{
  "id": 15872345,
  "title": "Building AI in India? Privacy is now a valuation issue: Shivaarti Bajaj",
  "url": "https://urgent.news/2026/10/21/building-ai-in-india-privacy-is-now-a-valuation-issue-shivaarti-bajaj",
  "topic": "ai",
  "section": "AI",
  "published": "2026-10-21T10:01:14.000Z",
  "source": {
    "name": "YourStory",
    "slug": "yourstory",
    "url": "https://yourstory.com/2026/10/dpdp-privacy-ai-startup-valuation-shivaarti-bajaj"
  },
  "original_language": "en",
  "account": "As India's innovative startups rush to develop AI-driven products, the manner in which they manage personal data could determine the ultimate worth of these companies. At the recent TechSparks 2026 summit, Shivaarti Bajaj, Founder and Managing Partner of RSD Bajaj Global Law Firm, emphasized that privacy should no longer be an afterthought for founders. She stressed that building products is akin to creating assets that can be valued, traded, sold, devalued, or even seized if not developed and managed correctly. \"When we build products, we are creating companies, an asset,\" Bajaj asserted.\n\nIntellectual property remains the primary line of defense, with trademarks safeguarding brands for direct-to-consumer businesses, patents protecting deep technology innovations, copyrights and design protections covering creators, semiconductors, and Internet of Things hardware. However, Bajaj pointed out that while intellectual property law in India is well-established, the emerging risk lies in the data that companies collect and generate. She cited Verizon's acquisition of Yahoo, where the deal's original $4.83 billion valuation was reduced by $350 million after Yahoo admitted to two major data breaches. Buyers and investors now account for remediation expenses in the pricing. No matter the sector—direct-to-consumer, educational technology, deep technology, or AI—companies can anticipate a discount in valuation if they lack a data inventory, cannot prove consent, rely on vendors who handle data without contractual agreements, or lack a breach response plan.\n\nAs these issues grow more pressing in India, the Digital Personal Data Protection (DPDP) Rules are being introduced gradually over an 18-month period, starting from November 13, 2025, with complete compliance expected by May 2027. The penalties under this law can reach up to Rs 250 crore for security lapses, and up to Rs 200 crore each for breach reporting failures or mishandling of children's data. Bajaj emphasized the gravity of these consequences, stating, \"We are not talking about a few thousand rupees. These are very serious matters that demand substantial compliance.\"\n\nShe also highlighted the rapid pace at which regulations can evolve. Following the misuse of AI-generated images by Grok on X in January, the Indian government introduced synthetic media rules by February. These regulations require AI-generated content to be labeled and include metadata identifying the tool used, meaning the time between an incident and regulatory action can be as brief as a quarter. Although India does not have a dedicated AI law, its AI governance guidelines outline seven key principles—trust, consent, and accountability—as the core \"sutras.\" Bajaj emphasized that privacy must be integrated into the design process from the outset, including ensuring compliance, data alignment, and consent mechanisms from the code and design levels to the supply chain. Consent must be specific, with data collected for one purpose, such as facial recognition, not being repurposed for other uses. Withdrawal of consent should be as straightforward as giving it. Whereas many global regulations set the age for digital consent between 13 and 16, in India, anyone under 18 is considered a child who requires verifiable parental consent. She referenced the Everalbum case, where a photo app used customers' images to train facial recognition models without proper consent, ultimately resulting in the company being ordered to delete both the data and the models built upon it. Bajaj stressed that the data used for training carries both privacy and intellectual property rights. Accountability must not be outsourced; under the DPDP framework, responsibility lies with the data fiduciary, and breaches must be reported to the Data Protection Board within 72 hours. Intermediaries acting as platforms must act even more swiftly, addressing deepfakes and misused AI content within hours. Bajaj advised founders to create comprehensive inventories of personal data, disclose the components used in model training, identify every vendor in user notices, and implement explicit consent procedures. Implemented correctly, she concluded, privacy by design not only protects a company's valuation but also contributes to building valuable intellectual property for the broader world.",
  "summary": "Shivaarti Bajaj explains how DPDP compliance and privacy by design protect AI startups from penalties and valuation discounts.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}