As organisations move toward the May 2027 deadline outlined by the Digital Personal Data Protection Act, a critical phase approaches on November 13, 2026, when eligible intermediaries can officially apply for registration with the Data Protection Board.
Despite the fast-approaching registration window, entities considering the intermediary function remain hesitant because the primary adjudicating authority has not yet been established and detailed regulatory instructions from the Board remain unpublished.
These regulated intermediaries are intended to serve as neutral platforms enabling individuals to grant, oversee, modify, or revoke permissions regarding their personal information across multiple institutions through a unified digital interface.
Technology creators building infrastructure for this purpose report active demand for their underlying tools, yet many vendors continue to evaluate whether they should step forward to operate as registered intermediaries themselves.
Industry projections suggest that total spending on compliance and related technology will exceed 10000 crore rupees across a three-year span, with consent architecture and governance estimated to account for approximately 1000 crore rupees of that total.
Market participants across various sectors highlight differing levels of preparedness, noting that fewer than four out of ten enterprises have mapped their information flows and third-party handlers, while nearly 80 per cent lack operational privacy governance structures.
Legal and industry experts point to potential conflicts of interest, strict eligibility criteria, and ambiguous revenue models as reasons why numerous technology vendors and professional services firms may choose to supply underlying systems rather than seek official intermediary registration.
Key numbers
- May 2027 deadline: DPDP compliance target
- 13 November 2026: Consent manager application date
- ₹10,000 crore: Projected DPDP-led tech and compliance spending over three years
- ₹1,000 crore: Estimated spending for consent architecture and governance
- Nearly 80 per cent: Enterprises yet to operationalise privacy governance frameworks
What a board might note
- Does the organization track the November 13, 2026 date regarding intermediary registration timelines?
- Has management reviewed the broader tech and compliance spending projections estimated at over ₹10,000 crore over the next three years?
- How does the firm compare against the statistic that nearly 80 per cent of enterprises have not yet operationalised privacy governance frameworks?
- What potential business conflicts might arise if technology providers also seek to operate as registered intermediaries under the upcoming rules from the Data Protection Board?
Source: The Hindu BusinessLine, 15 October 2026. This is a summary of a news report, published as general information. It is not legal, tax or investment advice.
This article is journalism and commentary. It is not a recommendation to buy or sell any security, and it is not professional advice. Read the full disclaimer.
