India’s privacy rules turn data retention into an economic decision

Personal data looks cheap to collect when the price of a storage bucket is the largest cost on the ledger. India’s new data protection rules put other costs on it. A firm has to know what it holds, why it holds it, who can act on it and what it can do when a customer exercises a right. The rules are likely to improve consumer welfare most where they change the default decision about collecting and keeping information. That gain depends on the cost of complying for a new entrant and the effort a customer must spend to make a right effective. MeitY, Digital Personal Data Protection Rules, 2025 · Digital Personal Data Protection Act, 2023

The shift from collection to stewardship

The November notification supplies implementation detail for the 2023 Act. It gives rules for notices and consent, security safeguards, breaches and other duties, with provisions beginning on different schedules. The distinction matters in commercial planning. A company can face a predictable investment requirement before the substantive obligation comes into operation. It can redesign a product now, spread work over releases and retire fields that no longer justify keeping. A deadline can also induce a hurried purchase of compliance software if management treats implementation as a project for its legal team alone. MeitY, Digital Personal Data Protection Rules, 2025 · PIB, notification and implementation

A retailer, for example, may legitimately need a delivery address for an order. Retaining it across disconnected customer-support and advertising systems is a separate choice. The value of the second copy might depend on whether it improves a measurable prediction. Its cost includes the engineering time required to find it, limit access and account for its retention. A company that can remove one copy cheaply may gain more from redesigning its information flows than from building a more elaborate notice.

The entry cost

Consider an illustrative service that expects ₹12 lakh a year in contribution from a product line. Suppose mapping and rebuilding the relevant data flows costs ₹6 lakh once, and maintaining the process costs ₹2 lakh annually. The year-one contribution falls to ₹4 lakh and recurring contribution to ₹10 lakh. For another firm making ₹1.2 crore on the same product, the nominal burden is identical in this example and the proportion is much smaller. These assumptions isolate a fixed cost. They leave aside the benefits of fewer incidents, lower storage costs and stronger customer trust.

Small companies can benefit too. A startup with two databases and a single codebase may locate and change its data flows faster than a legacy business with many duplicated systems. The burden depends on complexity and the availability of shared tools as well as revenue. Common, affordable templates for disclosures and portable vendor contracts can lower entry costs without reducing substantive protections. The most valuable forms of standardisation are those that make it easier to switch providers and test whether a request was handled.

Privacy as a product feature

The strongest case for leaving firms room to collect is that some of the gains are genuine. Historical records can help detect a duplicate order, make a service accessible on a replacement device or improve fraud controls. Some retention may also serve another obligation. An indiscriminate reduction in records would hurt users as well as firms. The practical test is purpose by purpose. An operations team can specify what a particular data item improves and how much benefit a longer retention period adds. For a poorly justified item, asking the customer to manage another permission simply shifts the work.

Enforcement will determine whether the rights reward better products. Track the time required to withdraw consent, the share of requests completed, the frequency of repeat complaints and the fraction of firms able to implement changes without expensive custom work. Differences by language, disability and device matter because an interface usable only on a recent smartphone creates an uneven effective right. A high volume of initial requests could reflect awareness, frustration or both. Resolution time and successful completion would help distinguish them.

India will have improved the economics of privacy when a firm can build a simpler, trustworthy product and a customer can exercise a right with ordinary effort. Clear rules make that outcome possible. Evidence from actual requests and firms of different sizes will show whether the market rewards it.