They plan to offer data management services such as encryption of personally identifiable data and age-gating for gaming and social media platforms, industry executives said.
“We do plan to apply for consent manager registration. Our experience with operating digital compliance flows at scale within large organisations – especially in the banking sector puts us in a good position to take on the role of a consent manager and help close the compliance gap in large companies,” said Shivam Singla, cofounder at Leegality.
The Centre on Friday released the draft rules under the Digital Private Data Protection Act, 2023.
It proposed a system of registration of consent managers, whose primary responsibility will be to manage customer data collected by organisations.
Discover the stories of your interest
The draft rules proposed a minimum net worth of Rs 2 crore for these entities with their top executives required to have a good reputation in the industry in general.IDfy plans to apply to become a recognised consent manager and has built its product Privy as a platform managing customer consent and tracking lifecycle of the consent as well.
“The market for privacy-tech solutions is expanding rapidly, with rising investments in compliance-focused technologies,” said Ashok Hariharan, cofounder and CEO of IDfy. “We anticipate a significant addressable market in India, potentially worth several billion dollars in the next five years.”
Anshu Sharma, founder of Skyflow—which helps large corporations adhere to Europe’s GDPR and the AI Act—said some of the Indian companies are already working with it for their customer data protection.
Now, with the official rules about to be notified, the demand from Indian firms for these services would go up manifold, he said.
But it would take several years for complete compliance for a large market like India, Sharma added.
Industry insiders believe that large corporations with business operations in Europe and the United States will be better prepared to handle the new rules because of their exposure to the data rules in those geographies.
Challenges will be higher for local firms, they said.
The impact will be bigger for small enterprises and startups which collect a lot of user data but have not invested in consent management and protection of consumer data, said Salman Warris, partner at Techlegis, a law firm specialising in digital data privacy.
Technology-led startups are likely to take on the services of these consulting firms in the first stage, with large corporations picking up the cue from there on, executives said.
While there is definitely a buzz among policy experts and privacy lawyers about the potential impact of the new rules, which are still in the draft stage, top executives of large companies are still in a ‘wait and watch’ mode.
“We have spoken to over 100 large companies and many are conducting initial assessments and pilot projects. There is a general recognition that there is a clear value in having a single, unified consent manager, though most are waiting for the final rules before committing to full-scale implementation,” Singla added.
Warris, who works extensively with technology companies, said these are still early days for consultancy firms to claim they can become consent managers.
“Some of the work has been going on for some time now, and some firms have developed priority products around DPDP compliance, but to get that correct, I think there is still some time left,” he said.
The draft DPDP rules are still up for public feedback, so these services can be finalised only after the final rules are released, Warris said.
Abhishek Prasad, managing partner of VC firm Cornerstone Ventures, said privacy-tech could also unlock the transition to Web3—“where consumers have control on their own data and are also able to seamlessly monetise their data on their own terms.”
