Whalesbook
The Shift from Arbitrage to Accountability
The upcoming full enforcement of India’s Digital Personal Data Protection Act (DPDPA) in May 2027 signals a major change for Global Capability Centres (GCCs). For 30 years, these hubs served as cost-effective processing centers for multinational companies, often operating in less defined regulatory spaces. The DPDPA changes this, making these centers responsible data fiduciaries and requiring significant upgrades to their internal systems due to strict liability for data processing decisions.
Understanding the Regulatory Risks
Unlike some other rules that focus on flexible compliance, India's law imposes strict fines. Violations of security rules can lead to penalties of up to ₹250 crore, and failure to report data breaches may result in fines up to ₹200 crore. These penalties are fixed amounts, not tied to a company's revenue, posing a substantial risk for medium-sized GCCs with limited budgets. Companies must now keep detailed processing records for at least one year, treating data as a valuable, regulated asset. Additionally, integrating third-party Consent Managers into software by November 2026 adds technical challenges, requiring early audits of consent processes and vendor agreements.
Structural Weaknesses and Potential Pitfalls
Companies viewing this law as a mere formality face serious structural issues. A key problem arises from processing mixed datasets; global firms often handle data from various countries within a single Indian facility. While the DPDPA specifically covers Indian residents' data, an 'Outsourcing Exemption' offers limited protection for foreign data. Firms that cannot separate these data streams risk accidental non-compliance. The uncertainty around the 'negative list' for international data transfers is another concern. The government could block transfers to certain countries, potentially disrupting global operations for companies relying on centralized systems. Without strong data governance tailored for India, separate from rules like GDPR or US policies, parent companies risk significant financial and reputational damage if a breach occurs at their Indian center.
The Future of Operations
Businesses are now clearly divided in their response to this regulatory change. Top companies are moving away from cost-cutting and focusing on building 'trust infrastructure,' viewing privacy compliance as a competitive advantage. This includes hiring more data governance experts and AI compliance specialists, often at higher costs due to a current talent shortage. As the May 2027 deadline nears, companies that have proactively designed their systems for privacy will likely fare better than those still trying to fix older systems, determining their long-term success in the Indian market.