Key points
- On 13 November 2026, Rule 4 of the DPDP Rules and Section 6(9) of the Act come into force, so Consent Managers can register with the Data Protection Board.
- It brings no new duty for an ordinary organisation, and you do not have to sign up to a Consent Manager.
- Notice, consent, security, breach reporting, retention and children's data duties apply from 13 May 2027.
- Using a Consent Manager never moves your responsibility: you must still prove valid notice and consent (Section 6(10)).
- The best use of the time left is fixing your notices and consent records, which you need either way.
What is a Consent Manager?
A Consent Manager is a company registered with the Data Protection Board that gives people one place to give, manage, review and withdraw their consent across different organisations (Sections 2(g) and 6(7) to 6(9) of the Act). Think of it as a consent dashboard that works for the individual, not for the organisation collecting the data.
It acts on the person's behalf and must not be able to read the personal data that flows through its platform.
What exactly starts on 13 November 2026
The DPDP Rules, 2025 were published in the Gazette on 13 November 2025 and come into force in three steps (Rule 1):
| Date | What comes into force |
|---|---|
| 13 November 2025 | Definitions, the Data Protection Board and its procedures (Rules 1, 2 and 17 to 21). |
| 13 November 2026 | Registration and obligations of Consent Managers (Rule 4), and the requirement that every Consent Manager is registered with the Board (Section 6(9)). |
| 13 May 2027 | The main duties: notice, consent, security safeguards, breach reporting, retention and erasure, children's data, rights and grievances (Rules 3, 5 to 16, 22 and 23). |
Who can become a Consent Manager?
The First Schedule of the Rules sets the conditions. In short, a Consent Manager must:
- be a company incorporated in India, with a net worth of at least ₹2 crore;
- have the technical, operational and financial capacity to run the service, on a platform independently certified against the Board's standards;
- have directors and senior management of good reputation, and avoid conflicts of interest with the organisations on its platform;
- keep records of consents given, denied or withdrawn for at least seven years, and show people their records on request;
- not subcontract its duties, and protect the platform with reasonable security safeguards.
Unless you plan to run a consent platform yourself, you will not register. For most organisations this part is background.
What it means for your organisation
| Question | Answer |
|---|---|
| Do we have to use a Consent Manager? | No. Section 6(7) says a person may use one. You can keep collecting and recording consent yourself. |
| Can we be penalised from 13 November 2026? | Not for the duties of an ordinary organisation. Those start on 13 May 2027. |
| What if we join a Consent Manager's platform? | Consent given or withdrawn through it counts just as if the person had told you directly, so your systems must act on it, including stopping processing when consent is withdrawn. |
| Does a Consent Manager take over our responsibility? | No. You still have to prove that valid notice was given and valid consent obtained (Section 6(10)). |
What to do now
None of this needs a Consent Manager, and all of it is required by 13 May 2027 anyway:
- Fix your notices. Every form, app and counter that collects personal data needs a clear notice that lists the data, the purpose, and how to withdraw consent or complain (Rule 3).
- Record consent so you can prove it. Keep the date, the notice version and the channel for each consent.
- Make withdrawal easy and real. Withdrawing should be as easy as giving consent, and it must stop processing in every system and at every vendor.
- Decide later whether a Consent Manager suits you. It is mainly worth a look for businesses that collect consent from large numbers of customers, once registered Consent Managers appear.
Not sure where your notices and consent records stand? The free DPDP Readiness Check covers them in its notice and consent section.
Common questions
When do the DPDP Consent Manager rules come into force?
On 13 November 2026. Rule 4 of the DPDP Rules, 2025 comes into force one year after the Rules were published in the Gazette on 13 November 2025, and Section 6(9) of the Act, which requires Consent Managers to be registered with the Data Protection Board, starts on the same day.
Is it mandatory to use a Consent Manager under DPDP?
No. Section 6(7) says a person may give, manage, review or withdraw consent through a Consent Manager. Organisations can still collect and record consent directly, as long as they meet the notice and consent requirements of the Act and Rules.
Is 13 November 2026 a compliance deadline for my organisation?
Not for most organisations. It only brings in the registration framework for Consent Managers. The duties on notice, consent, security safeguards, breach reporting, retention and children's data apply from 13 May 2027.
Who can register as a Consent Manager?
A company incorporated in India with a net worth of at least ₹2 crore that meets the conditions in the First Schedule of the DPDP Rules, including an independently certified platform, directors of good reputation and safeguards against conflicts of interest.
Official sources
- Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023, Ministry of Electronics and Information Technology)
- Digital Personal Data Protection Rules, 2025 (Ministry of Electronics and Information Technology)
- Government notifies DPDP Rules (Press Information Bureau, 14 November 2025)
This guide explains the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 in plain language for operational planning. It is not legal advice; check details against the official text and with your legal counsel.