DPDP Phase 2: Ready in Law, Waiting in Practice
DPDP Phase 2: Ready in Law,Waiting in Practice
Consent Managers, institutional readiness and what businesses should prepare for
The Digital Personal Data Protection Act, 2023 received Presidential assent on 11 August 2023, giving India its first comprehensive law on personal data. More than three years later, most of it is still waiting to come into force.[1]
When the Government notified the Digital Personal Data Protection Rules, 2025 on 13 November 2025,[2] it provided for the law to come into force in three phases rather than all at once. The second of those phases commences on 13 November 2026.
On paper, Phase 2 is a modest step. It brings in a new kind of regulated intermediary, the Consent Manager, and requires every Consent Manager to be registered with the Data Protection Board of India. In practice, it raises a question: who will do the registering? Nearly a year after the provisions establishing the Board came into force, the Board is still not functional.
This article examines what actually changes on 13 November, why the Board’s status matters, the Government’s proposal to give large companies a shorter runway, and what businesses should be doing in the meantime.
The three phases of the DPDP Rules
The notification bringing the Act into force and the Rules themselves were both published in the Gazette on the same day, 13 November 2025, and both count their phases from that date.[3]
The first phase took effect immediately. It brought in the definitions and the provisions that set up the Data Protection Board, which was formally established the same day.[4] The second phase, from 13 November 2026, covers only Consent Managers. The third phase, from 13 May 2027, is the one that matters most to businesses: it brings in the duties on notice and consent, data security, breach reporting and children’s data, the rights of individuals, and the penalties for breaking the law.[5]
Until then, the old regime continues. Section 43A of the Information Technology Act, 2000, on which the current Rules on sensitive personal data are based, will be repealed only when the new law comes into force on 13 May 2027.[6]
What changes on 13 November 2026
A Consent Manager is something new in Indian law. It is a registered intermediary that acts for the individual, letting a person give, manage, review and withdraw consent to many companies from one place through its platform. It is not the cookie banner or consent tool that a company runs on its own website; it is an independent intermediary, accountable to the individual.[7]
The Rules set a high bar for the eligibility of who can be a consent manager. Under the First Schedule of the Rules, an applicant must be a company incorporated in India, with a net worth of at least ₹2 crore and sufficient technical, operational and financial capacity. Once registered, it must not be able to read the personal data that passes through its platform, must avoid conflicts of interest with Data Fiduciaries (the businesses that use personal data), and must keep records of consents, notices and data sharing for at least seven years.[8]
From 13 November, no one can act as a Consent Manager without registering with the Board.[9] This is the commencement of a registration requirement, not a statutory deadline by which every prospective applicant must submit an application.
The Data Protection Board is not yet functional
Only the Board can register a Consent Manager.[10] That is where Phase 2 runs into difficulty.
The Board exists in law and is to have a Chairperson and four Members.[11] But no appointment to it has been announced. The Ministry of Electronics and Information Technology (MeitY) invited nominations for the posts only on 6 May 2026 and advertised them in the Employment News on 6 June 2026.[12]
In August 2026, Manish Tewari, MP, inquired from the Government whether the Chairperson and Members had been appointed and whether any Consent Managers had been registered. The Government’s written reply of 12 August 2026 set out the phased timeline and confirmed that the posts had been advertised. It did not, however, confirm any appointment to the Board.[13]
In October, the Government confirmed that the Board was not functional, when it informed the Kerala High Court, which was hearing a matter concerning a public interest petition on passenger data collected through Digi Yatra, that the Board had been constituted but not yet made functional. The Kerala High Court stated it expected the Board to be made functional within eight weeks, a period that ends after 13 November.[14] At the time of writing this article, no appointment appears to have been announced and it remains to be seen whether the Government will comply with the timelines for implementation.
If the Board is still not functional on 13 November 2026, the law will require registration with no one in place to be able to grant it. Companies wanting to become Consent Managers will have nowhere to apply, and the framework Phase 2 is meant to launch will exist only on paper.
The difficulty is not merely administrative. Rule 4 contemplates an application to the Board in the form and manner specified by it, followed by scrutiny and a decision on registration. Without an operational Board capable of prescribing the application process, receiving applications and deciding them, a prospective Consent Manager cannot complete the statutory route to registration. The commencement of the requirement does not, by itself, create an alternative authority or dispense with registration. It therefore creates a practical compliance impasse that may require the Government to operationalise the Board or clarify the transitional position.
The Board’s design is also under challenge. In February 2026, the Supreme Court issued notice on petitions challenging parts of the Act and the Rules, including the manner in which the Board’s Chairperson and Members are appointed, and referred them to a larger bench. It refused to stay the law in the meantime.[15]
Earlier deadline proposed for large companies
For large companies, the bigger concern is not Phase 2 itself but a proposal that could bring their heaviest obligations forward to the same date.
Days after the Rules were notified, Union IT Minister Ashwini Vaishnaw said the Government was in talks with industry to compress the 18-month timeline for large companies, many of which already comply with similar laws abroad.[16]
“So as we go forward once data protection board is put in place and the complete digital framework, which has already been prepared, is rolled out… after that we will have further amendments in rules so that we can compress the timelines.”[17]
In January 2026, at a meeting with industry, MeitY reportedly proposed that the additional obligations of Significant Data Fiduciaries (SDFs) should apply after 12 months instead of 18, that is, from 13 November 2026.[18] SDFs are companies the Government singles out for stricter oversight on the basis of factors such as the volume and sensitivity of the data they handle,[19] and they are expected to include big technology platforms, banks and insurers.[20] Size or sector alone, however, does not confer SDF status: a Government notification is required.
