Consent Managers Go Live on 13 November 2026: What to Do Now

What changed

On 13 November 2025 the Central Government notified the Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E)). On the same day, a separate notification (G.S.R. 843(E)) brought parts of the Digital Personal Data Protection Act, 2023 (the DPDP Act) into force. Neither instrument switches everything on at once. Rule 1 sets three start dates: a handful of rules applied immediately, most apply 18 months after publication, and one rule sits in between.

That rule is Rule 4, which governs consent managers. It takes effect one year after publication, on 13 November 2026. The matching parts of the Act follow the same one-year timetable: section 6(9), which says every consent manager must be registered with the Data Protection Board of India (the Board), and section 27(1)(d), which lets the Board act against a consent manager that breaches its conditions.

A consent manager is defined in section 2(g) as a person registered with the Board who "acts as a single point of contact" through which an individual can give, manage, review and withdraw consent "through an accessible, transparent and interoperable platform". In plain terms, it is an intermediary that works for the individual, sitting between them and the businesses that want to use their data. Section 6(8) makes the consent manager accountable to the individual, not to the businesses it connects with.

Rule 4 and the First Schedule set the entry conditions. Under the Gazette text, an applicant must be a company incorporated in India with a net worth of at least ₹2 crore, and it must keep records of consents given, reviewed and withdrawn for at least seven years. Rule 4 also gives the Board power to issue corrective directions, suspend or cancel a registration, and call for information.

Two other developments shape how this milestone should be read.

The Board has no members yet. The Board was established on paper on 13 November 2025. MeitY invited applications for a Chairperson and four Members on 6 May 2026. In its written answer to the Lok Sabha on 12 August 2026, the government reported no appointments, and we have found no official record of any since. A registration regime that runs through the Board cannot work until the Board can sit.

The Act has been tidied, not changed. On 5 October 2026 the government issued the DPDP (Removal of Difficulties) Order, 2026 (S.O. 5458(E)) under section 43. It corrects two drafting slips. Section 9(1) now refers to the personal data "of a child or of a person with disability", and "audit" in section 10(2)(c)(ii) becomes "data audit". Neither change touches consent managers.

The main deadline has not moved. MeitY consulted stakeholders in January 2026 on bringing the 18-month date forward, but no amending notification had been published as of October 2026. Treat 13 May 2027 as the date for notices, security safeguards, breach intimation, erasure and children's data, unless a Gazette notification says otherwise.

Who is affected

Prospective consent managers. Account aggregators, consent-technology vendors and identity platforms are the obvious candidates. One distinction matters: the RBI's Account Aggregator Directions, 2025 already run a consent system for financial data, with a standard, auditable "consent artefact" (a machine-readable record of each consent). An RBI licence is not a DPDP registration. A firm that wants to act as a consent manager under the DPDP Act needs registration with the Board as well.

Data fiduciaries. A data fiduciary is any person who decides why and how personal data is processed. Nothing in the Act forces a data fiduciary to accept consent through a consent manager. But section 6(7) gives every individual the right to use one. Once registered consent managers exist, a business that cannot receive, record and act on consent and withdrawal signals from them will find it hard to show that withdrawing consent is as easy as giving it, which section 6(4) requires.

Consent-tool vendors. MeitY's Business Requirement Document for consent management systems, released in mid-2025, is a design guide aimed mainly at the consent systems businesses build for themselves. The document does not say whether it is binding, and it is not a substitute for Rule 4.

Individuals. Very little changes on day one. Using a consent manager is optional, and few, if any, will be registered on 13 November.

What to do now

For data fiduciaries, the work overlaps almost entirely with what the May 2027 deadline already demands:

• List every consent touchpoint. Include sign-up forms, apps, call-centre scripts and paper forms that are later digitised. Record the purpose each consent covers.
• Make consent records machine-readable. For each consent, store the purpose, the notice version shown, the timestamp, the channel and any later withdrawal. A consent manager integration will need exactly this data.
• Build withdrawal as a function, not an inbox. Withdrawal should flow automatically to every system and processor using the data, so that the erasure duty in section 8(7) can be met.
• Decide your stance on consent managers. Will you accept consent signals from any registered consent manager, or only some? Write down the reasons and the technical standard you will require.
• Keep the 2027 programme moving. Do not read the Board's vacancy as a pause. The obligations commence on the dates in the Gazette, whether or not the Board is ready to enforce them.

For businesses planning to apply:

• Check eligibility early. Confirm incorporation in India and the ₹2 crore net worth on audited figures.
• Plan for conflict-of-interest scrutiny. A consent manager acts for the individual. Group companies that also use the data will need a clear separation.
• Design for seven-year records. Retention, integrity and retrieval of consent logs are core to the business, not an add-on.
• Watch for the Board's procedure. Until members are appointed and an application process is published, there is nothing to file.

A worked example. A diagnostics chain collects consent for home sample collection, report delivery on WhatsApp and promotional health packages. Today, all three sit in one checkbox in its app. Under the Act, each purpose needs to be itemised in the notice (Rule 3, from May 2027) and separately withdrawable. If a patient later manages consent through a registered consent manager, the chain must be able to stop the promotional messages without disturbing report delivery. Splitting the purposes now solves both problems.

13 November 2026 is a legal milestone more than an operational one. The value of preparing now is that consent records built for consent managers are the same records the Board will ask for when the main obligations begin.

Key takeaways

• Rule 4 of the DPDP Rules, and sections 6(9) and 27(1)(d) of the Act, take effect on 13 November 2026.
• Consent managers must be Indian companies with a net worth of at least ₹2 crore and must keep consent records for at least seven years.
• As of October 2026, no Board members have been appointed, so registration cannot yet operate in practice.
• The 18-month deadline of 13 May 2027 for the core obligations has not been changed by any Gazette notification.
• Data fiduciaries should split consent by purpose and record it in a machine-readable form now.