Who does the DPDP Act apply to?
The Act regulates digital personal data within its statutory scope. It covers data collected digitally and data collected offline and later digitised. It may also apply to processing outside India connected with offering goods or services to people in India, subject to statutory exclusions. An organisation that determines the purposes and means of processing is generally a Data Fiduciary, and the individual concerned is the Data Principal.
For businesses, the challenge is to map where personal data is held, understand the basis for each use, and set up workable processes for notices, consent where required, security and individual rights.
DPDP implementation timeline
| Date | Regulatory milestone | What businesses should understand |
|---|---|---|
| 13 November 2025 | Specified provisions commence and the Rules are notified | Institutional framework begins |
| 13 November 2026 | Consent Manager registration framework commences | Eligible organisations may pursue registration under the Board's process |
| 13 May 2027 | Principal operational provisions commence | Main requirements for notices, consent, rights, security and related duties become applicable |
13 November 2026: Consent Managers arrive
Twelve months after notification, the provisions on Consent Managers take effect. A Consent Manager is a company registered with the Data Protection Board of India that gives individuals a single, interoperable platform to give, manage, review and withdraw consent across many organisations.
For most businesses, this date does not create a new obligation on its own. It does change what customers can expect. Once registered Consent Managers start operating, some of your customers may choose to give or withdraw consent through one, and your systems need to be ready to accept those instructions.
A company that buys consent management software for its own website does not become a registered Consent Manager simply by using that software. This distinction matters when you evaluate vendors and describe your own products.
- Consent Managers must be companies incorporated in India and meet the conditions in the DPDP Rules before the Board registers them.
- Rule 4 and the First Schedule set out the registration and operating conditions, including organisational eligibility, financial and technical capacity, and accountability to Data Principals.
- They act on behalf of the Data Principal, not the business, and must avoid conflicts of interest with Data Fiduciaries.
- They must keep records of the consents they handle and make them available to the Data Principal.
13 May 2027: the core obligations apply
Eighteen months after notification, the obligations that affect day-to-day operations switch on. This is the deadline most organisations should plan around:
- Notices: a clear, standalone notice listing the personal data collected and the specific purpose, before or at the time of asking for consent. Separate purposes should not disappear inside vague wording or unrelated terms.
- Consent: free, specific, informed, unconditional and unambiguous consent, with withdrawal as easy as giving it.
- Legitimate uses: the Act also recognises certain legitimate uses other than consent, so not every processing activity necessarily relies on consent.
- Security safeguards: reasonable measures such as encryption, access control, logging and backups to prevent personal data breaches, backed by vendor oversight and an incident response process.
- Breach intimation: informing the Data Protection Board and each affected Data Principal about a personal data breach.
- Data Principal rights: access, correction, updating, completion, erasure, grievance redressal and nomination. These workflows may involve identity verification, data discovery and coordination across systems.
- Retention and erasure: deleting personal data once the purpose is served, subject to the timelines in the Rules.
- Children's data: verifiable parental consent and no tracking, behavioural monitoring or targeted advertising directed at children, subject to the statutory exemptions.
What to do before 13 November 2026
- Nominate an owner for DPDP compliance, with backing from leadership and a budget.
- Build a data inventory: what personal data you collect, where, why, and which systems and processors touch it.
- Decide how your consent records will be stored so they can be proved, searched and updated from one place.
- Check that your consent platform can expose APIs, so it can later accept consent and withdrawal instructions from Consent Managers.
What to do between November 2026 and May 2027
- Rewrite notices in plain language and translate them into the languages your customers use.
- Roll out purpose-based consent capture on websites, apps, forms and assisted channels such as branches and call centres.
- Launch a preference centre where customers can review and withdraw consent themselves.
- Set up workflows for access, correction, erasure and grievance requests, with response times you can track.
- Update contracts with Data Processors to cover security, breach reporting and erasure instructions.
- Run a breach response drill and test your notification templates.
- Do a final gap review in March 2027, leaving time to fix what it finds.
DPDP readiness checklist
- 1Map personal data across systems, vendors and departments.
- 2Identify purposes and lawful grounds for each meaningful processing activity.
- 3Review privacy notices and design clear, purpose-based disclosures.
- 4Implement consent and withdrawal controls where consent is required.
- 5Prepare rights and grievance workflows with accountable owners.
- 6Review processors and contracts, including security arrangements.
- 7Assess retention and erasure in light of other applicable laws.
- 8Test end-to-end operation, not just front-end consent screens.
Why waiting until 2027 is risky
The Data Protection Board can impose penalties of up to ₹250 crore for failing to take reasonable security safeguards, and up to ₹200 crore for failures such as not notifying a breach or not meeting the obligations for children's data. The work behind compliance, such as mapping data, changing forms and integrating systems, depends on IT release cycles that are already planned months ahead.
Customer information may live in CRM software, analytics systems, marketing tools, help desks, HR applications, cloud databases and outsourced services. A withdrawal recorded in one system may not automatically stop processing elsewhere. For many businesses, integrating these systems is harder than writing a notice.
How ConvergeDPDP helps
ConvergeDPDP gives you one consent hub for every channel: purpose-based consent capture, privacy notice versioning, time-stamped consent records, a preference centre for withdrawals, a cookie consent manager, Data Principal rights and grievance workflows, and a tamper-evident audit trail. Web and mobile SDKs and REST APIs connect it to your existing systems, and data is hosted in India.
These functions support a structured compliance programme when they are correctly configured and paired with legal, operational and security measures.
Conclusion
November 2026 and May 2027 are different DPDP milestones. The first brings the regulated Consent Manager registration framework into force; the second is the central date for businesses' operational obligations. Treat compliance as an ongoing data governance programme rather than a one-time form or banner installation.