DPDP Consent Managers: What Changes on 13 November 2026
Rule 4 of the DPDP Rules takes effect in November 2026. What Consent Managers are, who must register, and what data fiduciaries should do before May 2027.
The first DPDP deadline that touches the market
The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025 (G.S.R. 846(E)) and phase in over 18 months. The Data Protection Board provisions applied immediately. On 13 November 2026, Rule 4 — the Consent Manager framework — takes effect. On 13 May 2027, the core obligations follow: notice and consent, data principal rights, security safeguards, breach notification and retention limits. November 2026 is therefore the first date at which the DPDP ecosystem visibly changes for consumers, and the point from which data fiduciaries should expect Consent Manager integration requests.
What a Consent Manager is
A Consent Manager is a Board-registered entity that gives individuals a single, interoperable platform to give, manage, review and withdraw consent across many data fiduciaries. Instead of each company running its own consent silo, a data principal can route consent through a Consent Manager, and the data fiduciary must honour consent given or withdrawn that way. Consent Managers act on behalf of the data principal, not the business, and must avoid conflicts of interest with the data fiduciaries they connect to.
Who can register — the Part A conditions
Registration is with the Data Protection Board of India under the First Schedule to the Rules. Part A requires, among other conditions, that the applicant is a company incorporated in India, has a net worth of at least ₹2 crore, has sufficient technical, operational and financial capacity, has directors and senior management with a record of fairness and integrity, and operates an interoperable platform with appropriate technical and organisational measures. Part B then sets ongoing obligations once registered. Most businesses will not become Consent Managers — but every consumer-facing data fiduciary needs to be ready to work with them.
What data fiduciaries should do before May 2027
Treat November 2026 as the start of a six-month runway. First, build a consent inventory: every purpose for which you rely on consent, where consent is captured, and how withdrawal propagates to downstream systems and processors. Second, make consent machine-actionable — a withdrawal received through a Consent Manager has to stop processing in your CRM, marketing stack and analytics, not just update a database flag. Third, rewrite notices so each purpose is itemised in plain language, as the Rules require. Fourth, rehearse breach notification: the Rules require intimation to affected data principals without delay and a detailed report to the Board within 72 hours. Organisations that start in May 2027 will be retrofitting consent into live systems under enforcement.
The penalty context
The DPDP Act sets penalties of up to ₹250 crore for failing to take reasonable security safeguards to prevent a personal data breach, and up to ₹200 crore for failing to notify a breach or breaching obligations relating to children's data. Consent failures are not a paperwork risk: unlawful processing without valid consent undermines every downstream use of that data.