DPDPA & CERT-IN Compliance in 2026: What Indian Businesses Must Do Right Now

India's data protection and cybersecurity compliance landscape has never moved faster. July 2026 sits at the intersection of two regulatory forces that are quietly reshaping how Indian businesses must operate: the Digital Personal Data Protection Act (DPDPA) is deepening its enforcement grip, and CERT-IN's updated audit mandate is now fully operational. If your organisation has been in "wait and watch" mode, that mode is over.

The DPDPA Timeline Is Not Waiting for You

When the DPDP Rules were notified on November 14, 2025, a countdown began. The period from June to August 2026 is when the central government is operationalising the Consent Manager framework — an interoperable platform through which Data Principals can manage, review, and withdraw consent across multiple digital services in real time.

This isn't a future requirement. The framework is being stood up right now, and organisations that haven't yet built consent management flows into their products will find themselves scrambling when the Consent Manager goes live. Data Fiduciaries — the companies that collect and process personal data — must be able to interface with this ecosystem from day one of its operation.

What the November 2026 Inflection Point Means

November 2026 marks one year since the DPDP Rules notification, and regulatory observers widely expect the Data Protection Board of India (DPBI) to shift from awareness-building toward active regulatory supervision at that point. The current "soft enforcement" phase — characterised by guidance, consultations, and warnings — is expected to wind down.

Hard enforcement, with penalties up to INR 250 crore (approximately USD 26 million) for major violations, is projected to begin around May 2027. That sounds like a comfortable runway. It isn't. Building the data inventory, consent architecture, grievance redressal workflows, and audit trails that full compliance requires takes months, not days. Organisations that start in Q1 2027 will not be ready by May 2027.

The four areas that require immediate attention are: (1) mapping all personal data flows and identifying categories of sensitive data under the Act, (2) implementing purpose-limited consent mechanisms that align with DPDPA definitions, (3) establishing a Data Protection Officer (DPO) or equivalent governance function, and (4) documenting the cross-border data transfer mechanisms if your operations involve cloud services hosted outside India.

CERT-IN's Annual Audit Mandate: Already in Effect

Running in parallel to the DPDPA enforcement timeline is CERT-IN Guideline CISG-2025-02, which became effective July 25, 2025. This guideline requires every public and private enterprise operating in India to undergo annual third-party cybersecurity audits, with scope aligned to ISO/IEC 27001 and calibrated to actual business risk.

This is separate from, and in addition to, the 6-hour breach reporting obligation under CERT-IN's 2022 directive. Organisations that have focused only on incident response readiness — the 6-hour clock — without building a broader audit-ready security posture are now non-compliant on a different axis.

The CERT-IN audit requirement has teeth. Non-compliance carries criminal penalties including fines and imprisonment, and the reputational cost of a CERT-IN enforcement action in India's increasingly scrutinised corporate governance environment is significant. The annual audit is not a checkbox exercise. It must be documented, scoped properly, and conducted by a qualified third-party auditor.

The Compounding Risk: Both Regimes Simultaneously

The real challenge facing Indian CISOs and legal teams right now is that DPDPA and CERT-IN compliance are not independent workstreams — they overlap. CERT-IN's log retention requirement (180 days, within Indian jurisdiction) must be factored into DPDPA's data minimisation and storage limitation obligations. The consent management architecture required under DPDPA must be documented as part of the CERT-IN audit scope. Incident response plans must satisfy the CERT-IN 6-hour reporting window while also meeting the DPDPA's obligation to notify the DPBI of significant data breaches.

Treating these as separate compliance programmes creates duplication, gaps, and unnecessary cost. The smarter approach is a unified data governance and security programme that satisfies both frameworks from shared controls.

How Alastor Shield Bridges the Gap

Alastor Shield is built precisely for this dual-compliance reality. It maps your technical security controls to both DPDPA obligations and CERT-IN requirements, gives you a continuous view of your compliance posture rather than a point-in-time snapshot, and generates the audit-ready documentation that CERT-IN's third-party auditors and DPBI supervisors will expect.

For organisations preparing for the November 2026 inflection point, we recommend starting with a structured gap assessment: where does your current data processing, consent management, and incident response practice stand against the combined DPDPA/CERT-IN framework? That assessment takes two to four weeks and gives you a prioritised remediation roadmap. Organisations that complete this now have time to close gaps before soft enforcement ends.

Reach out to us at [email protected] or visit Alastor Shield to understand how we can map your environment to both regulatory frameworks and prepare you for what's coming in November.

The window for comfortable DPDPA and CERT-IN compliance preparation is closing — organisations that act in Q3 2026 will be in a fundamentally stronger position than those that wait for enforcement signals to appear.