What happened
India notified the Digital Personal Data Protection Rules in November 2025 with a phased rollout. The Data Protection Board provisions applied straight away. The second phase, which sets up registration and obligations for consent managers, applies twelve months after notification, on 13 November 2026. The third phase, which brings in consent notices, security safeguards, breach reporting and data principal rights for every organisation, applies from 13 May 2027.
Consent managers are registered platforms that let individuals give, review and withdraw consent across services in one place. They must be incorporated in India, cannot read the personal data that passes through them, and must keep consent records for seven years.
What it means for you
Any AI agent that reads customer or employee personal data in India will be inside the May 2027 obligations. That includes the notice the person was given, the purpose they consented to, and whether consent has since been withdrawn. An agent that cannot check consent status before it acts is a compliance gap.
- BFSI and healthcare: expect consent managers to become a common route for customer consent. Plan for your systems to receive and honour consent signals from them.
- All industries: six months is short for consent flows, retention rules and breach reporting across every system an agent touches.
What to do this quarter
- List the AI workflows that read personal data of people in India, and the purpose each relies on.
- Check whether each workflow can see consent status and withdrawal before it acts.
- Add DPDP requirements to the governance policy and vendor questionnaire you use for AI.
This update is general information, not legal advice. Check how it applies to you with your legal team.
