By CA Vrinda Aggarwal
Imagine receiving a phone call from an unknown company that knows your name, phone number, email address, shopping preferences and perhaps even details of your financial activities. You wonder: Where did they get all this information? Who gave them permission to use it? And, more importantly, do you have any control over it?
This is no longer an unusual experience. We live in a world where almost every activity leaves a digital footprint. From opening a bank account and applying for a job to shopping online, attending online classes and using social media, we continuously share personal information.
But how much do we really understand about the way our personal data is collected, stored, processed and shared?
This is precisely why India’s Digital Personal Data Protection (DPDP) framework deserves our attention.
A New Milestone: Launch of the DPBI Portal
On 14 November 2026, the Ministry of Electronics and Information Technology (MeitY) announced the launch of the online portal of the Data Protection Board of India at www.dpbi.gov.in.
The launch marks an important step towards implementing the Digital Personal Data Protection Act, 2023, and its accompanying Rules, 2025.
The immediate focus of this portal is to facilitate the registration of Consent Managers. Eligible Indian companies can apply through the portal to become registered Consent Managers, subject to prescribed conditions, including a minimum net worth of ₹2 crore.
This development is significant because it takes the conversation around data privacy beyond legislation and brings it closer to implementation.
However, it is important to understand that this portal is primarily meant for Consent Manager registration. It is not a general registration portal for every business or an indication that all DPDP obligations have already become enforceable.
What Exactly Is the DPDP Act?
The Digital Personal Data Protection Act, 2023, establishes a framework for protecting digital personal data in India.
In simple language, it aims to ensure that organisations handling personal data do so responsibly, transparently and for lawful purposes.
The Act introduces two important concepts:
1. Data Principal: The individual to whom the personal data relates. For example, you are the Data Principal when a company collects your name, contact number or other personal information.
2. Data Fiduciary: An organisation or person who determines the purpose and means of processing personal data. For example, a bank, hospital, educational institution, employer or e-commerce platform may act as a Data Fiduciary.
The underlying philosophy is simple: personal data belongs to individuals, and organisations handling it must be accountable for how they use it.
Understanding Consent Managers: A New Dimension of Digital Control
One of the interesting features of the DPDP framework is the concept of a Consent Manager.
Think about how many applications and websites ask you to accept their privacy policies, share your information or agree to receive communications. Managing these permissions across multiple platforms can become exhausting.
A Consent Manager is designed to provide an accessible, transparent and interoperable platform through which individuals can give, manage, review and withdraw their consent.
In other words, it can help individuals exercise greater control over how their personal information is processed across different platforms.
The newly launched portal creates a formal registration route for eligible companies seeking to offer these services.
This is also an emerging area of professional and entrepreneurial opportunity, particularly for technology companies, cybersecurity professionals and businesses working in digital governance.
Why Should Businesses and Professionals Pay Attention?
There is a common misconception that data privacy is relevant only to large technology companies. That is far from reality.
Consider a small business maintaining an Excel sheet containing customer names, mobile numbers, email addresses and financial details.
Consider an HR department maintaining employee records, salary information, bank account details and identity documents.
Consider a CA firm receiving clients’ PAN cards, Aadhaar details, bank statements, income-tax returns and financial records.
Or consider an educational institution maintaining students’ personal information, parents’ contact details and academic records.
All these situations involve personal data.
The real question is not whether an organisation is large or small. The question is whether it handles digital personal data and understands its responsibilities.
For professionals, this means data privacy can no longer be treated as merely an IT department’s responsibility.
It requires coordination between management, finance, HR, legal teams, technology professionals and compliance advisors.
What Should Organisations Start Doing?
Businesses should use this transition period to understand their existing data practices.
A few practical steps can make a meaningful difference:
- Identify personal data: Understand what information is collected from customers, employees, vendors and other individuals.
- Review data collection practices: Collect only the information that is genuinely required for a legitimate purpose.
- Review privacy notices and consent: Ensure individuals understand why their information is being collected and how it will be used.
- Strengthen data security: Introduce appropriate technical and organisational safeguards to protect personal information.
- Review third-party arrangements: Understand how payroll providers, cloud platforms, software vendors and service providers handle personal data.
- Create awareness among employees: Conduct regular training so that employees understand their role in protecting confidential information.
These are sensible preparatory measures. Organisations should also map their specific legal obligations and applicable implementation timelines under the Act and Rules.
Why Students Should Learn About Data Privacy Today
For students, DPDP is not simply another law to study for an examination.
The next generation of professionals will work in an environment where artificial intelligence, digital payments, cloud computing, online education and data analytics will become increasingly integrated into everyday business operations.
A future CA, lawyer, HR manager, entrepreneur, software developer or business administrator will inevitably encounter personal data.
Understanding data privacy can therefore become an important professional skill.
Students should begin asking questions: Is it appropriate to collect this information? Does the individual know how it will be used? Is it being shared securely? What happens if it is exposed?
These questions develop something more important than technical knowledge: responsible professional judgement.
The Road Ahead: Privacy Must Become a Culture, Not Just Compliance
The DPDP framework is being implemented in phases. While the Consent Manager registration framework became effective on 13 November 2026, the key provisions relating to individual rights, Data Fiduciary obligations and the Board’s inquiry and penalty processes are scheduled to take effect on 13 May 2027.
This gives organisations an opportunity to prepare, understand their responsibilities and build appropriate systems.
But ultimately, the success of data protection legislation will not depend only on government notifications, portals or penalties.
It will depend on how seriously organisations respect the privacy of individuals.
As professionals, we often focus on financial accuracy, statutory compliance, audit trails and regulatory reporting. It is equally important to recognise that protecting information entrusted to us is an essential part of professional responsibility.
My message is simple: Before asking someone to share their data, ask yourself whether you are prepared to protect it.
Digital growth and privacy protection should not be competing priorities. They must grow together.
Because in the digital economy, trust is not built merely by collecting information. It is built by handling that information responsibly.
