Six months to get ready for India’s data protection law 

Narayan Babu D N ,  Senior Partner –  Trust Law Advocates & Solicitors 

As consent manager rules take effect on 13 November, businesses have until 13 May 2027 before the main obligations and penalties of the DPDP Act apply 

India’s first comprehensive data protection law, the Digital Personal Data Protection Act, 2023 (the DPDP Act), enters its second phase on 13 November 2026. A year after the Digital Personal Data Protection Rules, 2025 were notified, the consent manager framework takes effect. Unless a business intends to register as a consent manager, nothing new becomes mandatory on 13 November. The principal obligations of businesses, and the penalties for breaching them, apply from 13 May 2027, so the date marks the start of the final six months of preparation. 

What the law does 

The Act governs how organisations collect, use, store, share and delete digital personal data. It gives individuals rights over their data, places duties on the organisations that handle it, and creates a regulator, the Data Protection Board of India, which can impose financial penalties. Until the main provisions commence, personal data is governed largely by Section 43A of the Information Technology Act, 2000 and the 2011 rules under it, which cover only “sensitive” personal data. That regime is replaced once the Act is fully in force. 

The rollout has three stages. The foundational provisions, including the Board’s establishment, took effect on 13 November 2025. The consent manager framework becomes effective on 13 November 2026. Everything else, including notice, consent, security safeguards, breach reporting, individuals’ rights and penalties, applies from 13 May 2027. 

Who is covered 

The Act applies to digital personal data processed in India, including paper records that are later digitised. It also reaches processing outside India if it is connected with offering goods or services to people in India, so a foreign company selling to Indian customers is covered. Data processed by an individual for personal or domestic purposes, and data that the individual has made public, or that the law requires someone to publish, fall outside it. 

There is no size threshold. A small shop that collects customers’ phone numbers is covered just as a large company is, although the Government can exempt certain classes of businesses, such as start-ups, from some obligations, and some duties apply only to the largest data handlers. 

Four terms matter. The data principal is the individual the data relates to; for a child, this includes the parent or lawful guardian. The data fiduciary decides why and how the data is processed and carries most of the obligations. A data processor handles data on a fiduciary’s behalf, such as a payroll provider, cloud host or call centre. A consent manager is an Indian company registered with the Board that acts as a single point of contact, through an accessible and interoperable platform, for individuals to give, manage, review and withdraw consent across one or more data fiduciaries. One business can play different roles in different activities, and working out which is the first step in any compliance exercise. 

Consent and its alternatives 

Personal data may be processed only for a lawful purpose, and only on the basis of valid consent or a recognised legitimate use under the Act. Valid consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data necessary for the stated purpose. It must be preceded by a notice, understandable on its own, that itemises the data collected and the purpose, explains how to withdraw consent and exercise rights, and tells the person how to complain to the Board. The notice must be available in English or any language in the Eighth Schedule to the Constitution. Withdrawing consent must be as easy as giving it. Pre-ticked boxes and bundled consents are unlikely to meet this standard. 

The alternative is “legitimate use”. Section 7 permits processing without consent in specified situations, such as where a person has voluntarily provided data for a stated purpose and has not objected, or where processing is needed to comply with a law or court order, to respond to a medical emergency, or for certain employment purposes. 

Duties of businesses 

A data fiduciary must keep data accurate and complete where it is used to make decisions about an individual or shared with another fiduciary. It must adopt reasonable security safeguards, which under the Rules include measures such as encryption and access controls, and logs that must be retained for at least a year. It may engage processors only under a valid contract. Data must be erased when consent is withdrawn or the purpose is no longer served, whichever is earlier, unless the law requires it to be kept. Every fiduciary must publish the contact details of a person who can answer questions, and must provide a grievance redressal mechanism. 

Data may be transferred outside India except to countries the Government restricts by notification. The Act does not displace existing laws that impose stricter requirements, so sector-specific regulatory and data-localisation requirements, such as those of the Reserve Bank of India, may continue to apply alongside it. 

After a breach, the fiduciary must inform each affected individual without delay, in plain language, explaining what happened, the likely consequences, the steps taken and what they can do to protect themselves. It must also tell the Board without delay, followed by a detailed report within 72 hours of becoming aware of the breach, unless the Board allows more time. These duties sit alongside existing ones, such as reporting specified cyber incidents to CERT-In within six hours. 

Children and large data handlers 

A child is anyone under 18. Before processing a child’s data, a fiduciary must obtain verifiable consent from the parent or lawful guardian, and under the Rules must take reasonable steps to verify that the person giving consent is an identifiable adult and the child’s parent, for example through reliable identity details or a virtual token issued by an authorised service such as a digital locker. It must not process data in a way likely to harm the child’s well-being, and must not track or monitor a child’s behaviour or target advertising at children. The Rules give limited exemptions, for example to healthcare providers and educational institutions. 

The Central Government may designate “significant data fiduciaries” based on the volume and sensitivity of data they handle and the risk to individuals. They must appoint an India-based data protection officer and an independent data auditor, and carry out data protection impact assessments and audits every year. 

Rights, and duties, of individuals 

Individuals may ask for a summary of the data held about them, how it is processed, and the other fiduciaries and processors with whom it has been shared. They can have data corrected, completed, updated or erased, seek redress of grievances, and nominate someone to exercise these rights if they die or become incapable. The Act also places duties on individuals: not to impersonate others, suppress material information or file false or frivolous complaints. A breach of these duties can attract a penalty of up to ₹10,000. 

Enforcement and penalties 

The Board can inquire into breaches, impose penalties and accept voluntary undertakings, and works as a “digital office”, with filings and proceedings conducted largely through an electronic framework. Appeals from its orders lie to the Telecom Disputes Settlement and Appellate Tribunal, and civil courts cannot hear matters within the Board’s jurisdiction. The maximum penalties are steep: 

These are ceilings, not fixed amounts. The Board must weigh the nature, gravity and duration of the breach, the type of data involved and any steps taken to mitigate harm. Penalties go to the Government, not to affected individuals. The Act does not create a dedicated statutory compensation mechanism for individuals, and the compensation remedy under Section 43A of the IT Act goes with that section’s repeal. 

What businesses should do now 

Six months is shorter than it sounds, because compliance touches systems, contracts and people across a business. A sensible order of work is: 

1. Map your data. Identify the personal data you hold, where it comes from, why you hold it, where it is stored and with whom it is shared. 

2. Fix your roles. Decide whether you act as fiduciary, processor or both for each activity. 

3. Update notices and consent. Rework notices and consent flows on websites, apps, forms and onboarding documents. 

4. Review vendor contracts. Make sure every processor is bound by suitable contract terms. 

5. Plan retention and deletion. Set retention periods and a process to delete data no longer needed. 

6. Plan for breaches. Prepare a plan that can meet the 72-hour reporting window. 

7. Open a grievance channel. Publish a contact person and set up a complaints channel. 

8. Train your people. Begin with teams that handle the most personal data, such as HR, sales and customer service. 

The Act rewards preparation. Businesses that start now can spread the work over the coming months; those that wait until May 2027 will be doing it under pressure, with the Board’s penalty powers already in force.