weight and are tied to consent, security, and user rights. Since the Digital Personal Data Protection Act became operational, businesses have begun reworking how they collect and manage personal data. That shift has created a fast-growing market for compliance tools, drawing startups and established firms into the same space.As companies rush to avoid heavy penalties, disagreements are emerging over who should manage consent and how independent they need to be.The bigger question is how much control users will really have over their data.Tune in.*This episode was first published on January 27th 2026.Daybreak is produced from the newsroom of The Ken, India’s first subscriber-only business news platform. Subscribe for more exclusive, deeply-reported, and analytical business stories.

If you use WhatsApp, you have probably received messages from companies. Delivery updates, payment reminders, promotional offers. Sometimes it's a brand that you remember interacting with. Sometimes it isn't. The messages, though, still arrive and most of the time you ignore them or you delete them without much thought. But behind those messages sits a growing legal question in India. When is a company allowed to contact you? And what permission did you actually give you?

actually give them to do so. That question has become harder to answer since India's Digital Personal Data Protection Act became operational in November last year. The law reshapes how companies can collect, store and use personal data, including something as basic as your phone number. Consent now has specific requirements. It has to be free, informed, specific and unambiguous. Users can ask companies what data they hold, correct it, delete it, or withdraw consent entirely.

And companies are required to build systems that make these rights usable, not theoretical. For businesses, this has changed how everyday communication works. Even something as familiar as a WhatsApp promotion can trigger internal debates about compliance. Founders and compliance teams are spending hours discussing, who initiated a conversation, what permissions exist, and how those permissions are recorded. One of the people fielding these questions is Gora Vmehda, the founder of Conquer, a startup working in compliance management. Since the law took effect, his role has involved translating legal language into operational decisions companies can follow across themes and platforms.

And the deadline for full compliance is mid-20207. But preparations are already underway. Companies are investing significant sums to avoid penalties that can run into hundreds of crores of rupees. At the same time, an entire industry seems to be forming to help businesses manage consent at scale. Now, as that industry grows, a larger issue is slowly coming into focus. The systems being built today will decide how much control users really have over their data,

including who gets to speak to them and under what terms. Welcome to Daybreak, a business podcast from the Ken. I'm a host, Nick Da Sharma, and I don't chase the news cycle. Instead, every day of the week, my colleague Rachel Vargheese and I will come to you with one business story that is worth understanding and worth your time. Once the data protection law became operational, companies quickly realized that compliance was not going to be a simple checklist. It required new systems, new roles and new budgets. Enterprises began asking what compliance actually looks like on the ground and many of those questions started landing with a new class of startups. One of them is concur, which I mentioned earlier, founded by Gorov Mehta.

His work involves translating the law into something that companies can execute across teams and technologies. That translation has value. For large enterprises, compliance services can cost up to 18 crore rupees in the first two years and about 10 crores every year after that. Penalties for non-compliance meanwhile can go up to 250 crore with higher exposure when children's data is involved. Raghuir Kancherla, the co-founder of governance and compliance at firm Sprinto, spoke to my colleague the Ken reporter Indirpal Singh, and he compared compliance to finance. In the same way that finance teams maintain accounts, compliance teams now have to manage consent frameworks and privacy obligations. And this shift has helped create a market that Shishang Karinjati, the co-founder of

Consent Management Startup Redacto estimates to be worth at least 2,000 crore rupees in India. Still, building the space is not straightforward. Consent, at some point, stops becoming a legal question and becomes a systems problem. It has to work across channels, vendors and internal teams, and it also has to be enforced through technology. Large enterprises often gravitate towards established players. Some work with Indian KYC companies like IDFI, while others rely on multinational governance companies that bring experience from Europe's GDPR regime. Platforms such as Privy by IDFE integrate consent and data governance directly into enterprise systems.

