Is 13 November 2026 a DPDP deadline for my shop or clinic?

01What actually starts on 13 November 2026?

The Rules arrive in three steps, set out in Rule 1. The second step is Rule 4, which begins one year after publication. That comes to about 13 November 2026. Some sources count 14 November, so treat the exact day as approximate.

Rule 4 is about consent managers. A consent manager is a registered body that gives people one place to give, review and withdraw their consent. Rule 4 says who may apply to the Data Protection Board to register as one. Its text puts no duty on a shop, a clinic or a school.

One more item came out recently. On 5 October 2026, the IT ministry issued a Removal of Difficulties Order. It corrects the wording of two sections of the Act. The dpdprules.org tracker says it moves no dates.

02When do the DPDP rules actually reach my business?

This is the timeline as law firms and trackers count it today:

So why do people say November? In January 2026, reports said the ministry might cut the 18-month window to 12 months. One tracker notes that would have moved the main date to 13 November 2026. The reports differed on whether this covered everyone or only the largest data handlers.

The dpdprules.org tracker found no instrument making that change when it reviewed the question on 12 October 2026. So May 2027 stands for now. A date like this can still change, so check again before you rely on it.

03Does the DPDP Act apply to a small shop, clinic or school?

Plan as if it does. The Act's duties fall on a Data Fiduciary, meaning any person who decides why and how personal data is used. A person includes an individual, a Hindu undivided family, a firm and a company. We found no cut-off by size or turnover in what we read.

Section 17 lets the government exempt some classes of business, including startups, from some duties. The tracker we read reports no such notification so far.

Paper is a real difference. The Act covers data collected digitally, or collected on paper and digitised later. A register that stays on paper falls outside it. Once those names go into billing software, Excel or your phone, they count. Your family's contacts are not covered, because personal and domestic use is excluded.

Schools, coaching institutes and clinics have more to think about. India Briefing notes that the Act treats anyone under 18 as a child. Processing a child's data generally needs verifiable parental consent. The Act also restricts tracking and targeted advertising aimed at children, with some listed exceptions. Do not assume an ad campaign falls under those exceptions. Patient records are beyond this post too, so ask your advocate.

04Can I still send offers to my customers on WhatsApp?

Yes, if they agreed. Two rulebooks matter here, and one already applies.

WhatsApp's Business Messaging Policy, last updated on 23 September 2026, covers the Business App and the Business Platform. It says the person must have given you their number and given opt-in permission. You must respect a request to stop, whether it comes on or off WhatsApp.

The DPDP Act adds its own test from about May 2027. Consent must be free, specific, informed, unconditional and unambiguous, given by a clear action. The Act's own example is useful. A customer gives a pharmacy her number and asks for a payment receipt by message. The pharmacy may use the number for that.

AMS's view, not a legal ruling, is that a number given for a bill is not permission for a festival offer. Here is how we would sort a typical list:

05What should I do this week?

None of this needs software. It needs one hour and a clear decision before the Diwali rush ends:

• Write down where your customer numbers live: billing software, staff phones, Excel, Google Forms, ad lead downloads.
• Split them into people who asked for offers and people who only gave a number for a bill.
• Teach the counter one line in Hindi: 'Offers WhatsApp par bhejein? Kabhi bhi STOP likhkar band kar sakte hain.'
• Keep a simple record of the name, the date, what they agreed to and where they agreed.
• Make stopping as easy as starting. When someone says stop, remove them from every list, including staff phones.
• Stop using any bought list. Our post on TRAI's spam rules at TRAI's new spam rules: what changes for businesses that call and SMS customers gives a second reason.
• Check who still has your lists. Take them off the phone of anyone who has left.

An SCC Online op-ed argues that consent for service messages and marketing messages should be collected separately. We agree as a habit, because the people who say yes to offers are the ones who may want to hear from you.

06What should I not panic about?

A confusing date is a good sales opening for someone. Keep these in mind:

• Nothing we read puts a new duty on your shop on 13 November.
• If someone calls selling a DPDP package with that deadline, ask which rule they mean. Rule 4 is about consent managers.
• The ₹250 crore figure in headlines is a legal maximum for security failures, as MirvoLegal lists it. It is not a price list.
• As of September 2026, MirvoLegal said no Board Chairperson or Members had been reported as appointed.
• Do not delete customer or billing records in a hurry. Ask your CA what you must keep.
• You do not need costly consent software at this size, in our view. A careful register or sheet is a fine start.

Waiting until April 2027 is the real mistake. A list built on clear permission takes months of counter conversations, and you cannot fill it in one week.

07How does AMS handle customer numbers in marketing work?

Advance Media Solution does not sell legal compliance, and we will not call anything DPDP-certified. What we can do is keep the marketing side clean.

When we run ads, we ask where any customer list came from before it goes near a campaign. We write lead forms so people know what they will receive. Our comparison of WhatsApp and lead-form ads is at Should my Facebook and Instagram ads open WhatsApp or a lead form?, and our ads work is at Facebook Ads Agency in Rudrapur | Meta Ads.

When we build a site, an enquiry form says in plain words what the number is for. The site also carries a privacy page. That work is explained at Website Design & Development in Rudrapur.

If you want a second pair of eyes on how your leads and lists are set up, call +91 91059 43909. Even if you never hire us, teach your counter that one line this Diwali.

08Questions people ask