No November Deadline for You
Nothing in the November 2026 tranche puts a duty on a Data Fiduciary. Your notice and consent duties under sections 5 and 6 and Rule 3 start in May 2027, with the rest of tranche (c).
DPDP Act guide
What Changes for DPDP Consent Managers in November 2026, and What Waits for May 2027.
From November 2026, companies can apply to the Data Protection Board to register as Consent Managers under Rule 4 of the DPDP Rules, 2025. No new duty applies to other businesses until May 2027. Here is what the Act and the Rules actually say, and what to do before then.
- Checked against the notified Gazette text, not the draft
- Every point tied to a section, rule or Schedule item
- Last checked October 2026
- DPDP Act, 2023
- DPDP Rules, 2025
- Rule 4 and First Schedule
In Brief
- What changes
- Rule 4 commences. A company that meets the First Schedule's conditions can apply to the Board to register as a Consent Manager, and the Board can act on a breach of those conditions.
- Who it affects
- Companies that want to run a Consent Manager platform. For every other business, no new duty becomes enforceable until May 2027.
- What to do now
- Do not buy anything because of a November deadline. Make sure your consent records could work with a Consent Manager by May 2027.
The timeline
Three Dates, and What Each One Switches On.
G.S.R. 843(E) brings the Act into force in three tranches, and Rule 1 does the same for the Rules. Consent Managers appear in all three, but only the second is about them alone.
| From | What starts for Consent Managers | Provisions |
|---|---|---|
| November 2025. In force. | The definition of a Consent Manager, and the Data Protection Board that will register them. | Act sections 2 and 18 to 26; Rules 1, 2 and 17 to 21. |
| November 2026. | Registration opens. The Board can inquire into a breach of a Consent Manager's registration conditions, direct it to fix the breach, and suspend or cancel its registration. | Rule 4; Act sections 6(9) and 27(1)(d). |
| May 2027. | People can give, manage, review and withdraw consent through a Consent Manager, which becomes accountable to them. They can complain to the Board about one, and Consent Managers must publish how to exercise rights and how fast they answer grievances. | Act sections 6(7), 6(8) and 27(1)(c); Rule 14; penalties under section 33. |
Why we give a month, not a day
Rule 1(3) starts Rule 4 one year after the Rules were published in the Gazette. The notification is dated 13 November 2025, while the e-Gazette record and the Press Information Bureau give 14 November. So the start date is 13 or 14 November 2026. We plan to the earlier one. The DPDP compliance page sets out all three tranches in full.
The definition
A Registered Intermediary, Not a Software Category.
Section 2(g) of the Act defines a Consent Manager as "a person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform".
It works for the person, not for the business. Section 6(8) makes it accountable to the Data Principal (the person the data is about) and has it act on her behalf. Part B item 8 of the First Schedule adds that it acts in a fiduciary capacity towards her.
That makes it different from a consent management platform in the software sense. Any company can build or buy software to collect and record consent. Only a company registered with the Board is a Consent Manager, and no one can be registered before Rule 4 commences in November 2026.
The First Schedule's own example shows how one works. A person on a Consent Manager's platform gives a bank consent to use her bank statement, either directly from her digital locker or routed through the bank that holds her account. India's Account Aggregator network already runs flows like this for financial data under RBI rules. The DPDP Rules do not mention Account Aggregators, so how the two regimes fit together is not yet settled.
Who can register
Nine Conditions in Part A of the First Schedule.
Rule 4(1) lets a person that meets all of them apply to the Board. Under Rule 4(2) the Board can inquire before it decides, and it must give reasons if it rejects an application.
| Item | Condition |
|---|---|
| 1 | The applicant is a company incorporated in India. |
| 2 | It has the technical, operational and financial capacity to meet a Consent Manager's obligations. |
| 3 | Its financial condition and the general character of its management are sound. |
| 4 | Its net worth is at least two crore rupees: total assets less liabilities, as in its books of account. |
| 5 | Its likely volume of business, capital structure and earning prospects are adequate. |
| 6 | Its directors, key managerial personnel and senior management have a record of fairness and integrity. |
| 7 | Its memorandum and articles of association require the conflict-of-interest duties in Part B items 9 and 10, and can be amended on that point only with the Board's prior approval. |
| 8 | Its proposed operations are in the interests of Data Principals. |
| 9 | It is independently certified that its platform meets the data protection standards and assurance framework the Board publishes on its website, with controls in place to meet them and the disclosure duty in Part B item 11. |
Two things only the Board can supply. Rule 4(1) leaves the application particulars, and Part A item 9 the standards and assurance framework, to what the Board publishes on its website. Check there before you plan an application. No consultant can promise you a registration date.
Once registered
Thirteen Obligations, in Six Groups.
Rule 4(3) binds a registered Consent Manager to Part B of the First Schedule. These are its duties, grouped by what they ask of the platform.
