Why 13 November 2026 Matters, and Why It Matters Less Than You Think
Only three sets of provisions commence on 13 November 2026: Rule 4 with the First Schedule, and sections 6(9) and 27(1)(d) of the Digital Personal Data Protection Act, 2023. How a Data Fiduciary collects, uses and protects data is governed from 13 May 2027.
What actually commences
A Consent Manager is a person registered with the Board that acts as a single point of contact through which a Data Principal can give, manage, review and withdraw consent on an accessible, transparent and interoperable platform (section 2(g)).
- Rule 4 sets out the application process and lets the Board register or reject applicants, direct corrective steps, and suspend or cancel a registration after a hearing.
- First Schedule, Part A sets entry conditions: incorporation in India, net worth of at least ₹2 crore, sound finances and management, directors and key managerial personnel with a record of fairness and integrity, and independent certification against standards the Board publishes.
- First Schedule, Part B sets continuing duties: the Consent Manager must be unable to read the data it carries, keep consent records for at least seven years, never subcontract its obligations, avoid conflicts with Data Fiduciaries, disclose its ownership, report audit outcomes to the Board and obtain prior Board approval for any change in control.
- Section 27(1)(d) lets the Board inquire into a breach of registration conditions and impose a penalty under the Act. In our reading, that penalty rests on section 33, and the inquiry on the procedure in section 28, both of which commence only on 13 May 2027.
[!NOTE] Both dates are computed from Gazette publication on 13 November 2025. The corrigendum G.S.R. 892(E) of 10 December 2025 did not change them.
What waits until 13 May 2027
Eighteen months after publication, sections 3–5, 6(1)–(8) and (10), 7–17, 27 (other than clause (1)(d)), 28–34, 36, 37 and 44(2) commence, with Rules 3, 5–16, 22 and 23. That brings in notice, security safeguards (Rule 6), breach intimation (Rule 7), erasure (Rule 8), data of children and persons with disability (Rules 10–12), Significant Data Fiduciary duties (Rule 13), rights (Rule 14), cross-border transfer (Rule 15) and penalties under section 33. Section 44(2) also omits section 43A of the IT Act, 2000.
One Year of the DPDP Rules: What Changed and What Did Not
The deadlines held and the Board stayed empty. Meanwhile the Act received two drafting corrections, the constitutional challenge went ahead without a stay, and sector regulators moved first.
Timelines: the compression proposal never became law
In January 2026 MeitY consulted stakeholders on shortening the eighteen-month window to twelve months, at least for the Significant Data Fiduciary duties in Rule 13 (Takshashila Institution, 26 January 2026). As on 9 November 2026 no amendment to G.S.R. 843(E) or G.S.R. 846(E) has been notified. The Act itself has changed once, in wording only. The Digital Personal Data Protection (Removal of Difficulties) Order, 2026 (S.O. 5458(E), published on 6 October 2026), made under section 43(1), clarifies section 9(1) on persons with disability and makes section 10(2)(c)(ii) require a periodic "data audit". No commencement date moved. No Significant Data Fiduciary has been designated either, and none can be under the current notification, because section 10 commences only on 13 May 2027.
The Board: established on paper, empty in practice
G.S.R. 844(E) established the Board and G.S.R. 845(E) fixed the number of its Members at four, both on 13 November 2025; the PIB backgrounder of 17 November 2025 also describes a four-member Board. MeitY's circular F. No. 2(1)/2026-Pers.I of 6 May 2026 invited applications for a Chairperson and four Members, at least one a law expert.
On 7 October 2026, in C.R. Neelakandan v. Union of India, WP(PIL) 15/2026, the Kerala High Court recorded the Union's statement that the Board was constituted but not functional, and expected it to be functional within eight weeks (LiveLaw), that is, by about 2 December 2026. We found no notified appointment as on 9 November 2026, and no published certification standard for Consent Managers. Since Part A requires certification against those standards, it is hard to see how any applicant can qualify yet.
The Supreme Court challenge: notice, no stay
On 16 February 2026 a bench led by the Chief Justice issued notice in Venkatesh Nayak v. Union of India, WP(C) 177/2026, and connected challenges to the Act and Rules, refused a stay and referred the matter to a larger bench (LiveLaw). The Act applies on schedule.
