The short answer: on 13 November 2026 the second phase of India's DPDP rollout began: the consent manager framework (Rule 4) took effect and the Data Protection Board opened registration. Most obligations for Data Fiduciaries apply from 13 May 2027. For banks, NBFCs, insurers and other document-heavy teams, the next six months are for finding where personal data sits inside documents, reducing it, and being able to prove what you did.
*This is a practical summary, not legal advice. Check the DPDP Act, 2023 and the DPDP Rules, 2025 for the exact text.*
What changed on 13 November 2026
- Consent managers can now register. Indian companies with a net worth of at least Rs 2 crore can apply to the Data Protection Board to operate as consent managers, platforms that let people give, manage and withdraw consent across services. (India Briefing, The Tribune)
- The rest of the clock keeps running. The Rules were notified on 13 November 2025 with a phased timeline. The core duties (notices, security safeguards, breach intimation, erasure) apply from 13 May 2027.
Why documents are the hard part
Databases are easy to inventory. Documents are not. KYC copies, salary slips, bank statements, Form 16s, claim forms and scanned applications sit in shared drives, email attachments, loan-origination systems and, increasingly, LLM and OCR pipelines. Many are scans, many are in Hindi, Marathi or other Indian languages, and personal data appears in free text, tables, stamps and handwriting.
A six-month checklist for document-heavy teams
1. Map personal data inside documents. For each document type you collect, list the personal data fields it carries and every system it flows into, including outside processors and AI vendors.
2. Collect less, and mask at intake. Store only the fields the purpose needs. Existing UIDAI requirements already restrict storing full Aadhaar numbers; apply the same thinking to PAN, account numbers and dates of birth on every stored copy.
3. Build security safeguards into the document flow. The Rules list reasonable security safeguards such as encryption, obfuscation or masking, and the use of virtual tokens mapped to personal data, along with access controls and logs (Rule 6). Redacting or masking documents before they are shared or stored is the document-level version of this.
4. Redact before sharing with processors and AI tools. When documents go to a vendor, an OCR service or an LLM, send only what the task needs and remove the rest from both the text and the page image, inside your own environment.
5. Be ready for breach intimation. The Rules require informing the Board and affected people about a personal data breach, with a detailed report to the Board within 72 hours (Rule 7). That is only possible if you know which documents held which personal data.
6. Keep an audit trail. Record what was detected and removed in each document, under which policy and who approved it, so you can show your safeguards rather than describe them.
Redaction is one safeguard, not the whole of compliance: it does not replace notice, consent, retention and access-control decisions.
Test with documents that look like yours
Masking that works on a clean English PDF can miss a value on a skewed phone photo of a Marathi form. GritWorks' free sample packs include fictional Indian-language documents (Hindi, Marathi and Bengali), each clean and degraded, with the expected value and position of every field. Get a free sample pack.
Where GritWorks fits
GritRedact detects personal data and custom entities in PDFs, scans, images and audio, applies your policy with human review, removes values permanently and keeps an audit trail. It runs fully offline on-premises (Docker, no network egress), so documents never leave your environment. If you are preparing for May 2027, book a working session.
