India is moving towards a new phase of digital privacy regulation as the implementation of the Digital Personal Data Protection (DPDP) Act, 2023, progresses. The Data Protection Board of India (DPBI) is expected to play a central role in overseeing compliance, addressing grievances and regulating the emerging Consent Manager ecosystem.
The latest milestone concerns the November 2026 commencement of the regulatory framework for Consent Manager registration. The development is intended to give individuals greater control over how organisations collect, use and share their personal information.
However, the transition is taking place in stages. Most substantive obligations relating to data security, individual rights, breach notifications and financial penalties are scheduled to become applicable in May 2027. This means businesses still have a preparation period, but they will need to use it to review their data practices and compliance systems.
Consent Managers Could Transform How Individuals Manage Personal Data
Consent Managers are a key feature of the DPDP framework. They are designed to act as intermediaries through which individuals can provide, review, manage and withdraw consent for the processing of their personal information.
For example, a person using several digital services may eventually be able to manage permissions through a registered Consent Manager rather than accessing separate privacy settings on every platform.
Section 6(9) of the DPDP Act provides for the registration of Consent Managers with the Data Protection Board. Rule 4 of the DPDP Rules, 2025, specifies the eligibility conditions and registration requirements.
Applicants must be companies incorporated in India and demonstrate adequate technical and financial capacity. The prescribed framework also requires a minimum net worth of ₹2 crore, along with standards concerning transparency, interoperability and platform security.
Registered Consent Managers will be required to maintain consent-related records for at least seven years, manage potential conflicts of interest and ensure that personal information shared through their systems remains unreadable to them.
The Board will have the authority to assess applications and take action, including suspension or cancellation of registration, in accordance with the prescribed procedure.
Importantly, the framework does not require every business or individual to use a Consent Manager. Individuals will have the option of using these services to manage their permissions once the system becomes operational.
Data Protection Board to Handle Complaints and Regulatory Enforcement
The Data Protection Board of India is the central institution responsible for administering important parts of the new privacy framework.
Its functions include examining complaints, addressing specified violations, issuing directions and determining financial penalties under the legislation.
The DPDP Act establishes significant maximum penalties for certain forms of non-compliance:
Type of violation | Maximum statutory penalty |
|---|---|
Failure to implement reasonable security safeguards | ₹250 crore |
Failure to notify a personal data breach | ₹200 crore |
Breach of obligations relating to children's personal data | ₹200 crore |
These amounts are statutory ceilings, not automatic fines. The Board must consider relevant circumstances, including the seriousness, duration and consequences of a violation, before determining an appropriate penalty.
The Board's operational readiness is therefore an important part of the implementation process.
According to the supplied report, the Ministry of Electronics and Information Technology invited applications for the chairperson and four members in May 2026. A parliamentary response in August confirmed that recruitment advertisements had been issued.
Although the Board's website, dpbi.gov.in, has reportedly become operational, the availability of a website alone does not establish that all appointments, administrative arrangements or adjudicatory functions are fully in place.
May 2027 Deadline Places Businesses Under Compliance Pressure
The Government's phased implementation approach gives organisations time to prepare for the new requirements. The next major milestone is May 2027, when most substantive obligations concerning Data Fiduciaries, individual privacy rights and financial penalties are scheduled to take effect.
A Data Fiduciary is an individual or organisation that determines the purpose and means of processing personal data. This definition covers a wide range of entities, including banks, hospitals, online retailers, educational institutions, social media platforms and employers.
Once the relevant provisions become applicable, organisations will need to review how they collect, store, process and share personal information. Key compliance responsibilities will include:
Data collection and processing: Identify the personal information being collected and establish the applicable legal basis for processing it.
Privacy notices: Provide individuals with clear information about how their data will be used.
Security safeguards: Strengthen technical and organisational measures to protect personal information.
Breach management: Establish procedures to detect, investigate and report personal data breaches.
Third-party oversight: Review contracts and security arrangements with external service providers handling personal data.
Employee awareness: Train staff to follow appropriate data protection and information-handling practices.
The framework also requires affected individuals to be informed about personal data breaches without delay. Detailed information must ordinarily be submitted to the Board within 72 hours, subject to the applicable rules and any permitted extension.
For businesses, preparation will involve more than updating privacy policies. Organisations may need to review software systems, access controls, vendor agreements, internal reporting procedures and employee responsibilities.
Companies can use this transition period to strengthen their SME compliance systems and assess whether their existing financial and operational processes are prepared for the new regulatory requirements.
Individual Privacy Rights and Regulatory Independence Under Scrutiny
Once the relevant provisions take effect, individuals will have statutory rights to obtain information about the processing of their personal data, seek corrections or erasure in specified circumstances and pursue grievance redressal.
The framework follows the Supreme Court's landmark 2017 judgment in Justice K.S. Puttaswamy v. Union of India, which recognised privacy as a fundamental right.
However, questions remain about the institutional design and independence of the Data Protection Board.
According to the supplied report, the Supreme Court sought the Centre's response in October 2026 to a petition filed by the Digital News Publishers Association. The petition challenges certain provisions of the DPDP framework, including aspects of the Board's constitution and powers.
It also raises concerns about press freedom and the absence of a specific exemption for journalistic activities. These are arguments presented in the legal challenge, not findings by the Supreme Court. The constitutional validity of the challenged provisions remains subject to judicial consideration.
The Road Ahead for India's Digital Privacy Framework
India's transition towards a formal data protection regime represents an important change in how businesses and institutions will be expected to handle personal information.
The success of the framework will depend on more than the publication of rules or the establishment of a regulatory institution. Effective implementation will require a functioning Data Protection Board, accessible grievance mechanisms, clear compliance expectations and practical safeguards for individuals.
For businesses, the period leading up to May 2027 provides an opportunity to identify weaknesses, improve data governance and establish reliable procedures before the wider obligations become enforceable.
For individuals, the emerging Consent Manager system could offer a more organised way to exercise control over personal information shared across digital services.
Ultimately, the effectiveness of India's privacy law will be measured by how consistently it protects individuals, holds organisations accountable and builds public confidence in the country's expanding digital economy.