Sector regulators moved first
- RBI's cyber Directions for commercial banks (RBI/DoS/2026-27/410, 31 July 2026, immediate effect) require data classification, data leakage prevention reaching vendor sites, vendor audit rights and six-hour incident reporting, much of the Rule 6 groundwork.
- IRDAI's Information and Cyber Security Guidelines, 2026 (IRDAI/GA&HR/CIR/MISC/51/4/2026, 6 April 2026) require insurers to take technical and organisational measures to comply with the DPDP Act (MediaNama).
Four Gaps We See in Practice
Most programmes we review are stuck at one of four points.
Gap 1: Treating a Consent Manager as mandatory, or as a liability shield
What most organisations do: Assume they must sign up with a Consent Manager by 13 November 2026, or that doing so shifts the risk.
What the law requires: Section 6(7) says a Data Principal "may" act through a Consent Manager; nothing obliges a Data Fiduciary to integrate. Section 6(10) keeps the burden of proving notice and consent on the Data Fiduciary. Our April 2026 analysis of the Consent Manager framework still holds on architecture; only the timing has shifted.
Gap 2: Waiting for the Board before starting the May 2027 build
What most organisations do: Read the empty Board as a sign that enforcement will slip, and pause.
What the law requires: The vacancy delays registration and complaints, not the 13 May 2027 commencement already fixed by notifications in the Gazette.
Gap 3: Legacy consents and tracking scripts left untouched
What most organisations do: Redesign the consent banner for new users, ignoring existing customers and the advertising tags already running on their sites.
What the law requires: Section 5(2) requires a notice, as soon as reasonably practicable, to every Data Principal who consented before commencement. Rule 3 requires that notice to stand on its own, use plain language, itemise the data and purposes and offer an easy way to withdraw, and section 5(3) requires the option of reading it in English or any Eighth Schedule language.
Gap 4: Breach playbooks built for six hours, not for 72
What most organisations do: Build incident response around CERT-In's six-hour report.
What the law requires: Rule 7(1) requires each affected Data Principal to be told without delay what happened, the likely consequences and what she can do. Rule 7(2) requires intimation to the Board without delay and a detailed report within 72 hours on facts, cause, remediation and the notices sent.
The first question we ask in a readiness review is not which Consent Manager you will use. It is whether, for one customer picked at random, you can show the notice she saw, the consent she gave and every system that has used her data since. No intermediary can answer that for you.
SARC Risk & Compliance Practice
The 180-Day Plan to 13 May 2027
The 181 days from 13 November 2026 to 13 May 2027 suffice if workstreams run in parallel.
| Month | Workstream | Deliverable | Legal anchor | Lead owner |
|---|---|---|---|---|
| Nov 2026 | Discovery and lawful basis | Data inventory; purpose-by-purpose register of consent or legitimate use | ss.4, 6, 7 | DPO, Legal |
| Dec 2026 | Notices | Standalone, itemised notices; section 5(2) notices for existing customers | s.5; Rule 3 | Legal, Product |
| Jan 2027 | Consent and withdrawal | Consent logs tied to notice versions; withdrawal as easy as consent; tag clean-up | s.6(4), (10) | Product, IT |
| Feb 2027 | Safeguards and processors | Rule 6 gaps closed (encryption or masking, access control, one-year logs, backups); processor contracts updated | s.8(2), (5); Rule 6 | CISO, Procurement |
| Mar 2027 | Breach response | Rule 7 drill mapped to CERT-In and sector clocks; notice templates | s.8(6); Rule 7 | CISO, Legal |
| Apr 2027 | Retention, children, rights | Erasure schedules; verifiable parental consent, applying Fourth Schedule exemptions; 90-day grievance process | ss.8(7), 9, 11–14; Rules 8, 10, 14 | DPO, Operations |
| May 2027 | Sign-off | Evidence pack, residual-risk register, recorded Consent Manager decision | s.8(1) | Board, DPO |
One duty binds every Data Fiduciary, whatever its size. Section 8(9) and Rule 9 require the contact details of the Data Protection Officer, or of a person who can answer questions about processing, to be published prominently on the website or app and repeated in every reply to a Data Principal exercising her rights.
