---
title: "DPDP Compliance Guide for Kerala Businesses to May 2027"
description: "DPDP readiness for Kerala SMEs: phased timeline to May 2027, notices, safeguards, breach response, rights, children, SDF, transfer, contracts, penalties."
url: "https://advaslam.com/writing/dpdp-compliance-guide-kerala-businesses/"
image: "https://advaslam.com/og/writing/dpdp-compliance-guide-kerala-businesses.png"
---

[Data protection & DPDP compliance](https://advaslam.com/practice/data-protection/)

# DPDP Compliance Guide for Kerala Businesses to May 2027

By [**Adv. K J Muhammed Aslam**](https://advaslam.com/profile/) · Advocate, Ernakulam (Bar Council of Kerala)

Published 25 September 2026

Every Kerala business processing customer data faces the same May 2027 horizon: notices, consent, safeguards, breach response, rights handling, retention, vendor contracts, and possibly children-data and SDF duties — with penalties to 250 crore rupees per instance. This hub orders the fifteen-guide DPDP series into a build sequence with the phased timeline. It is general information, not legal advice.

## What is the phased timeline — what bites when?

| Phase | Date | Content |
| --- | --- | --- |
| Board constitution | 14 November 2025 | Rules 1–2 and 17–21 in force from Gazette notification; inquiry machinery stands up |
| Consent Managers | ≈13 November 2026 (displayed as 14 November 2026 on this site) | Rule 4 registration; architecture must interoperate |
| Substantive duties + penalties | ≈13 May 2027 (displayed as 14 May 2027 on this site) | Rules 3, 5–16, 22–23; obligations and Schedule penalties enforceable |

*Timing note: G.S.R. 846(E) is dated 13 November 2025 and was notified on 14 November 2025 (PIB); 12- and 18-month periods computed from the 13 November 2025 date give ≈13 November 2026 and ≈13 May 2027 — displayed on this site as 14 November 2026 and 14 May 2027.*

## What is the build sequence — which guide when?

Foundations: the [countdown and 9-month plan](https://advaslam.com/writing/dpdp-act-deadline-businesses/) with consent-notice drafting and safeguards plus retention. Operations: breach playbook with the [CERT-In clock comparison](https://advaslam.com/writing/cert-in-6-hour-vs-dpdp-72-hour-breach-reporting/), principal rights workflow, processor contracts and DPIA, and employee and CCTV discipline. Special tracks: [children’s data](https://advaslam.com/writing/dpdp-children-data-parental-consent-guide/), [Significant Data Fiduciaries](https://advaslam.com/writing/dpdp-significant-data-fiduciary-sdf-obligations/), [cross-border transfers](https://advaslam.com/writing/dpdp-cross-border-data-transfer-section-16/), Consent Managers. Enforcement: penalties, Board inquiry, and TDSAT appeal with the [victim-rights mirror](https://advaslam.com/writing/data-breach-victim-rights-dpdp-compensation/).

## How do penalties and enforcement work — and what mitigates?

Schedule ceilings to 250 crore rupees per instance with Section 33 seven-factor grading, Board digital inquiry with voluntary-undertakings tracks, and TDSAT appeal beyond — the enforcement companion maps limitation, stay, and the mitigation file to build now rather than during inquiry.

## What comes after May 2027 — continuous compliance?

Compliance does not end at enforcement: periodic audits, DPIA refresh on new processing, retention-schedule execution with 48-hour notices, vendor re-assessments, rights-request metrics, and breach-drill cycles convert the May 2027 programme into steady-state governance with Board-ready evidence every quarter.

## Primary sources

-   [Digital Personal Data Protection Act, 2023 — India Code](https://indiacode.gov.in/handle/123456789/496508)
-   [DPDP Rules, 2025 (G.S.R. 846(E), 13 November 2025) — MeitY](https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf)
-   [PIB press release on notification of the DPDP Rules, 14 November 2025 (PRID 2190014)](https://www.pib.gov.in/PressReleasePage.aspx?PRID=2190014) and [PIB backgrounder, 17 November 2025 (PRID 2190655)](https://www.pib.gov.in/PressReleasePage.aspx?PRID=2190655)
-   Gazette notifications — [G.S.R. 843(E)](https://egazette.gov.in/WriteReadData/2025/267647.pdf) and [G.S.R. 846(E)](https://egazette.gov.in/WriteReadData/2025/267650.pdf) — e-Gazette

*General information — not legal advice. Office at High Court Junction, Ernakulam; practice before the High Court of Kerala.*

FAQ

## Common questions

**When do DPDP obligations actually bite?**

Board Rules from November 2025, Consent Manager registration around November 2026, and substantive duties with penalties around May 2027 under GSR 843(E)/846(E) phasing. Build across 2026; enforcement-grade operation by early 2027.

