Your Data, Your Rights: What India's Data Protection Rules Change, and the Key Dates in November 2026 and May 2027
India's data protection law is coming into force in stages. The next step, on November 13, lets 'consent managers' register. By May 2027, companies must ask clearly before using your data, and fines can reach ₹250 crore.
Every day, apps and websites collect your name, phone number, location, shopping habits and much more. For years, Indians had few clear rights over that data. That is changing. India's Digital Personal Data Protection (DPDP) Act, 2023, and the rules that put it into practice, are coming into force in stages, with two important dates ahead: November 13, 2026 and May 13, 2027.
Here is what the law gives you, and what companies will have to do.
Quick answer
- The DPDP Rules were notified on November 13, 2025, with an 18-month phased rollout.
- Phase 1 (done): the Data Protection Board of India, which hears complaints and can fine companies, has been set up.
- Phase 2 (November 13, 2026): consent managers, services that help you manage permissions, can register.
- Phase 3 (May 13, 2027): the main duties begin: clear notices, real consent, security safeguards, breach alerts and deletion of data when no longer needed.
- Penalties can reach ₹250 crore per violation.
The timeline in plain words
November 13, 2025: the referee is appointed. The rules first set up the Data Protection Board of India. It works mostly online and can look into complaints, hold inquiries and impose penalties.
November 13, 2026: consent managers arrive. A consent manager is a registered company that gives you one dashboard to see, give, manage and withdraw your consent to different businesses using your data. The idea is modelled on the RBI's account aggregator system for financial data. Consent managers must be Indian companies with a net worth of at least ₹2 crore, and must register with the Board, according to Sansa Legal.
May 13, 2027: the main rules apply. From this date, businesses that handle personal data must follow the core duties of the law.
Your rights under the law
Once the law is fully in force, you will have the right to:
- Know what personal data a company holds about you and how it is used.
- Correct data that is wrong or incomplete.
- Erase your data when it is no longer needed for the purpose you agreed to.
- Withdraw consent as easily as you gave it.
- Nominate someone to exercise these rights for you if you die or cannot act.
- Complain, first to the company, and then to the Data Protection Board if you are not satisfied.
What companies must do
From May 2027, organisations that collect personal data, which the law calls data fiduciaries, will have to:
- give you a clear, itemised notice saying what data they collect and why;
- take your specific consent, not bury it in long terms and conditions;
- use the data only for the purpose you agreed to;
- keep it secure, and tell both you and the Board if there is a data breach;
- delete it once the purpose is complete;
- have a way to handle your complaints.
Large companies that handle huge volumes or sensitive data may be named Significant Data Fiduciaries. They face extra duties: data protection impact assessments, a data protection officer based in India, and regular independent audits.
Special protection for children
The Act treats children, meaning anyone under 18, with extra care. Companies need verifiable consent from a parent or guardian before processing a child's data, and cannot track children's behaviour or target them with advertising. This will affect gaming apps, social media and education platforms.
What it will not do
The law covers digital personal data, or data that is digitised. It does not stop every use of your data: the government and some bodies have exemptions for purposes such as security or law enforcement, which critics say are broad. And until May 2027, most of the duties on companies are not yet in force.
What you can do now
- Review app permissions on your phone, and turn off location, contacts and microphone access for apps that don't need them.
- Read consent pop-ups instead of tapping "accept all".
- Use strong passwords and two-factor authentication, because the law punishes leaks but cannot undo them.
- Keep records of any data misuse you notice, such as spam calls after a purchase, so you can complain once the rules are in force.
For more on staying safe online, read our guides to festive sale scams and deepfakes and AI fraud.
This article is general information, not legal advice.
Related reading
Sources
This article draws on the following reporting. Dates are when each source was originally published.
Written by
Stories, explainers and features published by The Daily, based on public sources that are listed with every article.
More from The Daily →Enjoyed this story?
Get the best of The Daily in your inbox every Sunday.
