As the final rules for the Digital India Act take shape and new tax clarifications emerge, founders must move beyond reactive compliance and build regulatory strategy into their core business models.
A Bengaluru-based founder I spoke with last week summed up the mood perfectly. “My Series A pitch deck now has two new slides,” she said, “One is our AI ethics framework, and the other is a DPDP compliance roadmap. I spend more time with lawyers than with coders.” Her experience isn’t unique. It’s the new reality for every tech entrepreneur in India. The relatively unregulated, move-fast-and-break-things era is definitively over. In its place is a complex, overlapping, and rapidly maturing regulatory architecture that demands strategic navigation, not just a compliance checklist.
For years, we’ve talked about these changes in the abstract. The Digital India Act (DIA) was a future concern, the Data Protection Act felt distant, and angel tax was a recurring but manageable headache. Now, in mid-2026, the future is here. The final consultation rounds for the DIA rules are closing, the Data Protection Board (DPB) is operational and beginning to levy penalties, and a recent Central Board of Direct Taxes (CBDT) circular has once again muddied the waters on startup valuation. Understanding these shifts isn’t just a task for the CFO or the legal team anymore. It’s a core responsibility for founders and a critical due diligence item for investors.
The Digital India Act: A New Social Contract for the Internet
The Ministry of Electronics and Information Technology (MeitY) is on the verge of notifying the final rules under the much-debated Digital India Act. While the parent legislation laid out the broad principles, the rules are where the real impact lies for businesses. This is no mere update to the 26-year-old Information Technology Act. It’s a fundamental reimagining of the responsibilities of platforms, the rights of users, and the role of the state in governing the digital sphere. Forget thinking of this as a simple compliance update. The DIA establishes a new social contract for the Indian internet, and startups are at the very center of it.
AI Regulation: India Charts Its Own Course
The most consequential part of the DIA rules concerns the regulation of Artificial Intelligence. MeitY has sidestepped the European Union’s prescriptive, high-risk/low-risk categorization model seen in the EU AI Act. Instead, India is pushing a framework centered on principles of “fairness, transparency, and accountability,” enforced through mandatory audits and impact assessments for what it terms “Significant AI Systems.”
What does this mean for your startup? If you are building an AI product, particularly in sensitive sectors like hiring, lending, or healthcare, you will soon be required to:
- Conduct regular Algorithmic Impact Assessments (AIAs) and submit them to a new regulatory body, likely to be called the AI Regulatory Authority (AIRA).
- Maintain detailed documentation on your training data, model parameters, and testing protocols, making them available for audit.
- Provide users with clear, plain-language explanations of how your AI system arrived at a particular decision (the “right to explanation”).
This is a significant departure from the previous light-touch approach. While it avoids the EU’s rigid classifications, it introduces a degree of regulatory subjectivity. What constitutes a “fair” algorithm? Who defines an acceptable level of “transparency”? Early-stage startups, in particular, will need to invest in MLOps (Machine Learning Operations) and governance tools from day one. This is no longer a “good-to-have” for enterprise clients, it’s a legal requirement. The silver lining is that by creating a more flexible framework, MeitY hopes to foster innovation without the chilling effect of the EU’s more rigid law, positioning India as a global AI hub with responsible guardrails.
Intermediary Liability: The Safe Harbour is Shrinking
The concept of “safe harbour” under Section 79 of the old IT Act, which protected platforms from liability for user-generated content, has been fundamentally altered. The DIA and its new rules place a much higher burden of responsibility on platforms, especially those designated as “Systemically Important Digital Intermediaries” (SIDIs), a category that will likely include not just major social media networks but also large e-commerce marketplaces, app stores, and even major SaaS platforms with user interaction features.
For these platforms, the obligation is shifting from simply “taking down” illegal content upon notification to proactively monitoring for and preventing the spread of certain types of harmful content. This includes misinformation identified by a government fact-checking unit, content related to specified criminal offenses, and deepfakes. The practical implication is a massive increase in investment in content moderation, both human and automated. For startups aspiring to become large platforms, building trust and safety functions into your product architecture from the beginning is now non-negotiable. This will have a direct impact on burn rate and headcount, a factor VCs are now scrutinizing intensely.