**Does DPDP apply to my small business?**

Yes where it processes digital personal data — no small-business carve-out from notice, consent, safeguards, breach, rights, and retention duties. Scale calibrates depth, not applicability.

**What is the compliance sequence?**

Map data, fix notices and consent, build safeguards and retention, rehearse breach response, stand up rights handling, amend vendor contracts, assess children and SDF exposure, and file the inquiry-ready evidence set — each mapped to a guide below.

**What penalties apply?**

Schedule ceilings to 250 crore rupees per instance for safeguard failures, 200 for breach-notification and children's violations, with Section 33 factors grading actual quantum. Mitigation files built now discount later penalties.

**Do we need a Consent Manager?**

Most businesses interoperate rather than register — see the Consent Manager decision guide. Consent architecture must be Manager-compatible before the November 2026 window regardless.

**Where do we start this quarter?**

Data mapping with the safeguards checklist and consent-notice drafting in parallel — the two foundations every later workstream consumes.

**A note on this article.** It is general legal information, not legal advice. The law may have changed since the date shown; before acting on anything here, take advice on your specific situation from an advocate of your choice.

## Related guides

-   [DPDP Readiness Checklist for Kerala Small Businesses](https://advaslam.com/guides/dpdp-readiness-checklist-small-business/)

[All procedure guides →](https://advaslam.com/guides/)

Keep reading

Data protection & DPDP compliance

### Your Personal Data Was Leaked by a Company: What You Can Do Under the DPDP Act

Company leaked your Aadhaar, phone or health data? DPDP Sections 11-14 rights, Board complaint, IT Act 43A compensation, consumer and civil remedies.

6 Sept 2026

[Your Personal Data Was Leaked by a Company: What You Can Do Under the DPDP Act](https://advaslam.com/writing/data-breach-victim-rights-dpdp-compensation/)

Data protection & DPDP compliance

### CERT-In 6-Hour vs DPDP 72-Hour Breach Reporting: Which Clock Applies to Your Business?

India has two breach clocks that both apply: CERT-In's 6 hours and DPDP Rule 7's 72 hours. Who reports to whom, when each starts, and one playbook for both.

1 Sept 2026

[CERT-In 6-Hour vs DPDP 72-Hour Breach Reporting: Which Clock Applies to Your Business?](https://advaslam.com/writing/cert-in-6-hour-vs-dpdp-72-hour-breach-reporting/)

Contact

[WhatsApp](https://wa.me/919497240215?text=Hello%2C%20I%20found%20advaslam.com%20and%20would%20like%20to%20discuss%20a%20matter.) [contact@advaslam.com](mailto:contact@advaslam.com) [+91 94972 40215](tel:+919497240215)

