DPDP Rules: what starts on 13 November 2026, and the date that matters more for small businesses
India's data protection rules come into force in phases. Only the Consent Manager framework starts in November 2026; the duties that touch every business follow in May 2027. Here is what to prepare, especially if you use AI tools with customer data.
On this page
India's data protection law is arriving in steps, and the next step is on 13 November 2026. That date is getting attention, but for most small businesses a later date matters more. This update explains both, and what to prepare if you keep customer details or use AI tools with them.
This is general information to help you prepare. It is not legal advice. Ask your lawyer, CA or adviser how the law applies to your business.
What happened: the DPDP timetable
The Government of India notified the Digital Personal Data Protection (DPDP) Rules, 2025 in mid-November 2025. With the DPDP Act of 2023, they set out how organisations must handle people's digital personal data. The government's note says the Rules give an eighteen-month period for phased compliance.
The timetable below uses the dates published by the law firm Hogan Lovells, which counts from 13 November 2025. The government's own note gives 14 November 2025 as the day the Rules were notified. A day's difference does not change what you need to do.
| When | What starts |
|---|---|
| November 2025 | The Data Protection Board and the basic definitions |
| 13 November 2026 | The rule on registration and obligations of Consent Managers |
| 13 May 2027 | Notice and consent, reasonable security safeguards, telling people about a breach, how long data is kept, contact details, children's data, the rights of individuals, transfers abroad |
A Consent Manager, in the government's words, is an entity that gives people one platform to give, manage, review or withdraw their consent. The note says Consent Managers must be companies based in India.
Why it matters for a small business
The November date will be in the news, but it is about a new kind of company, not about your shop or office. The practical deadline for most businesses is 13 May 2027, about seven months from now.
Two facts make it worth preparing early:
- The law's definition is wide. A "Data Fiduciary" is any entity that decides why and how personal data is processed. A business that keeps customers' names, phone numbers or addresses in digital form and decides how to use them fits that description. We found nothing in the government's note that exempts small businesses, so check this point with your adviser.
- The penalties are large. The government's note lists up to ₹250 crore for failing to keep reasonable security safeguards, up to ₹200 crore for not telling the Board or the affected people about a breach or for breaking the duties about children's data, and up to ₹50 crore for other violations.
Who should care
- Any business with a customer list in a phone, a spreadsheet, a CRM, billing software or WhatsApp.
- Online sellers and anyone who collects details through a website or form.
- Businesses whose team pastes customer details into AI tools.
- Anyone who handles children's data: the note says a parent's or guardian's verifiable consent is needed, except where the processing relates to essential services such as healthcare, education or real-time safety.
What changes for your business from 13 May 2027
In the words of the government's note:
- A clear notice. Every Data Fiduciary must give a separate consent notice that is easy to understand and explains the specific purpose for which personal data is collected and used.
- Consent can be withdrawn at any time.
- Security. Reasonable safeguards to keep personal data safe.
- Breaches. Affected people must be told without delay, in plain language: what happened, the possible impact, the steps taken, and whom to contact.
- A contact point. Clear contact information for questions about personal data must be displayed.
- Requests. People can ask to see, correct, update or, in certain situations, erase their data. Such requests must be answered within ninety days.
After 13 November 2026, registered Consent Managers can start to appear. Over time, some customers may give and withdraw consent through them. An ordinary business does not have to become one.
DPDP and AI tools
When someone in your team pastes a customer's name, number or complaint into an AI assistant, that information leaves your business and goes to another company. The government's note says Data Fiduciaries stay accountable for how personal data is used. Sending it to an AI tool does not hand that over.
Two guides help here: customer data, privacy and AI tools and simple AI rules for your team.
DPDP checklist for a small business: what to do now
- List the personal data you hold and where it sits: phones, spreadsheets, CRM, billing software, WhatsApp, AI tools.
- Write the reason next to each. Delete what you no longer need.
- Draft a simple notice: what you collect, why, how to contact you, and how to withdraw consent. You will need it on forms, on your website and in WhatsApp.
- Name one person who answers requests about personal data, and note the ninety-day limit.
- Tighten the basics: strong passwords, two-step login, and removing access for people who have left.
- Set a team rule for AI tools: no customer personal data in an AI tool unless the task needs it and the tool is approved.
- Ask your software providers (CRM, billing, WhatsApp, website) what they are changing, and ask your adviser to review your notice before May 2027.
What to watch next
- The first registered Consent Managers after 13 November 2026.
- The Data Protection Board starting its work. The government's note says it will have four members and work digitally, with complaints filed online.
- Any guidance written for small businesses.
- 13 May 2027.
Not sure where AI fits in your business? The free AI Business Checkup takes about three minutes.