Comparative Insight: The GDPR Precedent: The two-year transition period provided by the EU’s GDPR offers a relevant case study. Organisations that viewed the transition as a dormant period were forced into reactive, resource-intensive measures immediately prior to enforcement. To secure operational readiness by May 2027, substantive structural adjustments must occur throughout 2026. This entails:
Comparative Insight: The GDPR Precedent: The two-year transition period provided by the EU’s GDPR offers a relevant case study. Organisations that viewed the transition as a dormant period were forced into reactive, resource-intensive measures immediately prior to enforcement. To secure operational readiness by May 2027, substantive structural adjustments must occur throughout 2026. This entails:
We enter 2026 with a definitive regulatory trajectory. Following the notification of the Digital Personal Data Protection (DPDP) Ruleson November 13, 2025, the timeline for the DPDP Act is now set. While the substantive obligations enter into force in May 2027, the 18-month transition period constitutes a critical implementation phase rather than a deferral of responsibility. Experience suggests that the period between legislation and enforcement is where the real work happens. This post outlines why 2026 is not a time for waiting, but a time for structural overhaul.
Navigate the intersection of law, tech and venture
From Seed to Exit. Specialised execution for Venture Capital,
Private Equity, and M&A.
