Consent Manager obligations under the DPDP Act kick in on 13 November 2026, and the core compliance obligations become enforceable on 13 May 2027. Most companies holding customer, employee, or vendor data haven't mapped what they collect, let alone built the consent flow the law now requires.
Lynx Legal Partners LLP helps founder-run and India-facing companies work out what the Digital Personal Data Protection Act actually requires of them — whether you're a software firm processing client data under an MSA, a GCC running employee and cross-border data flows, a D2C brand with a marketplace's worth of customer records, or a funded startup that's never had a compliance calendar.
Most businesses don't know whether they're a Data Fiduciary or a Significant Data Fiduciary — and that classification changes what the law demands of you, including whether you need a designated Data Protection Officer. We start by finding out, then build the programme around the answer.
A fixed-fee DPDP gap-check — mapping what personal data you collect and process, your fiduciary classification, your consent and vendor-contract exposure, and breach readiness, priced upfront. Clients typically move into a remediation sprint, an ongoing compliance retainer, and — for Significant Data Fiduciaries — a standing DPO-of-record arrangement.
Duties around registered Consent Managers become active — affecting how you capture, record, and honour consent.
The Act's substantive compliance requirements — notice, consent, data-principal rights, breach reporting — become enforceable.
The ceiling under the Act for failing to take reasonable security safeguards or report a breach.
Send us what data you collect and how — we'll flag what's exposed, fixed-fee, in one week.
Copyright© 2026 Lynx Legal Partners LLP
Lynx Legal Partners LLP · LLPIN: ABB-6277 · Registered office: Mumbai
