DPDP’s SARAL Approach: Why India’s New Privacy Rules are a ‘Consent-First’ Wake-Up Call for Startups
The long-awaited Digital Personal Data Protection (DPDP) Rules 2025 have finally landed, introducing the “SARAL” framework—a simplified compliance path specifically designed for startups. However, simplicity should not be mistaken for leniency. With the formal notification of the Data Protection Board, the 18-month countdown for full compliance has officially begun.
The core of the new regime is a “consent-first” mandate. Consent must now be free, specific, informed, and—crucially—unambiguous. For startups in the AR and AI sectors, this means the end of “pre-ticked boxes.” Additionally, the 72-hour mandatory breach reporting window is now law. Whether you are a lean team of five or a growing unicorn, your data architecture must now be “compliant by design.”
SARAL is a olive branch to the ecosystem, but the 72-hour breach rule is a high-stakes test of India’s technical maturity. Startups should audit their third-party SDKs immediately.
