DPDPA Phase 2 Enforcement Begins November 13, 2026: Your 16-Week Compliance Action Plan

India's Digital Personal Data Protection Act is moving from framework to force. On November 13, 2026 — exactly 16 weeks from today — Phase 2 of the DPDPA goes live, operationalising the Consent Manager framework and activating the Data Protection Board of India's capacity for active regulatory supervision. For the 83% of Indian organisations that have not yet begun comprehensive implementation, the countdown is no longer theoretical.

This post lays out what Phase 2 actually means, what CERT-In obligations intersect with it, and the specific steps organisations must take before November to avoid being caught off-guard when enforcement sharpens in 2027.

What DPDPA Phase 2 Actually Means

The DPDP Act's enforcement timeline runs in three distinct phases. Phase 1 — the establishment and procedural functioning of the Data Protection Board — became effective November 13, 2025. Phase 2 activates November 13, 2026, and centres on the Consent Manager framework. Phase 3, covering full enforcement of all substantive compliance obligations and penalties up to INR 2.5 billion (approximately US$26.24 million) per violation, takes effect May 13, 2027.

The Consent Manager is a central piece of the DPDPA's consent architecture. Once Phase 2 is live, registered digital intermediaries will operate interoperable platforms through which Data Principals can manage, review, and withdraw consent across multiple Data Fiduciaries simultaneously. This means every organisation that processes personal data based on consent needs a functioning, revocable consent mechanism that can interface with registered Consent Managers — not a checkbox or privacy policy footer.

For November 2026, the Board transitions from awareness-building mode into active regulatory supervision. That is not yet full penalty enforcement, but it is the end of the grace period. The Board will have visibility, capacity, and mandate to act on complaints. Organisations that cannot demonstrate meaningful compliance readiness will be exposed.

The CERT-In Layer: An Obligation That Cannot Wait

Many Indian businesses treat DPDPA and CERT-In compliance as separate workstreams. That is a mistake — they share the same underlying data and security infrastructure, and a gap in one amplifies risk in the other.

Under the CERT-In Directions (effective June 2022), every organisation operating in India must report cybersecurity incidents within 6 hours of detection. The list of reportable incidents covers 20 categories, ranging from ransomware and data breaches to fake mobile applications and denial-of-service attacks. Organisations are also required to maintain ICT system logs for 180 days on a rolling basis, stored within India, and to synchronise system clocks with NIC or NPL time servers.

VPN providers, cloud service providers, and data centres face additional obligations: 5-year KYC retention and log records for all subscribers and customers. Non-compliance currently carries a fine of up to ₹1 lakh and up to one year of imprisonment, with a proposed amendment under the Jan Vishwas Bill set to raise the ceiling to ₹1 crore.

The 6-hour incident reporting window is what trips most organisations up. Detecting an incident, triaging it, confirming its nature, and filing a CERT-In report within six hours requires real-time monitoring infrastructure, clear internal escalation paths, and pre-drafted incident templates — not improvisation on the day.

Five Things Organisations Must Complete Before November 13

The DPDPA does not prescribe a single compliance checklist, but Phase 2 readiness requires five distinct areas of preparation.

First, appoint a Data Protection Point of Contact. The Act requires Data Fiduciaries to publish contact details for a reachable individual or team that Data Principals can approach to exercise their rights — access, correction, erasure, and grievance redressal. This must be functional and responsive, not a dormant email alias.

Second, implement and document a consent framework. Every data processing activity based on consent needs a clear notice explaining the purpose of processing, the categories of data collected, and how consent can be withdrawn. This notice must be in plain language, available in English and any Indian language the Data Principal requests, and linked to an actual revocation mechanism.

Third, build a breach detection and reporting capability. DPDPA requires notification to the Data Protection Board and affected Data Principals "in the prescribed manner" following a personal data breach. CERT-In's 6-hour mandate adds a parallel, faster-moving obligation. Organisations need monitoring tools, a documented incident response plan, and the ability to produce a factual breach report under time pressure.

Fourth, complete a data inventory and processing map. You cannot consent-enable or protect data you cannot locate. A current-state inventory of what personal data is collected, where it is stored, how it flows across systems and third parties, and on what legal basis it is processed is the foundation of every other DPDPA obligation.

Fifth, assess your third-party data processors. The DPDPA holds Data Fiduciaries accountable for the processing activities of their processors. Contracts need to include data protection obligations, and you need assurance — not just contractual promises — that processors are actually meeting those obligations.

Where Security Testing Fits In

DPDPA compliance is not a legal-only exercise. Several of its provisions — breach notification, security safeguards, and the requirement to demonstrate "reasonable security measures" — map directly onto technical security controls. An organisation that cannot demonstrate it has tested those controls is in a weak position before the Data Protection Board.

Alastor Shield maps security findings directly to DPDPA obligations, SOC 2 Trust Services Criteria, and ISO 27001 controls, so every VAPT finding you remediate produces evidence you can present during a regulatory review. For organisations that process sensitive personal data at scale, continuous security testing through Alastor Pulse provides the audit trail that demonstrates ongoing security diligence — not a point-in-time snapshot.

The Window Is Closing

Sixteen weeks is enough time to move from a standing start to credible Phase 2 readiness — but not if the first action happens in October. The organisations that are in a reasonable position by November 13 will be the ones that started the structural work in Q3 2026, not the ones that scheduled a compliance call for the week before the deadline.

If you are unsure where your organisation sits on the DPDPA readiness spectrum, reach out to the Alastor InfoSec team for a compliance gap assessment. We work with Indian businesses at every stage of the DPDPA journey, from first-time data inventory to Board-ready documentation.

With 83% of Indian organisations yet to begin, Phase 2 enforcement on November 13, 2026 is not a distant deadline — it is an immediate mandate to act.