DPDP Act: The Two Dates Every Business Must Plan Around — 13 November 2026 and 13 May 2027

If you hold one customer's phone number on a spreadsheet, the DPDP Act already covers you. Not just the big platforms. You.

The short answer: India's Digital Personal Data Protection Act, 2023 switches on in stages. On 13 November 2026, the Consent Manager registration framework opens under Rule 4 of the DPDP Rules, 2025. On 13 May 2027, the substantive duties land: notice, consent, safeguards, breach reporting and data rights.

Does the DPDP Act apply to a small business like yours?

Yes, in most cases. The Act applies to digital personal data processed within India, and to processing outside India connected with offering goods or services to people in India. Size is not an exemption. A clinic with 400 patient records, a coaching centre with a WhatsApp list, an online store with a checkout form — each is a Data Fiduciary, the Act's word for the business that decides why data is collected and how it is used.

Two carve-outs matter, and both are narrower than people assume. Data processed for purely personal or domestic purposes falls outside the Act, as does data the individual themselves made public or that someone published because a law required it. A number scraped from a public directory is not automatically "publicly available" in this sense. When in doubt, treat the data as covered.

Until the DPDP duties bite, you are not in a vacuum. Section 43A of the Information Technology Act, 2000 and the 2011 sensitive-personal-data rules still require reasonable security practices, and negligent failure can mean compensation to the affected person. Contracts help too — an NDA covers what a counterparty may do with information you share, but it is not a substitute for the statutory duties in this guide.

What actually happens on 13 November 2026?

Less than some headlines claim. The DPDP Rules, 2025 were notified on 13 November 2025 as G.S.R. 846(E), with a staggered start: Rules 1, 2 and 17 to 21 (definitions and the Board's machinery) at once, Rule 4 one year after publication, on 13 November 2026, and Rules 3, 5 to 16, 22 and 23 eighteen months after publication, on 13 May 2027.

Rule 4 is the Consent Manager chapter. A Consent Manager is a company incorporated in India, registered with the Board, that lets a person give, review and withdraw consent across several businesses through one interface. Think of it as one key-holder for every lock you have handed out: today a customer must chase each business separately to withdraw consent, but through a Consent Manager they turn one key and every connected business hears about it.

Here is the correction most guides skip: 13 November 2026 opens the registration framework for Consent Managers. It does not, by itself, force every business to integrate with one by that date. Whether you need one depends on your processing model and on the Board's standards as they emerge. Some coverage tells small businesses they must "integrate by November" — that reads a registration window as a compliance deadline, and the Rules do not say that. The Board can inquire into breaches of a Consent Manager's registration conditions under Section 27(1)(d), read with Section 6(9). The machinery becomes real before the duties do.

One honest caveat: as of October 2026, coverage reported that the Board itself was not yet fully staffed — MeitY told Parliament in August 2026 that the Chairperson and Members were still to be appointed. Check the current position before you rely on it.

What changes on 13 May 2027?

From this date, the duties most businesses will feel in daily work apply:

Notice first. Before or when you seek consent, give the person a clear-language notice: what data you collect, why, and how they can withdraw consent, exercise their rights, and complain. Offer it in English and the Eighth Schedule languages your customers actually read.

Consent that means something. Consent must be free, specific, informed, unconditional and unambiguous, shown by a clear affirmative action — a pre-ticked box fails that test. Withdrawing must be as easy as giving, and consent for appointment reminders is not consent for festival offers. Each purpose needs its own yes.

Reasonable security safeguards. Rule 6 expects encryption or masking, access controls, logs and monitoring, continuity arrangements, processor contracts holding vendors to the same standard, and a documented incident-response process. The test is reasonableness against what you hold — "we kept it in a shared drive" will not pass it.

Breach reporting on a hard clock. On a breach, inform the Board and each affected person without delay, and send the Board a detailed report within 72 hours of becoming aware. Do not confuse this with CERT-In's separate 6-hour cyber-incident duty — filing with one does not satisfy the other.

Rights you must be ready to honour. A person can ask for a summary of their data, its correction or erasure, and can nominate someone to act for them. Grievances carry an outer limit of 90 days under the Rules. Erase data once its purpose is served or consent is withdrawn, unless another law requires you to keep it — tax and company records often do, so write the retention rule down instead of guessing.

