Firms need time to comply with data protection law'

Companies will need time to comply with the Digital Personal Data Protection Act (DPDP) whose rules are to be released, according to VINAYAK GODSE, chief executive officer of Data Security Council of India (DSCI). It's a non-profit non-profit organisation set up by NASSCOM and works in cybersecurity and privacy. "Companies will need to overhaul processes and adjust operations", he said in an interview with Ashutosh Mishra in New Delhi. Edited excerpts:

The DPDP rules are expected this month but a recent report shows that 60 per cent of Indian companies aren't meeting basic compliance. How is compliance with DPDP expected?

Compliance with the DPDP Act will indeed take time, much like we saw with the General Data Protection Regulation (GDPR) in Europe. Even after the DPDP rules are finalised and the law is enforced, companies will need to overhaul processes and adjust operations. Digital-first companies are better prepared but for others, especially those with legacy systems, it will require starting from scratch on data management. Similar to GDPR, Indian businesses will need to significantly rework their frameworks, processes and technologies to meet the Act's requirements, and that will take time.

What are the imminent cybersecurity threats?