DPDP Rules phase 2: consent-manager framework takes effect
What’s happening
India's Digital Personal Data Protection Rules phase in: consent-manager registration starts November 13, 2026, and the core duties (notices, consent, security safeguards, breach reporting, retention and data-subject rights) apply from May 13, 2027. Employee HR, payroll, health-check and benefits data are covered, although the Act lets employers process data for employment purposes as a 'legitimate use'; a proposal floated in early 2026 to shorten the timeline has not been adopted.
What to do
Use the next six months to map employee data flows (including wellbeing, EAP and health-check vendors) and update vendor contracts and employee privacy notices.
Source
networkintelligence.ai. Checked October 19, 2026.