DPDP Phase 2 Starts November 13: What It Means for Security Teams
This Friday, 13 November 2026, India's Digital Personal Data Protection (DPDP) framework moves into its second phase. Most coverage of this milestone is written by lawyers, for lawyers. This post is written for the people who will actually have to make DPDP work: CISOs, SOC teams and IT heads.
The short version: Friday's change is narrow. It mainly concerns Consent Managers, and most organisations do not need to do anything on the day itself. The real deadline for security teams is 13 May 2027, when the security safeguard and breach notification rules come into force. That is about six months away, and six months is not long to build what those rules demand.
Here is what changes on Friday, who it affects, and a practical plan to be ready by May.
What actually happens on November 13
The DPDP Rules were notified on 13 November 2025 and come into force in three phases. On 13 November 2026, Rule 4 comes into force. It opens registration with the Data Protection Board of India (DPBI) for companies that want to act as Consent Managers.
A Consent Manager is a registered platform that lets a person give, review and withdraw consent across many companies from one place. Think of it as a single dashboard for your data permissions, instead of chasing each app separately. To register, a Consent Manager must be an Indian company with a minimum net worth of ₹2 crore and must meet technical and security requirements.
Two points are often misunderstood:
Using a Consent Manager is optional. The Rules do not require any company to use one. A business can collect and manage consent directly, as long as it meets the Act's consent requirements from May 2027.
The platforms may not be ready on day one. Registration opens on Friday, but it will take time before registered Consent Managers are live and integrated with businesses.
Who it affects, and who it does not
Organisation | What Friday means |
Companies planning to become Consent Managers | Registration opens. They must meet the eligibility, technical and security conditions before applying |
Businesses that plan to integrate with Consent Managers (banks, fintechs, telecom, large consumer apps) | Start API and consent workflow design now, so integration is ready when platforms go live |
Most other businesses, including MSMEs and startups | No direct obligation on Friday. Your main deadline is 13 May 2027 |
If you are not becoming a Consent Manager, treat Friday as a reminder, not a deadline. The clock that matters for you is the one running to May.
The three DPDP phases at a glance
Date | Phase | What comes into force |
13 May 2027 | Phase 3 | The core obligations: notice and consent (Rule 3), security safeguards (Rule 6), breach notification (Rule 7), data retention and erasure, children's data, Significant Data Fiduciary duties and most other operational rules |
13 Nov 2026 | Phase 2 | Consent Manager registration framework (Rule 4) |
13 Nov 2025 | Phase 1 | DPDP Rules notified; Data Protection Board of India set up |
For security teams, Phase 3 is the one that changes daily work. Rules 6 and 7 turn "reasonable security" from a vague expectation into specific, enforceable controls with large penalties attached.
Rule 6: what "reasonable security safeguards" means in practice
Rule 6 sets minimum security measures for every organisation that processes personal data. Here is how each requirement translates into controls a security team can actually deploy.
Rule 6 requirement | What to deploy |
Protect data through encryption, masking, obfuscation or tokenisation | Encryption at rest and in transit, database masking for non-production, tokenisation for card and ID numbers |
Control access to personal data | Role-based access, MFA, privileged access management, regular access reviews |
Monitor access through logs | Database activity monitoring, application and identity logs sent to the SIEM, alerts for bulk data access |
Retain logs and personal data for at least one year | Log storage sized for one year minimum, protected against tampering |
Ensure continuity through backups | Tested, isolated backups that ransomware cannot reach |
Have measures to detect and respond to breaches | SOC monitoring, incident response playbooks, forensic readiness |
Bind data processors to the same safeguards | Security clauses in vendor contracts, with audit and breach-reporting rights |
The one-year log retention deserves attention. CERT-In already requires 180 days. DPDP extends this to at least a year for logs related to personal data. Many SIEM storage plans were not sized for that.
The penalty for failing to take reasonable security safeguards can reach ₹250 crore per instance. These are ceilings, not automatic fines, but they make security safeguards a board-level matter.
Rule 7: one breach, many clocks
Rule 7 creates a two-track breach notification duty. When an organisation becomes aware of a personal data breach, it must:
inform the Data Protection Board without delay, and send a detailed report within 72 hours;
inform every affected person without delay, explaining what happened, the likely consequences, the steps taken and a contact for questions.
Failure to notify can attract a penalty of up to ₹200 crore.
The harder problem is that DPDP is not the only clock. A single incident at a regulated entity can trigger several reporting duties at once.
Regulator | Who it applies to | Reporting timeline |
CERT-In | All service providers, intermediaries, data centres and body corporates | Within 6 hours of noticing the incident |
RBI (DAKSH) | Banks and other RBI-regulated entities | Within 6 hours under the 2026 Directions |
SEBI | SEBI-regulated entities | Through SEBI's incident portal, now aligned with the FIRE format |
DPDP Board | Every Data Fiduciary, for personal data breaches | Without delay, with a detailed report within 72 hours (from May 2027) |
Affected individuals | Every Data Fiduciary, for personal data breaches | Without delay (from May 2027) |
A bank with a customer data breach could owe reports to CERT-In, RBI, the DPDP Board and every affected customer, all within days. That only works if detection is fast, the facts are documented from the first hour, and one team owns all the notifications.
A six-month readiness plan for security teams
Six months is enough if the work starts now and runs in parallel with legal and business teams.
Month | Focus | Key outputs |
November 2026 | Discover | Inventory of systems holding personal data, data flow maps, list of data processors |
December 2026 | Assess | Gap analysis against Rule 6, log retention review, vendor contract review |
January 2027 | Protect | Encryption and masking rollout, access reviews, MFA and privileged access gaps closed |
February 2027 | Detect | Personal data logs into the SIEM, alerts for bulk export and unusual access, one-year retention in place |
March 2027 | Respond | Unified breach playbook covering CERT-In, sector regulator and DPDP notifications, notification templates ready |
April 2027 | Test | Breach simulation that runs the full notification chain end to end, board briefing |
May 13, 2027 | Comply | Evidence pack ready for the Data Protection Board |
Three things tend to slip, so start them first:
The data inventory. Every other control depends on knowing where personal data lives. Shadow databases, old backups and spreadsheets on shared drives are where most surprises hide.
Vendor contracts. Processors must meet the same safeguards, and renegotiating contracts takes months.
The notification chain. Decide now who declares a breach, who drafts each notice and who approves it. Working this out during an incident costs hours you will not have.
The bottom line
Friday's milestone is small, but it is a useful alarm. The obligations that change how security teams work, Rules 6 and 7, arrive on 13 May 2027. Organisations that use the next six months to map their data, close access gaps, extend log retention and rehearse their breach notifications will meet that date calmly. The rest will discover their gaps during their first reportable breach.
For more on building the detection and response capability DPDP expects, read my guide on how to build a next-generation SOC in 2026.
Sources
This post explains the regulations from a security practitioner's perspective and is not legal advice.
Comments