Not legal advice. This article explains public information about India's Digital Personal Data Protection (DPDP) Act as of 10 November 2026. BITOMANCY is not a law firm. For decisions that affect your business, speak to a qualified lawyer.
If you run a blog, a small online shop or a freelance business in India, you have probably seen warnings that "DPDP compliance starts on 13 November 2026". That date is real, but it is widely misunderstood. Getting it wrong can send you into a panic now, or lull you into doing nothing until it is too late.
Below is the short, accurate version, followed by a checklist you can work through before the dates that actually matter.
What really changes on 13 November 2026
The DPDP Rules, 2025 were notified on 13 November 2025, and they switch on in stages. On that first date the Data Protection Board and the basic framework started. On 13 November 2026, one year later, two narrow parts of the law come into force: Section 6(9) of the Act and Rule 4 of the Rules. Together they open the registration route for Consent Managers, which are companies that let a person give, review and withdraw consent across different services from one place, and give the Board power to act on breaches of that registration.
In plain terms, November 2026 is about the companies that want to become Consent Managers. It does not, by itself, force an ordinary website, blogger or shop to change its sign-up form or privacy policy.
| Date | What takes effect | Who it affects |
|---|---|---|
| 13 Nov 2025 | Rules notified; Data Protection Board provisions begin | Mostly the government and the Board |
| 13 Nov 2026 | Section 6(9) and Rule 4: registration of Consent Managers | Companies applying to be Consent Managers |
| 13 May 2027 | Remaining provisions: notice, consent, security safeguards, breach reporting, children's data, user rights and penalties | Every business that processes digital personal data |
The date that matters: 13 May 2027
This is when the duties that touch your website arrive, and when the penalty provisions begin. Under the law, serious failures, such as not keeping reasonable security safeguards, can carry penalties of up to ₹250 crore, which is why even small operators should take the date seriously.
A proposal reported in January 2026 would have shortened the 18-month window to 12 months, at least for the largest "significant" data fiduciaries. According to trackers reviewed in October 2026, no such change has been published in the Official Gazette, so 13 May 2027 remains the legal date for the main obligations. Because governments can change timelines, check the Ministry of Electronics and Information Technology (MeitY) site and the Gazette before you rely on any date. A legal overview is also kept on the DPDP Act, 2023 entry on Wikipedia, and the January proposal is summarised by Legal 500.
Does the Act apply to a small website?
The Act covers digital personal data, meaning information about an identifiable person that is collected in digital form. If your site collects names or email addresses through a contact form or newsletter, stores comments, uses analytics or advertising cookies, or sells products to individuals, you are probably handling personal data. The law calls the business that decides why and how that data is used a "data fiduciary". Whether any exemption or special rule applies to your exact situation is a legal question, so treat the list below as housekeeping that costs little and helps either way.
A DPDP readiness checklist for site owners
You have roughly six months. Spread the work out, one job a month.
1. Map what personal data you collect
Write down every place your site or business gathers information: contact forms, newsletter sign-ups, comments, checkout and invoices, analytics, advertising scripts, and any third-party tool. For each one note what is collected, why, where it is stored and who else can see it.
2. Collect only what you need
If a form asks for a phone number you never use, remove the field. Less data means less to protect and less to explain.
3. Write a plain-language privacy notice
The new rules expect a clear notice that tells people what you collect and for what purpose. Review your privacy policy against your data map and replace vague wording with specific statements. Make sure the contact details people can use to raise questions or complaints are current. You can reach us through our contact page, and your own site should offer something equally clear.
4. Make consent specific and easy to withdraw
Do not pre-tick consent boxes or bundle unrelated purposes together. Offer a simple way to withdraw, for example an unsubscribe link in every email that actually works.
5. Get the security basics right
Use HTTPS everywhere, keep software and plugins updated, use strong and unique passwords with two-factor login, limit who can access customer data, and keep backups. These are inexpensive steps, and "reasonable security safeguards" is the area where the law's largest penalties sit.
6. Prepare a breach plan
Decide in advance who handles a suspected breach, how you would find out what was affected, and how you would inform the Board and the people concerned. A one-page plan written now is far better than improvising during an incident.
7. Check what your third-party tools do
Payment pages, email services, analytics and ad networks all process data on your behalf or alongside you. Read their data terms, and name the important ones in your notice. If you plan to run ads, remember that the Act restricts tracking and targeted advertising aimed at children, so think about who your audience really is. Our AdSense approval checklist covers the policy pages Google expects to see.
8. Keep records and a retention rule
Keep a simple log of notices shown and consents given, and decide how long you keep each kind of data. When the period ends, delete it.
InvoiceKit: privacy-friendly GST invoicing
Create professional GST invoices in about a minute. InvoiceKit runs offline in your browser and your data stays on your own computer, so there is no cloud account holding your customers' details.
Get InvoiceKit → Learn moreCommon myths to ignore
- "Everything starts on 13 November." No. That date is about Consent Manager registration. The main duties start on 13 May 2027.
- "I must integrate a Consent Manager now." Not on 13 November. Consent Managers are an option for people to manage consent, and the integration details depend on what the Board publishes.
- "My site is too small to matter." Size is not a safe assumption. Cheap housekeeping now is wiser than guessing later.
- "A cookie banner solves it." A banner is one piece. Notice, purpose limits, security and breach handling matter too.
Key Takeaways
- 13 November 2026 opens Consent Manager registration, not full compliance.
- The main obligations and penalties begin on 13 May 2027, and no shortening has been published in the Gazette as of October 2026.
- Start with a data map, a clear privacy notice, easy withdrawal of consent and basic security.
- Check your third-party tools and any advertising that could reach children.
- Verify dates with official sources and talk to a lawyer for your specific case.
Frequently Asked Questions
Is 13 November 2026 the DPDP compliance deadline?
No. On that date, Section 6(9) and Rule 4 begin, which allow companies to register as Consent Managers. The deadline for most businesses is 13 May 2027.
What happens on 13 May 2027?
The remaining provisions apply, including requirements on notice and consent, security safeguards, breach reporting, children's data and user rights, along with the penalty provisions.
Could the deadline be moved earlier?
A proposal to shorten the window, mainly for the largest data fiduciaries, was reported in January 2026. As of October 2026 it had not been notified in the Gazette. Watch official sources for any change.
Do I need a Consent Manager?
Not to comply. A Consent Manager is a registered platform that lets individuals manage consent across services. Whether it affects your product depends on how the Board's rules develop.
Conclusion
The calm reading of the DPDP calendar is also the most useful one: nothing breaks for ordinary sites on 13 November, but 13 May 2027 is coming, and the work is mostly sensible housekeeping. Map your data, tighten your notice, secure your systems and plan for a breach. Do one task a month and you will be in good shape, whatever the Board publishes next.
How we checked
This article was prepared on 10 November 2026 from the text and reporting available on that date, including the Act's commencement provisions and published legal commentary on the DPDP Rules, 2025. BITOMANCY is independent and not affiliated with any government body. If you notice an update, tell us and we will revise this page.
Explore More on BITOMANCY
Want more practical AI and technology guides? Visit the BITOMANCY homepage for more articles on artificial intelligence, automation, SEO and emerging technology.