DPDP compliance: Why AI startups face valuation risk
Privacy is a valuation issue for AI startups in India. The Digital Personal Data Protection (DPDP) Rules are being phased in over an 18-month window that began on November 13, 2025, with full obligations taking effect by May 2027.
What the DPDP Rules cover
Shivaarti Bajaj, Founding Managing Partner of RSD Bajaj Global Law Firm, said privacy can affect whether a company’s assets are valued, bought, sold or devalued.
Once the law is fully in force, penalties can go up to Rs 250 crore for security lapses, and up to Rs 200 crore each for failures in breach reporting or in handling children’s data.
Under the DPDP framework, responsibility remains with the data fiduciary. Breaches must be reported to the Data Protection Board within 72 hours.
Who the rules affect
The compliance and valuation risk applies to companies in D2C, edtech, deep tech and AI.
Investors and buyers may factor remediation costs into pricing when a company has no data map, cannot prove consent, works with vendors that handle data without contracts, or lacks a breach response plan.
Newsletter
The corridor, every morning.
Funding rounds and cross-border capital moves, one email, five minutes.
Platforms acting as intermediaries face tighter timelines and must act on deepfakes and other misused AI content within hours.
Consent must be tied to a specific purpose. Data collected for facial recognition cannot be repurposed to train a model. Withdrawing consent must be as easy as giving it.
India treats anyone under 18 as a child who requires verifiable parental consent. Training data carries rights including privacy and intellectual property rights.
What founders should do
- Map the personal data the company collects and creates.
- Disclose what goes into model training.
- Name every vendor in user notices and put contracts in place for vendors that handle data.
- Take specific consent.
- Make consent withdrawal as easy as consent collection.
- Build breach-response procedures that can meet the 72-hour reporting requirement.
- Get compliance, data alignment and consent mechanisms right at the code, design and supply-chain level.
Why privacy matters to valuation
Bajaj pointed to Verizon’s acquisition of Yahoo’s operating business as an example of the financial impact of data failures. The deal was originally agreed at $4.83 billion, but after Yahoo disclosed two major data breaches, the price was cut by $350 million, and Verizon took on a share of the related litigation.
For startups, buyers and investors can factor remediation costs into pricing when data governance is inadequate.
More in Policy
