DPDPA Phase 2 + CERT-IN 2026: The Compliance Convergence Indian Businesses Can't Ignore

Indian businesses are heading into an unusually compressed compliance window. Two regulatory forces are converging simultaneously: the Digital Personal Data Protection Act (DPDPA) entering its Phase 2 enforcement period in November 2026, and CERT-IN's pending penalty upgrade from ₹1 lakh to ₹1 crore under the Jan Vishwas (Amendment of Provisions) Bill. For organisations that have been treating data privacy and cybersecurity compliance as separate workstreams, that separation is about to become very expensive.

This post lays out exactly what is changing, when, and what Indian businesses must do before both deadlines hit.

What DPDPA Phase 2 Actually Means in November 2026

The Digital Personal Data Protection Rules were notified in November 2025, starting a structured phase-in. Phase 2, effective 13 November 2026, operationalises the Consent Manager framework under Rule 4. This is not just a technical registration exercise — it is the moment the Data Protection Board of India (DPBI) is widely expected to shift from guidance mode to active regulatory supervision.

For Data Fiduciaries (the entities that determine the purpose and means of processing personal data), November 2026 marks the practical end of the "soft enforcement" period. Penalties under the DPDPA are already in force, and the DPBI has the statutory authority to levy fines up to ₹250 crore for a failure to implement reasonable security safeguards. What changes in November is the regulatory temperature — the DPBI is expected to begin processing complaints and initiating suo motu inquiries with much greater frequency.

The Consent Manager framework itself requires Data Fiduciaries to integrate their consent collection and management flows with registered Consent Manager platforms. Any organisation collecting personal data through a website, mobile app, or digital service needs to audit its current consent mechanisms against Rule 4 requirements before November 13.

The CERT-IN Penalty Upgrade: From ₹1 Lakh to ₹1 Crore

CERT-IN directions issued in April 2022 already mandate a 6-hour incident reporting window for all organisations operating in India. The current penalty for non-compliance is ₹1 lakh — a figure many enterprises have quietly factored in as an acceptable risk. The Jan Vishwas (Amendment of Provisions) Bill proposes raising that ceiling to ₹1 crore under Section 70B(7) of the IT Act. While not yet enacted as of mid-2026, legislative movement is underway, and compliance teams should treat the ₹1 crore threshold as imminent.

The practical obligations under the existing CERT-IN directions remain unchanged: 6-hour breach notification, 180-day rolling log retention, NIC/NPL time synchronization, and mandatory KYC plus 5-year log retention for VPN/cloud/VPS providers. What changes is the cost of ignoring them.

Where DPDPA and CERT-IN Overlap — And Why That's Your Leverage Point

Here is where intelligent compliance teams save money: the DPDPA's requirement to implement "reasonable security safeguards" (Section 8(5)) and CERT-IN's log retention and incident response mandates largely map onto the same technical controls. A mature incident detection and response capability with 180-day log retention satisfies both. So does a documented data inventory and data flow mapping exercise, which is foundational to both DPDPA consent management and CERT-IN's requirement to know what systems you are logging.

Organisations that have already implemented ISO 27001 or SOC 2 have a meaningful head start — the control frameworks overlap significantly. If your ISO 27001 scope covers personal data systems, a gap analysis against DPDPA's specific obligations (consent, purpose limitation, data principal rights, Significant Data Fiduciary requirements) and CERT-IN's incident reporting chain is the logical next step, not a full rebuild.

Our experience working with Indian technology companies shows a consistent readiness gap at the consent layer. Most organisations have some version of a cookie banner and a privacy policy. Very few have implemented consent management that is granular enough to satisfy Rule 4 — particularly the requirements around withdrawal of consent being as easy as giving it, and personal data processing stopping within a specified time of withdrawal.

For B2C companies processing high volumes of personal data, this is a meaningful engineering challenge, not a legal documentation exercise. Integrating with a registered Consent Manager platform requires understanding your data flows at the system level, not just the policy level.

What to Do in the Next 90 Days

First, complete a data flow mapping exercise. You cannot manage consent for data you cannot locate. Every personal data collection point — web forms, mobile SDKs, payment integrations, third-party analytics — needs to be catalogued.

Second, assess your CERT-IN incident response capability against the 6-hour reporting window. Most organisations that have never tested their incident response under time pressure discover that the 6-hour clock runs much faster in practice. A tabletop exercise focused specifically on the CERT-IN notification workflow is worth running before the penalty ceiling goes up.

Third, gap-assess your consent UI and backend against DPDPA Rule 4 requirements. If you are relying on a third-party consent management platform, confirm it is either already registered or planning to register as a Consent Manager under the DPDP framework.

Fourth, map your existing ISO 27001 or SOC 2 controls to DPDPA Section 8 obligations. The overlap is significant, and reusing existing evidence collection workflows reduces audit fatigue substantially.

How Alastor Shield Helps

Alastor Shield, our compliance automation platform, maps security findings and control evidence directly to DPDPA, CERT-IN, SOC 2, and ISO 27001 simultaneously. Rather than running separate audits for each framework, Shield maintains a unified control library where a single evidence item — say, your log retention configuration — satisfies requirements across all four frameworks at once.

For organisations approaching November 2026, we run a structured DPDPA readiness assessment that covers consent management, data flow mapping, CERT-IN alignment, and a residual risk register prioritised by the DPBI's expected enforcement focus areas.

To start your DPDPA + CERT-IN readiness assessment, reach out to our team at [email protected] or visit Alastor Shield.

The November 2026 DPDPA Phase 2 deadline is 122 days away — and the Consent Manager framework, CERT-IN log retention, and pending penalty increases make this the most consequential compliance quarter Indian businesses have faced since the IT Act's original cybersecurity directions.