The official website of the Data Protection Board of India (DPBI), dpbi.gov.in, is live as of 13 November 2026 marking the one-year anniversary of the Digital Personal Data Protection (DPDP) Rules, 2025 and the scheduled commencement of India’s Consent Manager registration framework.
While the launch of dpbi.gov.in gives India’s data protection regulator an official online home, it has also sparked immediate confusion across startups, compliance teams, and everyday internet users: Can citizens file privacy complaints online starting today? Do businesses face ₹250 crore penalties right now?
What Actually Happened on 13 November 2026?
Exactly one year after the Ministry of Electronics and Information Technology (MeitY) notified the establishment of the
Data Protection Board of India (DPBI)
(G.S.R. 844(E)) and the DPDP Rules, 2025 (G.S.R. 846(E)), two distinct developments converged on 13 November 2026:
Official DPBI Website Goes Live at dpbi.gov.in
The Board now has an official Government of India domain (dpbi.gov.in), establishing an authoritative online reference point for institutional information and regulatory disclosures.
Consent Manager Framework Enters Into Force
Under the phased commencement schedule (G.S.R. 843(E)), Section 6(9), Section 27(1)(d), and Rule 4 take effect—activating the legal framework governing Consent Manager registration and Board oversight.
13 November 2026 vs. 13 May 2027: What Changes When?
India’s DPDP framework follows a staggered three-phase rollout under Gazette Notification G.S.R. 843(E). Here is how the 13 November 2026 milestone compares with the next major enforcement milestone on 13 May 2027:
| Area | Status From 13 November 2026 | Scheduled From 13 May 2027 |
|---|---|---|
| DPBI Web Presence | Official website (dpbi.gov.in) is live for institutional information and official updates. | Digital Office procedures (Section 28) commence for online inquiries, hearings, and orders. |
| Consent Managers | In force: Section 6(9), Section 27(1)(d), and Rule 4 commence, activating the registration and compliance framework. | Full ecosystem interoperability as Data Fiduciaries begin honouring user consent actions routed via registered Consent Managers. |
| Businesses (Data Fiduciaries) | Preparation and integration window—core notice, consent, security, and breach duties are not yet enforceable under the DPDPA. | In force: Sections 3–17 commence (privacy notices, granular consent, 72-hour breach reporting, DPARs, and children’s data rules). |
| Citizens (Data Principals) | Cannot file general DPDPA privacy complaints with the DPBI yet; existing IT Act and consumer remedies continue to apply. | In force: Right to access, correction, erasure, and grievance escalation to the DPBI (Section 13) commence. |
| Financial Penalties | Limited to breaches of Consent Manager registration conditions (Section 27(1)(d)) once the Board is operationalised. | In force: Full Section 33 penalty schedule (up to ₹250 crore per instance) becomes enforceable. |
What This Milestone Means for Consent Managers, Businesses, and Citizens
Registration & Technical Readiness Open the Ecosystem
Starting 13 November 2026, entities seeking to operate as registered Consent Managers in India enter the formal regulatory framework under Rule 4 and Part A of the First Schedule to the DPDP Rules, 2025. Eligible applicants must:
- Be a company incorporated in India with a minimum net worth of ₹2 crore.
- Operate a data-blind architecture ensuring personal data routed through the platform is not readable by the Consent Manager itself.
- Maintain auditable records of consent grants, reviews, and withdrawals for at least seven years, backed by independent technical certification.
Use the Six-Month Runway Before 13 May 2027
Even though core Data Fiduciary obligations do not become enforceable until 13 May 2027, the launch of dpbi.gov.in and the Consent Manager framework signals that India’s enforcement infrastructure is actively moving into place. Retrofitting consent systems typically takes 4 to 6 months—making November 2026 the practical cutoff to begin engineering work:
- Standardise Multilingual Notices: Update forms, apps, and cookie banners with clear, purpose-specific DPDPA consent notices available in English and all 22 Eighth Schedule Indian languages.
- Build Tamper-Evident Consent Provenance: Under Section 6(10), the burden of proving valid consent rests on your organisation. Log exact timestamps, notice versions, purposes, and consent validity dates.
- Operationalise Grievance & DPAR Workflows: Because citizens must exhaust your internal grievance process before escalating to the DPBI, automate Data Principal rights requests (access, correction, erasure) and sync withdrawals across downstream CRM and vendor tools.
How to Protect Your Privacy Before May 2027
While you cannot yet submit a formal DPDPA complaint through dpbi.gov.in, you can already bookmark the official site for future updates and exercise existing privacy rights:
- Contact a company’s published Grievance Officer or Data Protection Officer first and keep copies of your emails or ticket numbers.
- For unresolved data leaks, spam, or unfair digital practices before 13 May 2027, seek remedies under the Information Technology Act, 2000, TRAI DND rules, or the Consumer Protection Act, 2019.
Data Fiduciary vs. Consent Manager: Does Your Business Need to Register on dpbi.gov.in?
Direct Answer: No—most Indian businesses do not register on dpbi.gov.in. Only specialised intermediary platforms applying to operate as a registered Consent Manager register with the DPBI under Rule 4 of the DPDP Rules, 2025. Regular companies (referred to as Data Fiduciaries) do not apply for registration, though they must prepare their systems to accept and honour user consent requests routed through registered Consent Managers by 13 May 2027.