E-commerce entities and social media intermediaries with at least two crore registered users in India, and online gaming intermediaries with at least fifty lakh, must under Rule 8 and the Third Schedule erase data after three years without user engagement, giving at least 48 hours' notice. Two refinements matter here. The three-year clock runs from the Data Principal's last contact or from the commencement of the Rules, whichever is later. And Rule 8(3) requires every Data Fiduciary to keep personal data, associated traffic data and processing logs for at least one year for the purposes in the Seventh Schedule, so erasure routines need a carve-out. Likely Significant Data Fiduciaries should plan for an India-based Data Protection Officer (section 10(2)) and the Rule 13 duties of an annual Data Protection Impact Assessment, data audit and algorithmic due diligence, as covered in our DPIA practitioner guide.
By 13 May 2027, these six items should be on file:
- A data inventory signed off by business owners, not only IT.
- A lawful-basis register citing consent or a section 7 legitimate use for each purpose.
- Dated notice versions and proof that section 5(2) notices reached existing customers.
- Consent and withdrawal logs retrievable for any single Data Principal.
- Processor contracts with breach notice, erasure and audit clauses, as in our vendor compliance guide.
- A breach runbook with Rule 7 templates and a record of one full drill.
The Board-Level Conversation
Directors need three answers before 13 May 2027.
Exposure. The Schedule, applied through section 33, allows penalties of up to ₹250 crore for failing to take reasonable security safeguards, ₹200 crore each for failing to notify a breach or breaching obligations on children's data, ₹150 crore for breaching a Significant Data Fiduciary's additional obligations, and ₹50 crore for other breaches. The Board may impose them only after an inquiry finds a breach significant, weighing among other factors its gravity, duration and how promptly it was mitigated. Evidence of mitigation is worth money.
Burden. Under section 6(10), a board that has never seen a consent log has not seen its own defence.
Consent Managers. The board should minute whether it will integrate, build its own consent layer or reduce reliance on consent. Banks should also read our note on the DPDP gaps RBI alone will not close.
Frequently Asked Questions
Is the DPDP Act in force in 2026?
Partly. The definitions and the provisions establishing the Data Protection Board have applied since 13 November 2025. Consent Manager registration under section 6(9), the Board's power under section 27(1)(d) and Rule 4 commence on 13 November 2026. Notice, consent, security, breach intimation, rights and penalties commence on 13 May 2027.
Is it mandatory to use a Consent Manager under the DPDP Act?
No. Section 6(7) gives the Data Principal the option of acting through a Consent Manager and does not require a Data Fiduciary to integrate with one. If you do integrate, section 6(10) still places the burden of proving notice and consent on you, so your own consent records must be complete.
Who can become a Consent Manager in India?
A company incorporated in India with a net worth of at least ₹2 crore, adequate technical, operational and financial capacity, and directors and key managerial personnel of integrity. Its platform must be independently certified against standards the Board publishes, and the Board must register it under Rule 4.
Has the Data Protection Board of India been constituted?
Yes in law, but not yet in practice. G.S.R. 844(E) established the Board on 13 November 2025, but no Chairperson or Member had been appointed as on 9 November 2026. On 7 October 2026 the Kerala High Court said it expected the Board to be functional within eight weeks.
What is the DPDP compliance deadline for companies?
13 May 2027. On that date Rules 3, 5–16, 22 and 23 and the core sections of the Act, including sections 3–17 and the penalty provisions, commence. The date is eighteen months from Gazette publication on 13 November 2025, and only a fresh notification could change it.
Speak to our experts
Our advisory team is ready to help.
How SARC Can Help
SARC's Risk & Compliance Practice helps banks, insurers, digital platforms and hospitals with data discovery and lawful-basis registers, notice and consent redesign, Rule 6 and Rule 7 readiness testing mapped to CERT-In and sector regulators, and board evidence packs for 13 May 2027. Contact SARC's DPDP team to schedule a 180-day readiness review.
This article is for general information only and does not constitute legal or professional advice. The position stated is as on 9 November 2026.