India’s data-protection transition is becoming a product-delivery problem. A business may have months before important provisions commence, but changes to customer journeys, vendor arrangements and incident-response systems usually have to be approved and built much earlier. For organisations planning their 2027 services, the practical deadline may fall inside the current development cycle.
The Digital Personal Data Protection Rules, notified in November 2025, use staged commencement. Rule 4 on Consent Managers starts one year after Gazette publication, while the main operational group of rules starts after eighteen months. That places significant implementation milestones in November 2026 and May 2027. It does not mean every requirement became enforceable when the Rules were announced. Official Rules, rule 1
A consent notice is an operational promise
The government’s explanation emphasises clear, standalone notices explaining the specific purposes of collection and use. It also identifies an Indian corporate requirement for registered Consent Managers. That specialised role should not be confused with the wider population of businesses using consent interfaces. MeitY’s notification announcement
The difficult work begins when the notice is compared with the product. A retailer may describe order fulfilment, fraud prevention and personalised offers in one customer journey, while those functions depend on separate systems and suppliers. The privacy team needs to know what happens when a customer changes a preference, closes an account or challenges a use of data.
Our assessment is that businesses should organise this work around processing purposes rather than around the number of policy documents revised. A purpose register becomes useful when each entry identifies the data, responsible business owner, receiving systems and mechanism for applying a change. A polished notice is much less valuable if the organisation cannot carry its promises through to the underlying service.
This also changes vendor selection. A supplier’s promise to “support compliance” is insufficiently specific for procurement. A more useful demonstration would show how it receives and implements a change, records completion, handles exceptions and reports a failure. The test should be performed with representative workflows before contractual commitments are treated as proof of technical capability.
Breach readiness requires two speeds
Rule 7 provides for initial notification without delay and more detailed information to the Board within seventy-two hours, subject to an allowed extension. The initial and follow-up stages are distinct. A response plan that waits for a complete forensic report before preparing any notification would miss that design. Official Rules, rule 7
A practical exercise should therefore test decisions under incomplete information. Who determines that the organisation has become aware of a personal data breach? Which team identifies affected users? Who can approve a clear initial communication outside normal business hours? How quickly will a processor supply the relevant facts?
These questions are particularly important where regional teams support Indian services. An incident discovered by a shared technology team can lose valuable time if it passes through several business units before reaching the people responsible for notification. An effective escalation process needs named decision-makers and an agreed minimum information package.
Avoid making deletion a single switch
Readiness also requires an internally consistent approach to retention. The government’s overview highlights rights, security and additional accountability for Significant Data Fiduciaries, including audits and impact assessments. The detailed Rules should be assessed alongside other applicable retention requirements rather than reduced to a promise of immediate deletion in every circumstance. Government overview of the framework
For implementation purposes, closing a customer account, stopping a particular use and deleting every associated record should be treated as separate operations. Each retained category needs an identified reason, restricted access and a defined endpoint. Otherwise, an account-deletion feature may leave either excessive data behind or an inadequate record for a legitimate obligation.
The next phase should be measured through working demonstrations: a changed permission reflected across systems, a rights request completed with an auditable result, and a breach exercise conducted with a critical supplier. Further guidance and implementation notices may refine the details. They are less likely to eliminate the need for those capabilities. Businesses that build them during the transition will have a stronger foundation than those that wait for enforcement to expose gaps.
Research updated 14 September 2026. Cover photograph: Akib Pictures.