With the Consent Manager framework commencing on 13 November 2026 alongside the launch of dpbi.gov.in, many founders and compliance leads assume every company collecting customer data must sign up with the Board. In reality, the DPDPA separates organisations into two distinct roles:
| Dimension | Data Fiduciary (Regular Businesses) | Consent Manager (Intermediary Platforms) |
|---|---|---|
| Who Is It? | Any company, app, bank, hospital, startup, or website that collects personal data for its own business purposes. | An independent, neutral platform that gives citizens a single dashboard to give, review, and withdraw consent across multiple services. |
| Registration with DPBI | Not required under the DPDPA (unless separately notified as a Significant Data Fiduciary for audit/DPO filings). | Mandatory under Section 6(9), Rule 4, and Part A of the First Schedule (commencing 13 November 2026). |
| Eligibility & Capital Rules | Applies to all businesses processing digital personal data in India regardless of company size or net worth. | Must be incorporated in India with at least ₹2 crore net worth, a data-blind architecture, and 7-year audit log retention. |
| Primary Deadline | 13 May 2027 for core notice, consent, security, breach notification, and Data Principal rights compliance. | 13 November 2026 for the commencement of the registration and governance framework. |
In short: if you run an e-commerce store, fintech app, healthcare service, or SaaS product, you are a Data Fiduciary. Instead of registering as a Consent Manager yourself, you can integrate an enterprise Consent Management Platform (CMP) like Concur – Consent Manager to manage notices, consent logs, and interoperability without building compliance infrastructure from scratch.
6-Month DPDPA Readiness Roadmap: From dpbi.gov.in Launch to 13 May 2027
With dpbi.gov.in live and exactly six months remaining until full enforcement begins on 13 May 2027, engineering, legal, and product teams can break their compliance rollout into four practical sprints:
Data Discovery & Purpose Mapping
- Map every touchpoint where personal data enters your business (web forms, mobile apps, WhatsApp flows, HRMS, and CRMs).
- Tag each data element with a specific lawful purpose and define clear consent validity dates and retention schedules.
- Audit third-party software vendors and update Data Processor agreements.
Multilingual Notice & Consent Capture
- Replace bundled terms-and-conditions checkboxes with standalone, itemised DPDPA consent notices in English and Indian languages.
- Implement verifiable parental consent gates for users under 18 and disable behavioural tracking for minors.
- Record cryptographic consent receipts (timestamp, notice version, purpose ID, and user action) for Section 6(10) audit defence.
Preference Centre, DPARs & Withdrawals
- Launch a self-serve User Preference Centre so customers can withdraw consent as easily as they gave it.
- Automate Data Principal Access Requests (DPARs) for access, correction, erasure, and nomination within Rule 14 timelines.
- Connect real-time webhooks so a consent revocation automatically stops downstream email, SMS, and ad-tech syncing.
72-Hour Breach Drills & Go-Live Audit
- Publish your Grievance Officer or Data Protection Officer (DPO) contact details prominently across all digital properties.
- Test your 72-hour personal data breach notification runbook (Rule 7) for reporting incidents to both affected users and the DPBI.
- Run a pre-enforcement audit of your consent ledger before 13 May 2027.
How to Verify the DPBI Official Website and Avoid Lookalike Scams
Whenever a major regulatory body launches a website in India, unofficial domains with similar names quickly surface online. Before sharing business details or personal documents, verify that you are on an authentic Government of India source:
- Confirm the Exact
.gov.inAddress: Check your browser bar to ensure the domain is https://dpbi.gov.in/ with a valid HTTPS security lock. - Cross-Check via Official Government Portals: Verify regulatory notices and Gazette orders directly through meity.gov.in, egazette.gov.in, or pib.gov.in.
- Never Pay Fees or Upload IDs on Unverified Sites: Do not submit identity documents, grievance forms, or “registration fees” to third-party
.com,.org, or.inportals claiming to process DPBI complaints or Consent Manager applications.
Want a deeper breakdown of the Board’s composition, appeal structure before TDSAT, and full Section 33 penalty schedule? Read our comprehensive Data Protection Board of India (DPBI) Guide.
Frequently Asked Questions (FAQs)
1. What is the official website of the Data Protection Board of India (DPBI)?
The official website of the Data Protection Board of India is dpbi.gov.in, which went live on 13 November 2026. Always verify the .gov.in domain extension before relying on any portal claiming to represent the Board.
2. Can citizens file privacy complaints online on dpbi.gov.in right now?
No. While dpbi.gov.in is live as the Board’s official website, general citizen grievance-redressal and inquiry provisions (Section 13 and Sections 27–34 of the DPDPA) are scheduled to commence on 13 May 2027. Until then, citizens should raise privacy issues with the concerned company’s Grievance Officer or use existing remedies under the IT Act, 2000 and Consumer Protection Act, 2019.
3. What legal provisions commenced on 13 November 2026?
Under Gazette Notification G.S.R. 843(E), Section 6(9), Section 27(1)(d), and Rule 4 of the DPDP Rules, 2025 commenced on 13 November 2026—activating the regulatory framework for Consent Manager registration and Board supervision of Consent Managers.
4. When do the ₹250 crore DPDPA penalties start applying to businesses?
Core Data Fiduciary obligations (notices, granular consent, security safeguards, breach reporting, and children’s data rules) and the Section 33 financial penalty schedule (up to ₹250 crore per instance) are scheduled to commence on 13 May 2027.
5. Does every Indian company need to register on dpbi.gov.in?
No. Only entities seeking to operate as registered Consent Managers apply for registration under Rule 4. Regular businesses (Data Fiduciaries) do not register as Consent Managers, though they must ensure their consent systems can honour user consent grants and withdrawals routed through registered Consent Managers by 13 May 2027.
