As India’s startups race to build AI-first products, the way they handle personal data could decide what those companies are eventually worth.
Speaking at TechSparks 2026, YourStory’s annual flagship summit, Shivaarti Bajaj, Founding Managing Partner of RSD Bajaj Global Law Firm, argued that privacy can no longer be an afterthought. Founders, she said, are not just shipping products but creating assets: assets that can be valued, bought, sold, devalued, or even taken away if they are not built and complied with correctly.
“When we are creating products, we are creating companies, an asset,” Bajaj said.
Intellectual property remains the first line of defence. Trademarks protect the brands that D2C companies are building, patents matter for deep tech innovation, and copyrights and design protection cover creators, semiconductors, and IoT hardware. But Bajaj noted that IP law in India is well established. The newer and less understood risk lies in the data sets companies collect and create.
To illustrate the stakes, she pointed to Verizon’s acquisition of Yahoo’s operating business. The deal was originally agreed at $4.83 billion, but after Yahoo disclosed two major data breaches, the price was cut by $350 million, and Verizon took on a share of the related litigation.
Buyers and investors, Bajaj said, now factor remediation costs into pricing. Whether a company is in D2C, edtech, deep tech, or AI, it can expect a valuation discount if it has no data map, cannot prove consent, works with vendors who handle data without contracts, or has no breach response plan.
In India, these questions are becoming urgent. The Digital Personal Data Protection (DPDP) Rules are being phased in over an 18-month window that began on November 13, 2025, with full obligations taking effect by May 2027. Once fully in force, penalties under the law can go up to Rs 250 crore for security lapses, and up to Rs 200 crore each for failures in breach reporting or in handling children’s data.
“We are not talking about a few thousands,” Bajaj noted. “These are very serious things which require a lot of compliance.”
She also showed how quickly regulation can move. After the misuse of AI-generated images through Grok on X in January this year, the government brought in synthetic media rules by February. The rules require AI-generated content to be labelled and to carry metadata that identifies the tool used, which means the gap between incident and regulation was barely a quarter.
India does not yet have a dedicated AI law, but its AI governance guidelines set out seven guiding “sutras” centred on trust, consent, and accountability. For Bajaj, the most important takeaway for builders is privacy by design. That means getting compliance, data alignment, and consent mechanisms right at the code, design, and supply chain level from day one.
Consent itself must be specific. Data collected for one purpose, such as facial recognition, cannot be repurposed to train a model. Withdrawing consent must also be as easy as giving it. And unlike many global regimes that set the age of digital consent between 13 and 16, India treats anyone under 18 as a child who needs verifiable parental consent.
She cited the US case of Everalbum, a photo app that used customers’ images to train facial recognition models without proper consent. The company was ultimately ordered to delete not just the data but the models built on it.
“Your training data carries rights, the rights of privacy, the rights of IP,” Bajaj said.
Accountability cannot be outsourced either. Under the DPDP framework, responsibility stays with the data fiduciary, and breaches must be reported to the Data Protection Board within 72 hours. Platforms acting as intermediaries face even tighter timelines and must act on deepfakes and other misused AI content within hours.
Bajaj urged founders to map their personal data, disclose what goes into model training, name every vendor in their user notices, and take specific consent. Done right, she said, privacy by design protects a company’s valuation and helps India build IP for the world.
“You build a company for money, but you build for value in the end,” she concluded.