Introduction: What Happens on 13 Nov 2026 and Why It Matters
DPDP Phase 2 starts on 13 November 2026, but most businesses do not suddenly face the full set of DPDP obligations on that day.
The main change is the start of the Consent Manager registration and obligation framework under Section 6(9) of the DPDP Act, Rule 4 and the First Schedule.
A Consent Manager is a registered platform that allows people to give, manage, review and withdraw consent through one interface.
In addition, Phase 2 brings Section 27(1)(d) into force. This gives the Data Protection Board of India the power to inquire into breaches of the registration conditions of a Consent Manager.
For most MSMEs and startups, the more important date is still 13 May 2027. That is when most of the remaining operational obligations come into force.
Therefore, 13 November 2026 should not be treated as a sudden compliance deadline for every business.
Instead, it is better viewed as the start of a six-month preparation window.
What Phase 2 Does Not Change Yet
Most day-to-day DPDP obligations for businesses still begin on 13 May 2027, not on 13 November 2026.
These include:
- Notice requirements
- Consent-related obligations
- Reasonable security safeguards
- Personal data breach reporting
- Data retention and erasure requirements
- Children’s data obligations
- Data Principal rights
- Applicable monetary penalties under the Act for breaches of the relevant provisions
This distinction matters because businesses may see “DPDP Phase 2 starts” and assume the entire compliance framework becomes applicable immediately.
However, that is not the case.
At the same time, waiting until May 2027 to start preparing would leave very little time to identify gaps, review vendors, update systems and train employees.
Therefore, the next six months should be treated as an implementation period.
November 2026: Find Your Data
Start by identifying what personal data your organisation collects.
Next, map where the data comes from, where it is stored and who can access it.
Include:
- Website forms
- CRM platforms
- HR systems
- Customer applications
- Cloud storage
- Marketing systems
- Payment or support platforms
Without this visibility, it becomes difficult to build reliable privacy or security controls.
December 2026: Check External Exposure
Next, look at what is visible from outside your organisation.
For example, review:
- Internet-facing systems
- Forgotten servers
- Old subdomains
- Exposed services
- Leaked credentials
- Lookalike domains
- Fake apps
- Email security configuration
As a result, you may uncover risks that sit outside your normal internal monitoring.
January 2027: Review Notices and Consent
Check what users are told when their personal data is collected.
Then ask:
- What data are we collecting?
- Why are we collecting it?
- Where do we rely on consent?
- Can a user understand what they are agreeing to?
- How would they withdraw that consent?
The goal is not to add more legal text. Instead, it is to make your data practices understandable and manageable.
February 2027: Tighten Security
Review the safeguards around systems that handle personal data.
In particular, focus on practical controls such as:
- Access control
- Multi-factor authentication
- Endpoint protection
- Backups
- Logging
- Monitoring
- Account review
- Incident detection
However, avoid treating this as a one-time technical checklist.
Security controls need to work consistently, not just exist on paper.
March 2027: Build a Breach-Response Plan
Decide what happens if personal data is exposed.
For example, your plan should answer:
- Who detects the incident?
- Who investigates it?
- Who contains it?
- Who decides whether personal data is involved?
- Who communicates with affected people?
- Who communicates with the Data Protection Board?
A written plan is useful. More importantly, a tested plan is better.
April 2027: Review Vendors and Retention
Identify vendors and service providers that process personal data for your organisation.
Then understand what data they receive and why.
In addition, review how long personal data is being retained.
If information is no longer required, your business should know how and when it should be erased.
May 2027: Final Check and Training
Use the final weeks before Phase 3 to test what you have built.
Review your:
- Data map
- Consent flows
- Privacy notices
- Security controls
- Breach-response process
- Vendor responsibilities
- Retention practices
- Internal contacts
Finally, train the employees who will actually use these processes.
The objective is simple: avoid discovering major gaps after the obligations have already come into force.
Where Security Fits: You Can’t Protect What You Can’t See
DPDP readiness is not only a legal-document exercise. It also depends on knowing where your technical exposure exists.
From May 2027, businesses will need to take reasonable security safeguards to protect personal data.
Therefore, security cannot be separated from compliance.
For example, a company may have strong internal policies but still have an exposed server, leaked employee credentials or an old subdomain that nobody is monitoring.
Common external exposures may include:
- Forgotten servers or subdomains still connected to the internet
- Employee passwords leaked on the dark web
- Lookalike websites or fake mobile apps using the company’s identity
- Expired SSL certificates
- Misconfigured email domains
Although these issues may exist outside the main production environment, they can still create security and fraud risk.
Breach Reporting Also Makes Visibility Important
When a Data Fiduciary becomes aware of a personal data breach, it must inform the Data Protection Board and affected Data Principals without delay.
A Data Fiduciary is simply the organisation that decides why and how personal data is processed.
In addition, the organisation must provide updated and detailed information to the Board within 72 hours of becoming aware of the breach.
The Board may permit a longer period following a written request.
Because of this, visibility becomes critical.
A business cannot report or contain an exposure quickly if it does not know that the exposure exists.
That is why external visibility should be part of DPDP preparation.
For smaller businesses without a large security team, the first question should be:
What can someone outside our organisation see, misuse or exploit today?
The Financial Impact Can Also Be Significant
Under the Act, failure to take reasonable security safeguards can attract a penalty of up to ₹250 crore.
In addition, failure to notify the Board or affected Data Principals of a personal data breach can attract a penalty of up to ₹200 crore.
However, the useful response is not fear.
It is preparation.
Conclusion: Start With What’s Visible From Outside
The next six months give businesses time to move from DPDP awareness to practical readiness.
Start with the basics.
First, know what personal data you hold and where it is stored.
Next, understand how consent works and review your vendors.
Then prepare for breach reporting and identify security exposures that are already visible from outside your organisation.
For a quick starting point, C9Lab’s free Business Risk Score checks website health, email protection, domain misuse and dark web exposure in about a minute.
Start with what’s visible from outside.
Comments
Join the discussion. We’d love to hear your thoughts.