DPDPA Consent Manager Goes Operational and CERT-In's 6-Hour Rule: India's July 2026 Compliance Crossroads

India's digital compliance landscape just crossed a threshold that most organisations were not ready for. In the window between June and August 2026, the central government is operationalising the Consent Manager framework under the Digital Personal Data Protection Act (DPDPA) — a mechanism that will fundamentally reshape how Indian companies collect and manage user consent at scale. Simultaneously, CERT-In's six-hour incident reporting mandate remains fully in force under the Information Technology Act, 2000, with no grace period, no exceptions for company size, and a penalty structure that affects CISOs and board members alike. If your organisation processes personal data of Indian residents and has not yet done both of these things — mapped your consent flows and established a documented incident response process — July 2026 is the month you cannot afford to defer action.

What the Consent Manager Framework Actually Means in Practice

The DPDP Act Consent Manager framework creates a licensed intermediary layer between data principals (your users) and data fiduciaries (your organisation). When fully operationalised, users will be able to access interoperable platforms — registered and regulated by the Data Protection Board of India (DPBI) — through which they can grant, review, modify, and withdraw consent across multiple digital services in one place. This is not a minor administrative change. It means that the consent your organisation collected before Consent Managers went live may need to be re-obtained through the new interoperable infrastructure if users exercise their right to manage consent via a registered platform.

The practical implications for data fiduciaries are substantial. First, your consent management system must be technically capable of integrating with Consent Manager APIs once those specifications are published by the DPBI. Second, your privacy notice and consent workflow must be granular enough to support selective withdrawal — a user must be able to withdraw consent for one processing purpose without it automatically invalidating consent for another. Third, your data architecture must support deletion or anonymisation at the level of individual consent records, not just at the level of a user account.

We are working with clients across BFSI, e-commerce, and SaaS verticals where the consent layer is currently a checkbox buried in a sign-up form. That architecture will not survive the Consent Manager era.

CERT-In's 6-Hour Mandate: What "Fully Enforced" Actually Means

CERT-In's Directions issued April 28, 2022, under Section 70B of the IT Act are not new — but enforcement in 2026 is meaningfully different from 2022. The regulatory environment has matured, CERT-In has issued guidance clarifying scope ambiguities, and the DPDPA now creates a parallel reporting obligation to the Data Protection Board for data breaches, creating a dual-track that many organisations do not have documented processes for.

Under the CERT-In Directions, every organisation in India — from a two-person startup to a multinational data centre operator — must report twenty categories of cybersecurity incidents within six hours of becoming aware. The reportable categories include unauthorised access, data breaches, ransomware, denial-of-service attacks, phishing campaigns targeting Indian domains, and compromise of critical infrastructure. Non-compliance carries a fine of up to ₹1 lakh and imprisonment of up to one year for responsible executives.

The dual-track problem deserves specific attention. If your organisation suffers a data breach in 2026, you have two simultaneous obligations: report to CERT-In within 6 hours of becoming aware, and notify the Data Protection Board and affected data principals under the DPDPA on a timeline that the rules specify but that will require your incident response playbook to address both concurrently. Most organisations we audit have an incident response policy that references one regulatory body or neither. That gap creates legal exposure across two separate enforcement frameworks.

The 83% Problem and the November 2026 Horizon

Research published in the run-up to 2026 indicated that approximately 83% of organisations subject to the DPDPA had not begun comprehensive implementation. That figure should alarm any board member reading it, because May 13–14, 2027 is the widely cited "hard enforcement" date — the end of the 18-month transition period after which the DPBI can impose penalties of up to INR 2.5 billion for major violations. That sounds like a 2027 problem. It is not. The compliance programme that will be assessed at that deadline needs to be operational well before it, and the audit trail needs to cover months of documented practice, not a last-minute sprint.

July 2026 sits inside what India Briefing has called the "build and test" window. If your organisation starts its DPDPA programme in July, you have roughly ten months before hard enforcement, which is enough time to complete a data mapping exercise, overhaul consent workflows, appoint a Data Protection Officer if you qualify as a Significant Data Fiduciary, implement technical and organisational security measures, and establish incident response processes aligned to both CERT-In and DPDPA. If you start in January 2027, you do not have enough time to do any of that credibly.

What a Practical July 2026 Action Plan Looks Like

The compliance gap between where most Indian organisations are today and where they need to be is real but closeable. Based on our experience running DPDPA readiness assessments, a structured programme needs five elements completed before November 2026.

The first element is data mapping — a complete inventory of what personal data your organisation processes, where it is stored, who has access, what the legal basis for processing is, and how long it is retained. This exercise surfaces the consent and deletion problems that will otherwise appear as regulatory findings.

The second element is consent workflow re-architecture. Every user-facing consent mechanism — web forms, mobile apps, third-party integrations, dark patterns buried in settings — needs to be reviewed against the granularity requirements of the DPDPA and redesigned to support selective withdrawal and future Consent Manager integration.

The third element is incident response documentation. Your playbook must explicitly address the CERT-In 6-hour reporting requirement and the parallel DPDPA notification obligation, including named owners, escalation paths, and template notifications.

The fourth element is vendor and third-party data processor review. The DPDPA places obligations on data fiduciaries for the processing their vendors do on their behalf. If your cloud provider, analytics platform, or payroll processor handles personal data of Indian residents, that relationship needs a Data Processing Agreement that meets the DPDPA's requirements.

The fifth element is technical security baseline. The DPDPA requires appropriate technical and organisational security measures. CERT-In's Directions require 180-day log retention and NTP synchronisation. Both require documented, tested controls — not aspirational policies.

How Alastor InfoSec Supports DPDPA and CERT-In Compliance

Alastor Shield, our compliance automation platform, maps security controls and findings directly to DPDPA obligations, CERT-In Directions, SOC 2, and ISO 27001 simultaneously. When Enforster AI identifies a vulnerability in your environment, the finding is automatically tagged with the compliance frameworks it affects, the data categories at risk, and the remediation priority. You are not managing two separate spreadsheets — one for security findings and one for compliance gaps — you are working from a single evidence base.

For organisations that have not yet begun their DPDPA programme, we recommend starting with a structured readiness assessment. We map your current data flows, consent mechanisms, incident response capability, and technical controls against the DPDPA requirements and CERT-In Directions, and produce a gap report with a prioritised remediation roadmap. Most assessments complete within two to three weeks and give you the clarity to scope the work accurately.

To schedule a DPDPA readiness assessment or to ask about Alastor Shield's compliance automation capabilities, email us at [email protected] or visit /products/alastor-shield.

The window between now and November 2026 is shorter than it looks — organisations that start their DPDPA programme in July will be the ones whose compliance story holds up under scrutiny in 2027.