Comments were due by 4 February 2026. Since then, nothing appears to have been notified, and the Government’s August reply in Parliament described only the original timeline.[21]
Even if the proposal is notified, its reach depends on a second decision. The extra duties under Rule 13 apply only to companies that the Government notifies as SDFs under Section 10 of the Act, and no such notification appears to have been issued.[22] Large companies are therefore waiting on two decisions, neither of which has a date.
There are, however, signs that the groundwork is being laid. On 5 October 2026, MeitY issued an order correcting the wording of Sections 9 and 10 of the Act, including a clarification that the periodic audit an SDF must carry out is a “data audit”.[23] This is a technical correction to the statutory text; it does not itself change the commencement date or establish that the Government has decided to accelerate the SDF obligations.
What businesses should do now
For most businesses, 13 November 2026 brings no new legal duty. It is, however, a useful moment to review their readiness. From 13 May 2027, when the third phase commences, businesses that collect and use personal data (Data Fiduciaries) will have to comply with the core obligations set out earlier.
The starting point is knowing what personal data the business holds, why it holds it, where it is stored and with whom it is shared. Without that map, the rest is guesswork. From there, privacy notices need to be rewritten in plain language, consent forms need to make withdrawing consent as easy as giving it, and security measures such as encryption, access controls and log retention need to be in place. Businesses will also need a breach-response plan that allows them to inform affected individuals and the Board without delay, and to send the Board a detailed report within 72 hours.[24] It is therefore, hoped that the Board will be constituted at least by the time of implementation of the third phase of the Act.
Companies that expect to be notified as SDFs have more to do: appointing a Data Protection Officer based in India and an independent data auditor and preparing for a Data Protection Impact Assessment and data audit every year.[25] These take time to put in place, which is why the Government’s January proposal matters even before it is notified.
The stakes are high. A failure to take reasonable security safeguards to prevent a personal data breach can attract a penalty of up to ₹250 crore under the Act.[26]
Conclusion
Phase 2 was meant to mark the point at which India’s data protection law begins to work in practice. Instead, it may be remembered for the gaps it exposed: a registration requirement with no functioning Board to register anyone, and a deadline for large companies that the Government has signalled it wants to change but has not yet changed. Until the Board is staffed and the position on SDFs is settled, the safest course is for businesses to treat 13 May 2027 as the currently notified compliance date, while companies that may be designated as SDFs should prepare for the possibility of an earlier date if the necessary notifications are issued.
[1]The Digital Personal Data Protection Act, No. 22 of 2023, India Code (2023).
[2]The Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), Gazette of India, pt. II sec. 3(i) (Nov. 13, 2025).
[3]Notification No. G.S.R. 843(E), Gazette of India, pt. II sec. 3(i) (Nov. 13, 2025); DPDP Rules, r. 1.
[4]Notification No. G.S.R. 844(E), Gazette of India, pt. II sec. 3(i) (Nov. 13, 2025).
[5]Notification No. G.S.R. 843(E), cls. (a)–(c).
[6]DPDP Act, section 44(2); The Information Technology Act, No. 21 of 2000, India Code (2000), section 43A.
[7]DPDP Act, sections 2(g), 6(7), 6(8).
[8]DPDP Rules, r. 4, sch. I pts. A, B.
[9]DPDP Act, section 6(9).
[10]DPDP Act, sections 2(g), 6(9); DPDP Rules, r. 4.
[11]Lok Sabha, Unstarred Question No. 3960 (Aug. 12, 2026).
[12]Ministry of Electronics & Info. Tech., F. No. 2(1)/2026-Pers.I (May 6, 2026); Lok Sabha, supra note 11.
[13]Lok Sabha, supra note 11.
[14]C.R. Neelakandan v. Union of India, 2026:KER:77409.
[15]‘Some Creases To Be Ironed Out,’ Supreme Court Refers Pleas Challenging DPDP Act Amendment To RTI Act To Larger Bench, LiveLaw (Feb. 16, 2026).
[16]Press Trust of India, Govt May Shorten DPDP Compliance Timeline for Big Tech Amid Industry Talks, Business Standard (Nov. 17, 2025).
[17]Id.
[18]Aashish Aryan, Meity May Cut Compliance Timeline for Key DPDP Rules to 12 Months, Business Standard (Jan. 22, 2026).
[19]DPDP Act, section 10(1).
[20]Aryan, supra note 18.
[21]Lok Sabha, supra note 11.
[22]DPDP Act, section 10(1); DPDP Rules, r. 13.
[23]The Digital Personal Data Protection (Removal of Difficulties) Order, 2026, S.O. 5458(E), Gazette of India (Oct. 5, 2026).
[24]DPDP Act, sections 5, 6, 8; DPDP Rules, rr. 3, 6, 7.
[25]DPDP Act, section 10(2); DPDP Rules, r. 13.
[26]DPDP Act, section 33, sch., item 1.
