You may see headlines this November saying India's data protection law "kicks in". That is only partly true. On 13 November 2026, the rules for consent managers start to apply. Most of the obligations you would actually notice, such as clearer consent notices, your rights over your data and breach alerts sent to you, start on 13 May 2027. Here is what each date means, how someone might try to exploit the confusion, and what a small business should do now.
The timeline in one paragraph
The government notified the Digital Personal Data Protection Rules, 2025 in November last year, with an 18-month phased timeline, as the PIB release put it. Law firm Khurana & Khurana sets out the phases: Data Protection Board provisions took effect immediately on 13 November 2025; consent manager provisions within 12 months, by 13 November 2026; and the core obligations within 18 months, by 13 May 2027.
What a consent manager is
PIB describes consent managers as entities that help individuals manage their permissions, and says they must be Indian companies. In practice, a consent manager is meant to be a single place where you can give, review and withdraw consent you have given to different companies, through a platform that works across them.
Think of it as a switchboard for your data permissions. Instead of hunting through ten apps' settings, you would see who you have said yes to, and change it in one place.
Not just anyone can run one. According to ConsentOS's timeline, the conditions include being a company incorporated in India with a net worth of at least ₹2 crore, an interoperable platform and fit and proper directors. Registration with the Data Protection Board becomes mandatory from 13 November 2026 for anyone operating as one.
What changes for you on 13 November
Honestly, very little on day one. Companies can begin registering as consent managers. You will not suddenly get new rights that day, and your apps are not required to change their consent screens yet.
That gap between headlines and reality is where trouble starts. New rules with official-sounding names make good bait. Be ready for messages like:
"Under the new DPDP Act, you must update your data consent within 24 hours or your bank account will be frozen. Click here."
"Register with the government consent manager to protect your Aadhaar. Fee ₹199."
A caller claiming to be from the "Data Protection Board" asking you to verify your details.
Here is why these work: they borrow a real change you half-heard about, add urgency and ask for one small action. Nothing in the published rules asks individuals to "update consent" through a link sent by SMS, and you do not need to pay anyone to "register" yourself. Treat any such message as a scam: do not click, do not pay, and report it at cybercrime.gov.in or by calling 1930.
How to check a "DPDP" message in ten seconds
Who sent it? A random mobile number or an unfamiliar sender ID is a red flag.
Where does the link go? Read the address. Lookalike domains with extra words or hyphens are the classic trick.
Is there a deadline in hours? Real rule changes come with months of notice, as this one did.
Does it ask for money, an OTP or your Aadhaar number? Stop there.
What arrives in May 2027
This is the date that changes your day-to-day. From PIB's summary of the framework:
Companies must give standalone, clear consent notices explaining the specific purpose they collect your data for.
You get the right to access, correct, update or erase your personal data, and to nominate someone to do this for you. Companies must respond within a maximum of 90 days.
If there is a breach, companies must tell affected people promptly in plain language: what happened, possible consequences, what they did and who to contact.
Processing children's data needs verifiable consent, with limited exemptions such as healthcare and education.
The Data Protection Board works digitally, so you can file and track complaints online.
The penalties are large. ConsentOS lists up to ₹250 crore for failing to take reasonable security safeguards. That is the reason big companies are busy now.
Do this today if you run a small business
Six months sounds like a long time. It is not, if you have never thought about where customer data lives. Start small:
Write down every place customer personal data sits: your billing software, a WhatsApp Business list, a Google Sheet of orders, delivery addresses in your courier dashboard.
Delete what you do not need. An old spreadsheet of 2023 customers' phone numbers is risk with no benefit.
Name one person who answers privacy questions, and put a contact email on your website and invoices.
Write a one-page breach plan: who notices, who decides, how you tell customers, who you call for help.
Ask your software vendors, in writing, what they are doing to meet the May 2027 obligations.
Turn on two-factor authentication on every account that holds customer data. It is the cheapest security safeguard there is.
Do this today as an individual
Open your phone's app permissions and remove access you do not use, especially contacts and location. Note which apps hold sensitive data about you, such as health, money and identity, so that when your rights start in May 2027, you know where to use them first.
This is general information, not legal advice. If your business handles large volumes of personal data or children's data, talk to a lawyer who works on DPDP compliance.