3rd Floor, Lalan Towers (KGL Builders), Vanchi Square, High Court Junction, Ernakulam, Kerala 682031 · Monday – Saturday, 10:00 – 18:30 (by appointment)

```json
{"@context":"https://schema.org","@graph":[{"@type":"WebSite","@id":"https://advaslam.com/#website","url":"https://advaslam.com","name":"Adv. K J Muhammed Aslam","alternateName":"advaslam.com","publisher":{"@id":"https://advaslam.com/#person"},"inLanguage":"en-IN"},{"@type":"Person","@id":"https://advaslam.com/#person","name":"K J Muhammed Aslam","alternateName":["Adv. K J Muhammed Aslam","Advocate K J Muhammed Aslam","Muhammed Aslam K J","Adv. Aslam"],"honorificPrefix":"Adv.","jobTitle":"Advocate","description":"Advocate enrolled with the Bar Council of Kerala, practising from High Court Junction, Ernakulam: cyber and technology law, data protection (DPDP), business, banking and IPR, and litigation before the High Court of Kerala and the courts at Ernakulam.","url":"https://advaslam.com/profile/","image":"https://advaslam.com/og.png","telephone":"+919497240215","email":"contact@advaslam.com","address":{"@type":"PostalAddress","streetAddress":"3rd Floor, Lalan Towers (KGL Builders), Vanchi Square, High Court Junction","addressLocality":"Ernakulam","addressRegion":"Kerala","postalCode":"682031","addressCountry":"IN"},"alumniOf":{"@type":"CollegeOrUniversity","name":"Bharata Mata School of Legal Studies"},"memberOf":[{"@type":"Organization","name":"Bar Council of Kerala","url":"https://barcouncilkerala.org/lawyer-registry-list"},{"@type":"Organization","name":"Kerala High Court Advocates' Association","url":"https://khcaa.com/"}],"identifier":[{"@type":"PropertyValue","propertyID":"Bar Council of Kerala Enrolment No.","value":"K/001823/2026"},{"@type":"PropertyValue","propertyID":"KHCAA Membership No.","value":"OAJ 358"}],"knowsAbout":["Information Technology Act 2000","Cyber crime law","Technology law and technology contracts","Digital Personal Data Protection Act 2023","DPDP compliance","Data protection and privacy law","Business and commercial law","Contract drafting and negotiation","Banking and finance law","Negotiable Instruments Act cheque dishonour","SARFAESI Act","Intellectual property law","Copyright and trademark law","Patent infringement","GST and income-tax law","Blockchain and cryptocurrency technology","Web3 wallets and NFTs","Drone regulation and DigitalSky framework","Writ petitions under Article 226","Criminal law","Civil and consumer litigation","Family and succession law","Service and labour law","Legal drafting","Mediation and dispute resolution"],"knowsLanguage":["en","ml"],"workLocation":{"@id":"https://advaslam.com/#practice"},"hasCredential":[{"@type":"EducationalOccupationalCredential","credentialCategory":"Enrolment as an advocate","identifier":"K/001823/2026","recognizedBy":{"@type":"Organization","name":"Bar Council of Kerala"},"description":"Enrolled as an advocate with the Bar Council of Kerala (K/001823/2026), 2026"},{"@type":"EducationalOccupationalCredential","credentialCategory":"degree","educationalLevel":"Bachelor","recognizedBy":{"@type":"CollegeOrUniversity","name":"Bharata Mata School of Legal Studies"},"description":"BBA LLB (Hons.), Bharata Mata School of Legal Studies (2025)"},{"@type":"EducationalOccupationalCredential","credentialCategory":"Remote Pilot Certificate","recognizedBy":{"@type":"Organization","name":"Directorate General of Civil Aviation, India"},"description":"DGCA Remote Pilot Certificate, issued 2022"}],"subjectOf":[{"@type":"CreativeWork","name":"Govind Babu v. State of Kerala (Crl.M.C. No. 5640 of 2026, 2026:KER:69496)","url":"https://indiankanoon.org/doc/151180872/","datePublished":"2026-09-10","publisher":{"@type":"Organization","name":"High Court of Kerala"}},{"@type":"CreativeWork","name":"Viji Sagar v. State of Kerala (Crl.M.C. No. 1603 of 2026, 2026:KER:20803)","url":"https://indiankanoon.org/doc/193042273/","datePublished":"2026-03-09","publisher":{"@type":"Organization","name":"High Court of Kerala"}},{"@type":"CreativeWork","name":"Anjana v. Manoharan A.P. (C.R.P. No. 442 of 2025, 2026:KER:10054)","url":"https://indiankanoon.org/doc/68585852/","datePublished":"2026-02-05","publisher":{"@type":"Organization","name":"High Court of Kerala"}}],"sameAs":["https://www.linkedin.com/in/azlubro","https://portal.khcaa.com/advocate?id=10480","https://lexosys.com"]},{"@type":"LegalService","@id":"https://advaslam.com/#practice","name":"Adv. K J Muhammed Aslam — Advocate, Ernakulam","url":"https://advaslam.com","image":"https://advaslam.com/og.png","telephone":"+919497240215","email":"contact@advaslam.com","address":{"@type":"PostalAddress","streetAddress":"3rd