MeitY
high impact
upcoming
Demo reference · DPDP/2026/02DPDP — Data Principal Rights Operationalisation
Operational expectations for consent, rights fulfilment and breach notification under the DPDP framework.
0
Issued
10 May 2026
Effective
1 Oct 2026
Compliance deadline
1 Oct 2026
What changed
Consent capture and withdrawal, rights fulfilment workflows and breach notification timelines must be demonstrably operational.
Who is affected
All data fiduciaries processing personal data of individuals in India.
Why it matters
Documentation alone does not evidence compliance; running systems and fulfilment logs do.
What to do
Test a data-principal access request end to end and measure fulfilment time; close gaps in processor oversight.
Boardroom risk
Regulatory exposure combined with direct customer-facing failure during rights requests.
Related controls
Consent management
Data subject rights fulfilment
Breach notification
Source: official notification
Turn this into owned actions
ComplianceHQ maps regulatory change to controls, owners, evidence and deadlines automatically.
Talk to us