Angel Tax Again? CBDT’s Valuation Maze
Just when the ecosystem thought the “angel tax” saga was settling down, a new CBDT circular (let’s call it Circular 12/2026 for discussion) has introduced fresh complexity. The core issue of Section 56(2)(viib) of the Income Tax Act remains: if a startup raises capital at a price higher than its Fair Market Value (FMV), the excess amount is treated as “income from other sources” and taxed. The problem has always been the subjective nature of determining FMV for early-stage, loss-making companies with high growth potential.
The new circular attempts to provide “clarity” but, in practice, adds new layers of bureaucracy. While it formally accepts the Discounted Cash Flow (DCF) method of valuation, it now empowers Assessing Officers (AOs) to challenge the underlying assumptions of the DCF model, such as growth projections and discount rates, with greater scrutiny. Previously, as long as the valuation report was from a registered valuer, it was often accepted. Now, founders will need to be prepared to defend their business projections in minute detail to the tax authorities.
The message from the tax department is clear: your valuation narrative for investors must now be robust enough to withstand the scrutiny of a tax officer. This tightens the screws on inflated, momentum-driven valuation marks.
Furthermore, the safe harbour provisions for DPIIT-recognized startups have not been expanded. This means many tech startups that don’t fit the narrow DPIIT definition of “innovative” are still exposed. For founders, this means two things. First, meticulous documentation of your valuation process, including board resolutions, detailed financial models, and market comparisons, is critical. Second, it may be prudent to have more conservative, defensible valuations in your official filings, even if the convertible notes or SAFE agreements with investors reflect a higher cap.
DPDP Act in Action: The Data Board Gets to Work
The Digital Personal Data Protection (DPDP) Act of 2023 is no longer a paper tiger. The Data Protection Board of India (DPB) is fully constituted, staffed, and has begun adjudicating complaints. We are seeing the first wave of notices and penalties, and they offer crucial insights into the board’s priorities.
Early actions have focused on three key areas:
The Rise of the Consent Manager
One of the most significant business impacts of the DPDP Act is the operationalization of the “Consent Manager” ecosystem. These are new, regulated entities that allow users to manage their consent for data sharing across multiple platforms from a single dashboard. For startups, this means you will soon need to integrate with these Consent Manager platforms via APIs.
This is both a compliance requirement and a strategic challenge. On one hand, it can simplify consent management. On the other, it gives users a very easy way to revoke consent with a single click, which could disrupt marketing funnels and data analytics pipelines. Companies that have built their business models on broad, perpetual consent will need to fundamentally re-architect their data strategies. The focus must shift from collecting as much data as possible to collecting only what is necessary and continuously demonstrating value to the user to maintain their consent.
The Global Compliance Web
No Indian tech company operates in a vacuum. For the thousands of SaaS, fintech, and D2C startups with global ambitions, this domestic regulatory churn is happening alongside major international shifts. The EU AI Act is now in effect, requiring Indian companies serving European customers to comply with its stringent rules. A B2B SaaS company from Chennai providing an HR tool to a client in Germany, for example, must now ensure its algorithms are free from bias according to EU standards and provide extensive documentation to its client.
Similarly, data transfer mechanisms between India and other jurisdictions are becoming more complex. While India is pursuing “adequacy” status with the EU, it’s not yet a reality. This means companies still have to rely on complex legal instruments like Standard Contractual Clauses (SCCs) and Binding Corporate Rules (BCRs) to transfer personal data of EU citizens to India for processing. This adds legal costs and operational friction, especially for smaller companies without large compliance teams.
Conclusion: From Ad-Hoc Fixes to Systemic Design
The era of treating regulation as an afterthought is over. The current policy landscape, from the DIA’s proactive obligations to the DPDP’s granular consent rules and the CBDT’s valuation scrutiny, demands a new approach. Founders can no longer afford to “deal with it later.”
Regulatory strategy must be woven into the fabric of the business from day one. This means building products with privacy-by-design principles, creating AI systems that are explainable and auditable, maintaining meticulous financial documentation, and understanding that market access is now contingent on compliance. The cost of getting it wrong is no longer just a potential fine; it’s a loss of customer trust, investor confidence, and the ability to operate in key markets.
This new, regulated environment is undoubtedly more challenging. But it is also the hallmark of a maturing digital economy. The companies that thrive will be those that view regulation not as a burden to be managed, but as a framework within which to build sustainable, trustworthy, and globally competitive businesses.
