K J Muhammed AslamAdvocate · Ernakulam
Contact

Data protection & DPDP compliance

DPDP Compliance Guide for Kerala Businesses to May 2027

By Adv. K J Muhammed Aslam · Advocate, Ernakulam (Bar Council of Kerala)

Published 25 September 2026

Every Kerala business processing customer data faces the same May 2027 horizon: notices, consent, safeguards, breach response, rights handling, retention, vendor contracts, and possibly children-data and SDF duties — with penalties to 250 crore rupees per instance. This hub orders the fifteen-guide DPDP series into a build sequence with the phased timeline. It is general information, not legal advice.

What is the phased timeline — what bites when?

Phase Date Content
Board constitution 14 November 2025 Rules 1–2 and 17–21 in force from Gazette notification; inquiry machinery stands up
Consent Managers ≈13 November 2026 (displayed as 14 November 2026 on this site) Rule 4 registration; architecture must interoperate
Substantive duties + penalties ≈13 May 2027 (displayed as 14 May 2027 on this site) Rules 3, 5–16, 22–23; obligations and Schedule penalties enforceable

Timing note: G.S.R. 846(E) is dated 13 November 2025 and was notified on 14 November 2025 (PIB); 12- and 18-month periods computed from the 13 November 2025 date give ≈13 November 2026 and ≈13 May 2027 — displayed on this site as 14 November 2026 and 14 May 2027.

What is the build sequence — which guide when?

Foundations: the countdown and 9-month plan with consent-notice drafting and safeguards plus retention. Operations: breach playbook with the CERT-In clock comparison, principal rights workflow, processor contracts and DPIA, and employee and CCTV discipline. Special tracks: children’s data, Significant Data Fiduciaries, cross-border transfers, Consent Managers. Enforcement: penalties, Board inquiry, and TDSAT appeal with the victim-rights mirror.

How do penalties and enforcement work — and what mitigates?

Schedule ceilings to 250 crore rupees per instance with Section 33 seven-factor grading, Board digital inquiry with voluntary-undertakings tracks, and TDSAT appeal beyond — the enforcement companion maps limitation, stay, and the mitigation file to build now rather than during inquiry.

What comes after May 2027 — continuous compliance?

Compliance does not end at enforcement: periodic audits, DPIA refresh on new processing, retention-schedule execution with 48-hour notices, vendor re-assessments, rights-request metrics, and breach-drill cycles convert the May 2027 programme into steady-state governance with Board-ready evidence every quarter.

Primary sources

General information — not legal advice. Office at High Court Junction, Ernakulam; practice before the High Court of Kerala.

FAQ

Common questions

When do DPDP obligations actually bite?
Board Rules from November 2025, Consent Manager registration around November 2026, and substantive duties with penalties around May 2027 under GSR 843(E)/846(E) phasing. Build across 2026; enforcement-grade operation by early 2027.
Does DPDP apply to my small business?
Yes where it processes digital personal data — no small-business carve-out from notice, consent, safeguards, breach, rights, and retention duties. Scale calibrates depth, not applicability.
What is the compliance sequence?
Map data, fix notices and consent, build safeguards and retention, rehearse breach response, stand up rights handling, amend vendor contracts, assess children and SDF exposure, and file the inquiry-ready evidence set — each mapped to a guide below.
What penalties apply?
Schedule ceilings to 250 crore rupees per instance for safeguard failures, 200 for breach-notification and children's violations, with Section 33 factors grading actual quantum. Mitigation files built now discount later penalties.
Do we need a Consent Manager?
Most businesses interoperate rather than register — see the Consent Manager decision guide. Consent architecture must be Manager-compatible before the November 2026 window regardless.
Where do we start this quarter?
Data mapping with the safeguards checklist and consent-notice drafting in parallel — the two foundations every later workstream consumes.

Keep reading

Data protection & DPDP compliance

Your Personal Data Was Leaked by a Company: What You Can Do Under the DPDP Act

Company leaked your Aadhaar, phone or health data? DPDP Sections 11-14 rights, Board complaint, IT Act 43A compensation, consumer and civil remedies.

6 Sept 2026

Data protection & DPDP compliance

CERT-In 6-Hour vs DPDP 72-Hour Breach Reporting: Which Clock Applies to Your Business?

India has two breach clocks that both apply: CERT-In's 6 hours and DPDP Rule 7's 72 hours. Who reports to whom, when each starts, and one playbook for both.

1 Sept 2026

Contact

WhatsApp[email protected]+91 94972 40215

3rd Floor, Lalan Towers (KGL Builders), Vanchi Square, High Court Junction, Ernakulam, Kerala 682031 · Monday – Saturday, 10:00 – 18:30 (by appointment)

A note before you read on. In keeping with the Bar Council of India Rules, this website provides information about Adv. K J Muhammed Aslam, and general legal information, only to those who seek it of their own accord. It is not an advertisement or solicitation, and nothing here is legal advice. By continuing, you acknowledge you are visiting voluntarily. Full disclaimer.