Floor, Lalan Towers (KGL Builders), Vanchi Square, High Court Junction","addressLocality":"Ernakulam","addressRegion":"Kerala","postalCode":"682031","addressCountry":"IN"},"geo":{"@type":"GeoCoordinates","latitude":9.9889,"longitude":76.2748},"hasMap":"https://www.google.com/maps/search/?api=1&query=Lalan+Towers+High+Court+Junction+Ernakulam","areaServed":[{"@type":"City","name":"Ernakulam"},{"@type":"City","name":"Kochi"},{"@type":"State","name":"Kerala"},{"@type":"Country","name":"India"}],"openingHoursSpecification":{"@type":"OpeningHoursSpecification","dayOfWeek":["Monday","Tuesday","Wednesday","Thursday","Friday","Saturday"],"opens":"10:00","closes":"18:30"},"founder":{"@id":"https://advaslam.com/#person"},"knowsAbout":["Cyber crime and IT Act matters","Data protection and DPDP Act compliance","Business, banking, intellectual property and tax","Legal drafting","Criminal law: bail, quash and appeals","Writ petitions before the High Court of Kerala","Civil, property and consumer matters","Family and succession matters","Service and labour matters"]},{"@type":"BlogPosting","@id":"https://advaslam.com/writing/dpdp-compliance-guide-kerala-businesses/#article","isPartOf":{"@id":"https://advaslam.com/#website"},"headline":"DPDP Compliance Guide for Kerala Businesses to May 2027","description":"DPDP readiness for Kerala SMEs: phased timeline to May 2027, notices, safeguards, breach response, rights, children, SDF, transfer, contracts, penalties.","url":"https://advaslam.com/writing/dpdp-compliance-guide-kerala-businesses/","mainEntityOfPage":"https://advaslam.com/writing/dpdp-compliance-guide-kerala-businesses/","datePublished":"2026-09-25T00:00:00.000Z","dateModified":"2026-09-25T00:00:00.000Z","keywords":"DPDP compliance Kerala businesses, DPDP readiness May 2027, DPDP obligations penalties timeline, Kerala SME data protection, DPDP compliance checklist, Consent Manager November 2026","inLanguage":"en-IN","author":{"@id":"https://advaslam.com/#person"},"publisher":{"@id":"https://advaslam.com/#person"},"image":"https://advaslam.com/og/writing/dpdp-compliance-guide-kerala-businesses.png","about":{"@type":"Service","@id":"https://advaslam.com/practice/data-protection/#service","name":"Data protection & DPDP compliance","url":"https://advaslam.com/practice/data-protection/","provider":{"@id":"https://advaslam.com/#practice"}}},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://advaslam.com/"},{"@type":"ListItem","position":2,"name":"Articles","item":"https://advaslam.com/writing/"},{"@type":"ListItem","position":3,"name":"DPDP Compliance Guide for Kerala Businesses to May 2027","item":"https://advaslam.com/writing/dpdp-compliance-guide-kerala-businesses/"}]},{"@type":"FAQPage","mainEntity":[{"@type":"Question","name":"When do DPDP obligations actually bite?","acceptedAnswer":{"@type":"Answer","text":"Board Rules from November 2025, Consent Manager registration around November 2026, and substantive duties with penalties around May 2027 under GSR 843(E)/846(E) phasing. Build across 2026; enforcement-grade operation by early 2027."}},{"@type":"Question","name":"Does DPDP apply to my small business?","acceptedAnswer":{"@type":"Answer","text":"Yes where it processes digital personal data — no small-business carve-out from notice, consent, safeguards, breach, rights, and retention duties. Scale calibrates depth, not applicability."}},{"@type":"Question","name":"What is the compliance sequence?","acceptedAnswer":{"@type":"Answer","text":"Map data, fix notices and consent, build safeguards and retention, rehearse breach response, stand up rights handling, amend vendor contracts, assess children and SDF exposure, and file the inquiry-ready evidence set — each mapped to a guide below."}},{"@type":"Question","name":"What penalties apply?","acceptedAnswer":{"@type":"Answer","text":"Schedule ceilings to 250 crore rupees per instance for safeguard failures, 200 for breach-notification and children's violations, with Section 33 factors grading actual quantum. Mitigation files built now discount later penalties."}},{"@type":"Question","name":"Do we need a Consent Manager?","acceptedAnswer":{"@type":"Answer","text":"Most businesses interoperate rather than register — see the Consent Manager decision guide. Consent architecture must be Manager-compatible before the November 2026 window regardless."}},{"@type":"Question","name":"Where do we start this quarter?","acceptedAnswer":{"@type":"Answer","text":"Data mapping with the safeguards checklist and consent-notice drafting in parallel — the two foundations every later workstream consumes."}}]}]}
```