Today's Headlines

1. Most India GCCs still in early stages of DPDP compliance despite ticking 14-month deadline: Experts

Source: Google News DPDP | Read Original →

A recent report indicates that many India Global Capability Centres (GCCs) are still far from achieving full compliance with the Digital Personal Data Protection (DPDP) Act 2023, despite the "14-month deadline" signifying that the Act is now in effect. Experts warn that this lack of preparedness puts these critical operational hubs at significant risk of penalties and reputational damage under Section 24 (Penalties). This highlights a broader challenge for Indian businesses in meeting the stringent requirements for Data Fiduciaries under Section 8.

2. Instagram is dropping end-to-end encryption soon: Here are 5 secure messaging apps you can use instead

Source: Livemint Tech | Read Original → Meta has announced that Instagram will cease to offer end-to-end encryption (E2EE) for its direct messages starting May 8, 2026, advising users to download their data beforehand. While WhatsApp will retain E2EE, this move by Meta raises concerns about user data security and privacy expectations, especially for Indian users whose data will now be more vulnerable to access. This development underscores the importance of reasonable security safeguards under Section 8(5) of the DPDP Act and the need for Data Principals to be aware of how their personal data is being protected.

---

DPDP Impact Analysis

Today's headlines paint a critical picture for Indian businesses navigating the nascent but active DPDP Act landscape. The revelation that many India GCCs remain in the early stages of compliance, even after the Act's operational "14-month deadline," is a significant red flag. It suggests a potential widespread unpreparedness across Indian industry, indicating that the rigorous obligations imposed on Data Fiduciaries by Section 8 are not yet fully integrated into operational frameworks. This inertia exposes businesses to substantial financial penalties, potentially up to ₹250 Crore per incident, and severe reputational damage, which can be far more costly in the long run.

The non-compliance among GCCs, which often handle vast amounts of global and local personal data, points to a broader systemic challenge. It implies that many Indian enterprises might also be underestimating the urgency and complexity of implementing robust data protection policies, consent mechanisms, grievance redressal systems, and data breach notification protocols. The time for deliberation is over; the Act is in force, and regulators will likely increase scrutiny. Businesses must immediately audit their data processing activities, identify gaps, and accelerate their compliance journey to mitigate risks.

Adding to this environment of heightened data sensitivity, Instagram's decision to drop end-to-end encryption (E2EE) on its direct messages, though a global move by Meta, directly impacts Indian Data Principals. While not a direct DPDP violation, it profoundly affects the reasonable security safeguards (Section 8(5)) users can expect. For businesses, this is a cautionary tale: platforms they use for communication or customer engagement might not always offer the highest levels of data security. Companies need to be vigilant about the security postures of third-party services they leverage and ensure that any data shared or processed through such channels still aligns with DPDP's requirements for protecting personal data.

Collectively, these stories emphasize a dual imperative for Indian businesses. Firstly, the internal requirement to implement and mature comprehensive DPDP compliance frameworks is paramount and overdue. The grace period has effectively ended, making proactive, robust adherence to Section 8 (Obligations of Data Fiduciary) non-negotiable. Secondly, external factors, such as changes in platform security, necessitate a continuous evaluation of data processing risks and communication strategies to maintain trust with Data Principals. The message is clear: data protection is no longer an optional add-on but a fundamental operational and strategic pillar for survival in the Indian digital economy.

---

Stay Compliant

Not sure if your business meets DPDP standards? Start with a free check:

🔍 Run Your Free DPDP Audit →

16 questions. 60 seconds. Instant risk report.

---

Published by DPDP News, a Meridian Bridge Strategy initiative. For compliance consulting, book a free call.