Children's data, handled separately. For a child under 18, you need verifiable parental consent, and you must not track, behaviourally monitor or target advertising at children.

Significant Data Fiduciaries carry more. The government designates certain fiduciaries as Significant based on volume, sensitivity and risk. If designated, you add a Data Protection Officer, impact assessments and audits. Most small businesses will not be designated.

What do the penalties actually look like?

The Act's Schedule sets ceilings, not fixed fines; the Board decides case by case. Failing to take reasonable security safeguards can attract up to ₹250 crore, failing to notify a breach up to ₹200 crore, children's-data breaches up to ₹200 crore, and Significant Data Fiduciary failures up to ₹150 crore. A data principal's own duties carry a ceiling of just ₹10,000.

Read those numbers the right way. No small coaching centre faces a ₹250 crore fine for a misfiled consent form. The ceilings exist so a large fiduciary cannot treat penalties as a cost of business. Your realistic exposure is a Board inquiry, a direction to fix the gap, and the trust lost with customers. Still, "small" is not a defence the Act recognises.

Your six-month build plan, in order

1. Map the data. List every place personal data sits: CRM, billing, email marketing, WhatsApp Business, spreadsheets, scanned paper forms. One row per system, one owner per row. Most businesses find copies they had forgotten.

2. Separate the purposes. For each collection point, write the purpose in one sentence. Booking, delivery updates, marketing offers — each gets its own consent. If you cannot state the purpose plainly, do not collect the data.

3. Draft the notice. One page, plain language, in English and the languages your customers read. State what you collect, why, how consent can be withdrawn, and how to complain — separate from your general terms. If you need the documents drafted, start with a website terms and privacy policy built around your actual data flows.

4. Fix the vendor contracts. Every processor — billing provider, marketing tool, ad agency — needs a written agreement limiting what it can do with the data and requiring safeguards. Your duty does not travel away with the data. A non-disclosure agreement is the starting point where a vendor will see customer data, but it does not replace a processor agreement that limits use and requires safeguards.

5. Write the breach runbook. Who gets the midnight call, who drafts the Board intimation, who contacts affected customers, where the 72-hour clock is tracked. A runbook written during a breach is written too late.

6. Set the retention rule. Decide, in writing, how long each category is kept and when it is deleted. Stale marketing lists, old enquiry forms, ex-employee records — each needs a date, not a feeling.

A note on the moving parts: in early 2026, MeitY was reported to be considering pulling the Significant Data Fiduciary deadline forward to November 2026. No amendment has been notified, and a Removal of Difficulties Order of 5 October 2026 corrected wording in Sections 9 and 10 without moving any date. Plan for May 2027, but check for a fresh notification before you sign off.

Three mistakes I keep seeing

Treating the privacy policy as the notice. A policy page nobody reads is not the standalone, plain-language notice the Rules require. The notice goes where consent is asked, not three clicks away.

One consent for everything. A checkout form taking a number "for order updates and offers" bundles two purposes into one yes. Split them: yes to delivery, no to marketing, order intact.

Assuming WhatsApp is someone else's problem. If you collect numbers through WhatsApp Business and broadcast offers from them, you are the fiduciary for that processing. The platform's terms do not transfer your duty.

The DPDP Act rewards boring work: a data map, a plain notice, a consent record, a runbook. All of it is cheaper in November than in May, when every other business in India will be asking the same professionals the same questions.

Frequently asked questions

Does the DPDP Act apply if I only have Indian customers and a simple website?
Yes, if you process their digital personal data — names, numbers, email addresses, payment details. The Act turns on the data, not the size of your team.

Must I integrate with a Consent Manager by 13 November 2026?
No. That date opens the registration framework under Rule 4. Whether your business needs one depends on your processing model and the Board's standards as they develop.

What happens if I miss 13 May 2027?
The substantive duties become enforceable, and the Board can inquire, direct corrective action, and impose penalties up to the Schedule ceilings. For most small businesses the practical risk is an inquiry, a fix direction, and lost customer trust.

Founders should also settle who owns data protection inside the company — the founders' agreement is where that responsibility is usually written down.

If your business holds customer data and has no written data map yet, that map is the first job. Start it this week, and the two dates stop looking like deadlines and start looking like a plan. Put both dates in your compliance calendar now, before the May work crowds them out.