Consent Manager registration under the DPDP Rules starts on 13 November 2026

The deadline before the deadline

Most DPDPA compliance plans run to 13 May 2027. That is when most of the Act’s operative provisions, including Data Fiduciary obligations and Data Principal rights, come into force, eighteen months after the Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025 (G.S.R. 846(E)).

Another date falls first. Rule 1(3) of the Rules provides that Rule 4, which deals with registration and obligations of Consent Managers, “shall come into force one year after the date of publication”. That is 13 November 2026, about six weeks from now. The Act’s commencement notification of the same date (G.S.R. 843(E)) puts two matching provisions on the same one-year timeline. Section 6(9) requires every Consent Manager to be registered with the Data Protection Board. Section 27(1)(d) lets the Board inquire into a breach of a condition of a Consent Manager’s registration.

What a Consent Manager is

Section 2(g) of the Act defines a Consent Manager as a person registered with the Board who acts as a single point of contact through which a Data Principal can give, manage, review and withdraw consent, using an accessible, transparent and interoperable platform. Under Section 6(7), a Data Principal may route consent to a Data Fiduciary through one. Under Section 6(8), the Consent Manager is accountable to the Data Principal and acts on her behalf.

The illustration in the First Schedule uses two banks and a platform holding the user’s consent. Indian readers will recognise the resemblance to the RBI’s Account Aggregator framework. The DPDPA applies the same idea across all sectors, not only finance.

Who can register

Rule 4(1) lets a person who meets the conditions in Part A of the First Schedule apply to the Board, with whatever particulars and documents the Board publishes on its website. Part A sets nine conditions. The applicant must be a company incorporated in India with a net worth of at least ₹2 crore. It must have the technical, operational and financial capacity to meet its obligations, sound finances and management, and adequate business prospects and capital structure. Its directors, key managerial personnel and senior management must have a general reputation and record of fairness and integrity. Its memorandum and articles must lock in the conflict-of-interest obligations, which can then be amended only with the Board’s approval. Its operations must be in the interests of Data Principals.

The ninth condition matters most in practice. The applicant’s platform must be independently certified as consistent with “such data protection standards and assurance framework as may be published by the Board on its website”. Until the Board publishes that framework and its application particulars, applicants have nothing to certify against. That publication is the thing to watch between now and November.

What a registered Consent Manager has to do

Part B of the First Schedule sets out the obligations, and several of them shape the design. The Consent Manager must make data available or share it in a way that leaves the contents unreadable to the Consent Manager itself (item 2). It must keep a record of consents given, denied or withdrawn, the notices that came with each request, and data shared with a transferee Data Fiduciary, and it must hold that record for at least seven years (items 3 and 4). It must act in a fiduciary capacity towards the Data Principal (item 8). It cannot sub-contract or assign its obligations (item 6). It must avoid conflicts of interest with Data Fiduciaries, including through its directors and senior management (items 9 and 10). It must publish who owns more than 2 percent of it (item 11), and it cannot change control without the Board’s prior approval (item 13).

Once registered, a Consent Manager stays under supervision. Under Rule 4(4) and 4(5), the Board can direct a non-compliant Consent Manager to fix its practices, and after a hearing it can suspend or cancel the registration.

What does not change on 13 November 2026

Nothing in the Act or the Rules requires a Data Fiduciary to route consent through a registered Consent Manager from that date, or at all. Section 6(7) frames this as the Data Principal’s option. The notice and consent obligations on Data Fiduciaries under Rule 3, and most other Rules, start on 13 May 2027.

What changes in November is narrower. The registration regime starts to operate, and any entity that wants to act as a Consent Manager has to be registered to do so. For a Data Fiduciary, the practical question comes later: whether to integrate with registered Consent Managers once they exist, and how its own consent records will line up with theirs.

Why the date still matters

For organisations planning to apply, the time needed for independent certification and corporate restructuring is the main constraint. The memorandum-and-articles condition and the conflict-of-interest rules alone may require board and shareholder action. For everyone else, November is the first time the DPDPA framework produces a regulated entity class with a public register, which usually makes a regime’s practical shape clearer.

It is also a reminder that May 2027 is closer than it looks. A typical DPDPA compliance programme takes six to twelve months, so organisations that have not started data mapping and consent redesign are already working inside that window.

Sources

• Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), Gazette of India, 13 November 2025: Rule 1(3), Rule 4, First Schedule Parts A and B. egazette.gov.in
• Taxmann, “Govt Notifies Commencement Dates for DPDP Act, 2023”: summary of G.S.R. 843(E), including the one-year commencement of Section 6(9) and Section 27(1)(d). taxmann.com
• Digital Personal Data Protection Act, 2023: Sections 2(g), 6(7) to 6(9) and 27(1)(d).