Let People Consent Through the Platform
A person can give consent to a Data Fiduciary onboarded onto the platform, either directly or through another onboarded Data Fiduciary that holds her data. (Item 1.)
Never Read the Data
Personal data must be shared in a way that keeps its contents unreadable to the Consent Manager. (Item 2.)
Keep the Record for Seven Years
A record of consents given, denied or withdrawn, the notices that came with each request, and each sharing of data. The person can see it and get it in machine-readable form, and it is kept for at least seven years. (Items 3 and 4.)
Run It Directly, and Securely
A website or app as the main way in, no sub-contracting or assigning of its obligations, and reasonable security safeguards against a personal data breach. (Items 5 to 7.)
Stay Independent of Data Fiduciaries
Act in a fiduciary capacity towards the person, avoid conflicts of interest with Data Fiduciaries and their promoters, and publish its promoters, directors, senior management and every shareholder above two per cent. (Items 8 to 11.)
Audit, Report and Keep Control
Audit its controls, its registration conditions and its compliance, and report the results to the Board. Its control cannot change hands without the Board's prior approval. (Items 12 and 13.)
For your business
What November 2026 Means If You Collect Consent.
Most businesses are Data Fiduciaries (the organizations deciding how personal data is used), not would-be Consent Managers. For them, four points matter.
Joining a Platform Is Not a Duty
Neither the Act nor the Rules require a Data Fiduciary to join a Consent Manager's platform. Part B speaks of Data Fiduciaries "onboarded onto" a platform: an arrangement each one enters, not one the law imposes.
Plan for Consent That Arrives Another Way
From May 2027, section 6(7) lets a person give, manage, review or withdraw consent to you through a Consent Manager. Consent records kept by purpose, with the notice shown and a clean withdrawal path, are what let you act on it.
Check What a Vendor Is Selling
A "DPDP consent manager" product is software unless the company behind it is registered with the Board. No registration can exist before November 2026, and afterwards the Board publishes registered Consent Managers on its website.
Before May 2027
Four Things to Have Ready.
- A purpose register. Every place you collect consent, and the specific purposes each consent covers. Consent under section 6 has nothing to attach to without one.
- A record for each consent. Which notice the person saw, what she agreed to and when. Section 6(10) puts the burden on you to prove the notice and the consent if they are ever questioned.
- Withdrawal as easy as the grant. Section 6(4) requires it. Build it so a withdrawal can reach you through your own channels or through a Consent Manager.
- A decision on Consent Managers. Whether you will accept consents and withdrawals that arrive through one, how you would verify them, and who on your side owns that.
If you plan to register as a Consent Manager yourself, start with Part A: the company structure, the articles of association, the net worth and the platform certification all take longer than the application.
This guide explains the published text. It is not legal advice. Sources: the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E)), both as published by MeitY, and G.S.R. 843(E) on commencement.
Related: DPDP Act compliance, CERT-In and DPDP reporting guide, GDPR compliance, compliance as a service.
FAQ
Questions About DPDP Consent Managers.
No. The November 2026 tranche commences only Rule 4 and sections 6(9) and 27(1)(d) of the Act, which deal with registering Consent Managers and supervising them. None of them puts a duty on a Data Fiduciary. Your duties on notice and consent under sections 5 and 6 and Rule 3 start in May 2027, and even then nothing requires you to join a Consent Manager's platform.
Only if the company running it is registered with the Data Protection Board. Section 2(g) defines a Consent Manager as a person registered with the Board. Software that records consent is a tool any company can build or buy. Registration cannot exist before Rule 4 commences in November 2026, so check the Board's website for any vendor that claims it.
Not directly. Part A item 1 of the First Schedule requires the applicant to be a company incorporated in India. A foreign group would need an Indian company that meets every other condition in Part A, including a net worth of at least two crore rupees.
At least seven years, under Part B item 4(c), or longer if the person and the Consent Manager agree or a law requires it. The record covers consents given, denied or withdrawn, the notices that came with each request, and any sharing of the person's data with a Data Fiduciary.
No. Part B item 2 requires the Consent Manager to make personal data available or share it in a way that keeps its contents unreadable to the Consent Manager itself. It manages the consent, not the data.
From November 2026, the Board can inquire into a breach of a registration condition under section 27(1)(d). After a hearing it can direct the Consent Manager to fix the problem under Rule 4(4), or suspend or cancel its registration under Rule 4(5). From May 2027, people can also complain to the Board about a Consent Manager under section 27(1)(c), and the penalty provisions of section 33 apply.
Rule 1(3) starts Rule 4 one year after the Rules were published in the Gazette. The notification is dated 13 November 2025, but other official records give 14 November, so the anniversary falls on one of those two days. We plan to the earlier one and give months, not days, in our advice.
Let's talk
Plan Your DPDP Work Around the Real Dates.
Send us your consent flows and your current privacy notice. We map them against sections 5 and 6 and Rule 3, and show where a Consent Manager could fit. We reply within one working day.