India’s Digital Personal Data Protection (DPDP) Rules are entering a critical phase with the Consent Manager framework set to take effect on November 13. This marks the first compliance milestone for startups and businesses, which have just over four months to prepare. The DPDP law will fully come into effect on May 13, 2027, with severe penalties for non-compliance, including fines up to ₹250 crore for inadequate security safeguards, according to inc42.com.
The Consent Manager framework introduces regulated intermediaries that enable users to give, review, and withdraw consent for sharing their personal data through a single platform. Following the November rollout, the Data Protection Board, an independent adjudicatory body under the DPDP Act, will begin registering these Consent Managers. Businesses relying on these platforms must integrate systems capable of receiving real-time consent updates and acting on them promptly to meet compliance requirements, inc42.com explains.
The DPDP Act’s phased rollout underscores the growing regulatory focus on data privacy in India. The penalties for violations are substantial: up to ₹250 crore for failing to implement reasonable security safeguards, ₹200 crore for failing to report data breaches or mishandling children’s data, and ₹50 crore for other breaches. This regulatory environment is expected to significantly impact startups and established firms alike as they adapt to new compliance demands, inc42.com reports.
The next major compliance deadline is May 13, 2027, when the DPDP law will be fully enforced across India. Until then, businesses must prepare for the Consent Manager framework’s November 13 launch and ensure their systems can handle consent management in real time, as mandated by the Data Protection Board under the DPDP Act.