13 November 2026: Another Important Milestone in India’s DPDP Journey

13 November 2026 · Sri Tulasi Tech Labs

One year ago, on 13 November 2025, the Government of India notified the phased commencement of the Digital Personal Data Protection Act, 2023.

Today marks another important milestone in that implementation journey.

Under the notified commencement schedule, specific provisions relating to Consent Managers, including Section 6(9) and Section 27(1)(d) of the DPDP Act and Rule 4 of the DPDP Rules, come into effect one year after publication.

But there is a much bigger milestone ahead.

13 May 2027 is the scheduled commencement date for the major remaining provisions of the DPDP Act and Rules.

This includes the provisions relating to:

• Processing of digital personal data.
• Notice and consent requirements.
• Responsibilities of Data Fiduciaries.
• Security safeguards and personal data breach notifications.
• Rights of individuals (Data Principals).
• Additional obligations applicable to Significant Data Fiduciaries.

What should organizations be doing now?

Whether you are a startup, MSME, manufacturer, retailer, educational institution, healthcare provider, service company or large enterprise, this is the time to start understanding your data protection practices.

Here are some practical first steps:

1. Understand your data

Identify what personal data your organization collects, why it is collected, where it is stored and who has access to it.

2. Identify your stakeholders

Review how customer, employee, supplier, visitor and other personal data is handled across departments.

3. Review your existing practices

Look at privacy notices, consent practices, data access, retention, security safeguards and arrangements with third-party service providers.

Disclaimer: This article provides general information and is not legal advice. Applicability and obligations depend on the organization’s circumstances and the applicable provisions and commencement dates.