DPDPA, the Digital Personal Data Protection Act, is entering a decisive phase in India, with its main working framework expected to go live in May 2027. The Act was passed by Parliament in August 2023, and the rules under it were notified on 13 November 2025. An Economic Times Prime summary published on 31 October 2026 argues that the success of the framework will depend on more than legislation alone. It will be tested by how organisations respond when customer records appear online and how trust infrastructure is handled when certificates fail.
The rules bring the Act into effect in three phases. The first phase, which started on notification, covers definitions and the machinery for setting up the Data Protection Board of India. The second phase, starting on 13 November 2026, covers the registration of consent managers. The third phase, starting on 13 May 2027, covers notice to users, security safeguards, breach intimation, data retention, the rights of individuals and the duties of significant data fiduciaries. Rule 7, which sets out how a breach must be reported, falls in the third phase: a data fiduciary must tell affected people without delay and send the Board a detailed report within 72 hours.
What DPDPA means for banks after the SBI case
The SBI case shows why the timing matters. State Bank of India received alerts on 16 October 2026 from its threat intelligence provider, the Defence Cyber Agency and CERT-In, the national cyber emergency response team, about customer data that might be exposed on the dark web. The bank disclosed the matter to the stock exchanges on 21 October 2026. Its preliminary review of about 375,000 records found 3,897 customer records containing personal information. The source and full extent of the exposure remained under investigation.
Reports of the filing listed the exposed fields as registered mobile numbers, dates of birth, addresses, branch and customer information file identifiers, and loan lead metadata. SBI said it had activated incident response procedures and engaged an independent cybersecurity agency empanelled by CERT-In. The 3,897 figure is a subset found in a preliminary review, not a confirmed count for the whole dataset.
Because the main DPDPA duties are not yet in force, the Act gives affected SBI customers no statutory right under DPDPA to be told about this incident, and no Data Protection Board to complain to under DPDPA, according to analysis of the case published this month. Separate CERT-In directions cited in coverage require incident reporting within six hours, and stock exchange disclosure duties also applied to the bank. The gap is specific to DPDPA: its breach notice and safeguard duties arrive only in May 2027.
How DPDPA tests trust after the eMudhra incident
The eMudhra incident raises a different question for DPDPA, about the trust systems that sit behind secure websites. On 17 October 2026, a security researcher reported that cryptographic keys linked to eight eMudhra Global TLS intermediate certificate authorities were weak and potentially recoverable. eMudhra revoked the affected intermediate certificates on 18 October 2026. CERT-In said the compromised keys could potentially have been used to issue fraudulent TLS certificates, impersonate legitimate websites, or intercept and modify communications.
The incident concerned eMudhra global TLS certificate business, according to the Economic Times Prime summary. TLS certificates let a browser check that a website is what it claims to be, and that traffic to it is encrypted. Revocation closes one route, but organisations that relied on the affected certificates must still check their own systems and replace certificates where needed.
DPDPA will not, by itself, fix a weak certificate. Its contribution is the discipline around personal data: clear notice, limited collection, safeguards against breach, and a duty to tell people and the Board when a breach happens. The eMudhra case shows that personal data protection also depends on infrastructure that many users never see.
What DPDPA work remains before May 2027
The DPDPA Forum, a non-profit company based in Mumbai, is trying to fill part of that preparation gap. Its director, S. V. Ramsunder, said: “A plan is not readiness, a drill is.” The forum aims to develop standards, publish guidance on the law and provide a platform for debate on privacy and data governance. It has published draft standards on consent and data governance, and has sought comments from stakeholders.
Organisations have a short window before the third phase starts. Consent manager registration begins in November 2026, and the main duties follow in May 2027. Firms that wait until the duties are in force will have to build notice forms, retention schedules, breach response plans and data subject request systems at the same time. Firms that test those systems now, with drills and clear records of what data they hold, will face less pressure when the Board can receive breach reports under the Act.