DPDP Rules: What Changes on 13 November 2026 (and What Can Wait Till May 2027)
Rule 4 of the DPDP Rules (Consent Managers) starts on 13 November 2026, but most business obligations begin on 13 May 2027. What it means for clinics, coaching classes and D2C brands, and a 7-step plan.
On 13 November 2026, Rule 4 of India's Digital Personal Data Protection (DPDP) Rules, 2025 comes into force. It covers Consent Managers: registered platforms that let people give, review and withdraw consent across businesses. Many posts online are treating this date as the day every business must be fully DPDP-compliant. That is not what the rules say. Most obligations for ordinary businesses, such as notices, consent, security safeguards, breach reporting and user rights, start on 13 May 2027.
This guide explains what changes now, what can wait, and what clinics, coaching classes and D2C brands in Mumbai should do with their WhatsApp, website and CRM data. It is a practical guide, not legal advice; for your specific situation, speak to a lawyer.
The DPDP timeline
| Date | What comes into force |
|---|---|
| 13 November 2025 | Rules notified (Gazette G.S.R. 846(E)). Rules 1, 2 and 17–21 apply: the Data Protection Board and its procedures. |
| 13 November 2026 | Rule 4: registration and obligations of Consent Managers. |
| 13 May 2027 | Rules 3, 5–16, 22 and 23: notices, consent, security, breach intimation, retention, children's data, user rights and the rest of the core duties. |
Some sources give 14 November 2025 as the publication date because the Gazette was published a day after the notification. Either way, the core business obligations start in May 2027.
What 13 November 2026 means for a small business
Consent Managers are registered with the Data Protection Board and act as a single point for people to manage consent. A clinic or coaching class does not have to become a Consent Manager. But people may start using Consent Managers to give or withdraw consent, so your systems should be able to respect a withdrawal when it reaches you. For most small businesses this is a planning milestone, not a hard switch-over day.
What to do in the next six months
- Map your personal data. List where customer, patient or student data lives: WhatsApp, Google Sheets, CRM, Shopify, forms, email.
- Collect only what you need. A booking bot needs name, phone and slot, not date of birth and address.
- Write a clear notice. In plain English (and Hindi if your customers prefer it), say what you collect, why, and how to withdraw consent.
- Get proper WhatsApp opt-in. Ask before sending promotional messages, and keep a record of the opt-in.
- Lock down access. Remove old staff accounts, use two-factor login, and keep API keys on the server.
- Plan for deletion. Decide how long you keep leads and patient chats, and automate deletion or archiving.
- Check your vendors. Your WhatsApp provider, CRM and AI tools process data for you; read their data terms.
By industry
- Clinics: patient details and health information need extra care. Keep clinical conversations with doctors, not in a bot, and limit who can read chats. See WhatsApp automation for clinics.
- Coaching institutes: many students are under 18, and the rules have specific requirements for children's data from May 2027. Parents' consent flows matter.
- D2C brands: marketing broadcasts and retargeting depend on clear consent; make unsubscribe easy.
How we help
When we build AI and WhatsApp automations, we include consent wording, minimal data collection, access controls and action logs by default. If you already run automations, we can review them against this checklist.
Frequently asked questions
Does my business need to be DPDP compliant by 13 November 2026?
No. 13 November 2026 is when the Consent Manager rules start. Most obligations for ordinary businesses, such as notices, consent, security and user rights, start on 13 May 2027.
What is a Consent Manager under the DPDP Rules?
A platform registered with the Data Protection Board that lets people give, manage, review and withdraw consent across businesses through one interface.
Do small businesses need a Consent Manager?
No. Small businesses do not need to become Consent Managers, but should be ready to respect consent given or withdrawn through one.
Does DPDP apply to WhatsApp chats with customers?
Yes. Names, numbers and messages are personal data, so collect only what you need, get opt-in for promotions and limit who can access chats.