But what happens as a result is attention around definitions. The law specifies that a consent manager must be incorporated in India, and avoid conflicts of interest with data fiduciaries. Startups like Concour and Redacto argue that this excludes KYC firms and foreign headquartered companies and KYC firms do not agree. If the market cannot resolve this disagreement, it will fall to the Data Protection Board of India, which is expected to begin registering consent managers in November. Until then, companies are still moving ahead, even as the rules can.

continue to take shape. For more on this, stay tuned. Some of the risks that the law is trying to address are already visible. For example, in early 2025, a large trading platform hired the data security firm Matters.AI to audit its systems. The audit uncovered something quite troubling. A former employee who had left three years earlier had set up a script that siphon sensitive information to a telegram channel. Under the current law, such a breach would need to be reported to the Data Protection Board

within 72 hours. Affected users would have to be informed and penalties, like I said, could reach into hundreds of crores. Matters.aI has since started offering tools that help companies accurately delete data when users revoke consent alongside its other cybersecurity services.

Other startups, are choosing different areas of focus. Redacto, for example, concentrates on tracking where personal data flows and where it is stored. The company positions itself as a privacy-only layer

that does not collect data itself, which it says helps avoid conflicts of interest. Redacto sees early demand from healthcare and financial services. Industries that handle large volumes of sensitive data and are likely to face closer regulatory scrutiny. Sprinto meanwhile, which initially worked with startups now focuses on large enterprises and estimates recurring compliance costs of 4 to 5 crore rupees a year for mid-sized companies.

Established players, on the other hand, argue that consent is only one part of compliance. Ashok Hariharan, the founder of IDFE, points that areas like third-party risk management, cookie controls and data discovery often receive less attention but carries sense. significant exposure. ID fee sells consent governance as a part of a broader compliance offering. The sharpest debate, though, centers on conflicts of interest. GRC companies argue that KYC firms should not act as consent managers because their business depends on continuous access to data. Yashu Bansal, who is assistant professor at Manipal Law School, illustrates the concern. He says, if a KYC firm verifies users and also manages consent,

every revoked permission affects its own onboarding and verification workflows. Hari Haran, though, disagrees with that framing. He distinguishes between a consent manager, acting on behalf of users and enterprise-facing systems that help fiduciaries implement consent at scale. From his perspective, governance platforms operate on behalf of companies and the law does not prohibit KYC firms from offering such systems. The Information Technology Ministry has shortlisted ID fee, redacto and geo-platforms to help develop

a modular consent framework. While this is not authorization to act as consent managers, it does signal confidence in their technical capabilities. Still, some observers, including Internet Freedom Foundation Director Apar Gupta, warn that government-backed innovation efforts can influence who eventually receives registrations. But beyond the market structure, there is a deeper question about what compliance ends up prioritizing. Gupta argues that the real test is whether companies trended user agency or focus primarily on limiting liability. A case described by matters.aI founder Keshav Murthy actually is a good example of

At one of India's largest banks, a senior executive downloaded sensitive customer data before leaving the company. He disguised the file as a medical report and shared it on WhatsApp. No customer harm was reported, but the bank's immediate concern was identifying and containing the breach. That response reflects how the law is weighted. According to Murdi, the Data Protection Act places more emphasis on security than on privacy. Preventing data leaks and misuse sits at the center of enforcement. Kanjela believes that the headline penalty figure

of 250 crore rupees exists to force attention. Whether it remains notional or becomes routine will actually depend on the enforcement. For now though, it is enough to get companies to engage. And that engagement is already reshaping how businesses think of something as ordinary as a WhatsApp message and how much control users truly have over the data behind it. Daybreak is produced from the newsroom of the Ken,

India's first subscriber-focused business news platform. What you're listening to is just a small sample of a subscriber-only offerings and a full subscription offers daily, long-form feature stories, newsletters and a whole bunch of premium podcasts. To subscribe, head to the Ken.com and click on the red subscribe button on the top of website. Today's episode was hosted and produced by my colleague's Nikthash.