Updated 2 November 2026. This is a technology guide, not legal advice. Confirm your obligations with a lawyer.
Short answer: India's Digital Personal Data Protection (DPDP) Rules were notified on 13 November 2025 and are coming into force in phases. The Consent Manager framework (Rule 4) starts on 13 November 2026, and most of the remaining duties for businesses, such as notices, consent, security, breach reporting and children's data, start on 13 May 2027, according to King Stubb & Kasiva and Lakshmikumaran & Sridharan. If you run an app, website, CRM or any software that collects customer data, the next six months are your build window.
The timeline in one table
| Date | What starts |
|---|---|
| 13 Nov 2025 | Rules notified; provisions setting up the Data Protection Board |
| 13 Nov 2026 | Consent Manager framework (registration and obligations of consent managers) |
| 13 May 2027 | Most substantive duties: notice, consent, security safeguards, breach reporting, retention, children's data, rights of users |
Some media reports have talked about bringing the later deadline forward. Nothing like that is confirmed in the sources above, so plan for May 2027 but do not leave the work to the last month. Penalties under the Act can go up to Rs 250 crore per instance of non-compliance.
What is a consent manager?
A consent manager is a registered company that gives users one place to give, review and withdraw consent across many businesses, a bit like how account aggregators work for financial data. From 13 November 2026, companies can register with the Data Protection Board as consent managers if they meet the conditions in the Rules.
For most businesses the practical question is not "should we become one" but "should our app accept consent through one". You are not forced to use a consent manager, but your system should be able to record consent that arrives that way, and honour a withdrawal that comes through one, once they are live.
What your software should support
- A clear notice before you collect data. Plain language, itemised: what data, for what purpose, how to withdraw consent and how to complain. The Rules allow users to ask for the notice in English or any language in the Eighth Schedule of the Constitution, so plan for multiple languages.
- Purpose-wise consent, not one tick box. Separate consent for marketing messages, analytics and service delivery. Do not pre-tick boxes.
- A consent log. Store who consented, to which notice version, for which purpose, when and through which channel (web form, app, WhatsApp, consent manager). This is your evidence if a complaint comes.
- Easy withdrawal. Withdrawing should be as easy as giving consent: a link in emails, a setting in the app and an API for consent managers. When consent is withdrawn, stop the processing and tell your vendors.
- User rights requests. A simple way for users to ask what you hold, correct it or have it erased, with a tracked workflow and response deadlines.
- Retention and deletion. Decide how long each type of data is kept and automate deletion. Old leads in a CRM and old WhatsApp exports are common problem areas.
- Security safeguards. Encryption, access control, logging and monitoring. Keep access logs so you can investigate an incident.
- Breach response. The Rules require you to inform affected users and the Board when a personal data breach happens, with a detailed report to the Board within 72 hours. Write the playbook now and assign owners.
- Children's data. If children can use your product, you will need verifiable consent from a parent or guardian before processing their data. School and edtech apps should start designing this flow early.
- Vendor contracts. Your hosting, SMS, WhatsApp, email and analytics providers process data on your behalf. Make sure contracts and settings match your notice.
Where Indian businesses usually have gaps
- Lead forms that collect a phone number and push it to five tools with no record of what the person agreed to.
- WhatsApp marketing lists built from old customer records without fresh consent. Read our guide to the WhatsApp Business API for the opt-in side.
- Shared logins to the CRM or admin panel, which make it impossible to know who accessed what.
- No deletion, so data from years ago sits in spreadsheets and backups.
- Clinic, school and pharmacy software holding sensitive data with weak access control. If you are choosing such software, see our clinic software checklist and school software features guide.
A six-month plan
- November-December 2026: map what personal data you collect, where it is stored and who it is shared with.
- January-February 2027: rewrite notices, split consent by purpose and build the consent log.
- March-April 2027: add withdrawal, rights requests, retention rules and the breach playbook; tighten access control.
- Before 13 May 2027: test everything, train staff and keep a short compliance file with evidence.
Frequently asked questions
Does the DPDP Act apply to small businesses?
Yes. It applies to digital personal data regardless of company size, although some duties are heavier for businesses notified as Significant Data Fiduciaries.
Do I have to use a consent manager?
No. Users can still give consent directly to you. Consent managers are an additional route that your systems should be able to handle.
What changes on 13 November 2026 for an ordinary business?
Mostly nothing you must switch on that day. It is the date consent managers can start operating, and a good marker for beginning the work due by May 2027.
Is a privacy policy enough?
No. A policy page is only one part. The Rules expect itemised notices, recorded consent, working withdrawal, security safeguards and a breach process inside your actual product.
How we can help
Nextinera builds privacy-ready websites, apps and CRMs: consent capture and logs, user rights workflows, retention jobs and secure access control. See our cyber security, CRM development and software modernization services, or get a free website audit. We are a technology company, not a law firm.