India DPDP Rules: consent manager registration takes effect Nov 13, 2026

India's consent manager rules take effect on 13 November 2026. On that date Rule 4 of the Digital Personal Data Protection Rules, 2025 comes into force. It lets companies apply to the Data Protection Board of India to register as consent managers: platforms people use to give, review and withdraw consent across many apps and services. In practice, filing may have to wait: the Board has not yet published its application requirements. Most obligations for ordinary businesses (data fiduciaries) begin later, on 13 May 2027.

Based on the Gazette text as of November 2026; not legal advice.

Where the 13 November date comes from

The Ministry of Electronics and Information Technology (MeitY) published the Rules as G.S.R. 846(E) in the Gazette of India dated 13 November 2025. Rule 1 starts the Rules in three stages:

• 13 November 2025: Rules 1, 2 and 17 to 21 (definitions and the Data Protection Board) took effect on publication.
• 13 November 2026: Rule 4 and the First Schedule (consent managers) come into force, one year after publication.
• 13 May 2027: Rules 3, 5 to 16, 22 and 23 (notices, security, breach reporting, children's data and other duties) come into force, eighteen months after publication.

A government explainer from 17 November 2025 says the Rules were notified on 14 November 2025, so some trackers list 14 November 2026 instead. The Gazette itself carries the 13 November 2025 date. Analyses of the companion commencement notification, G.S.R. 843(E), say the same stage brings in section 6(9) of the Act, which requires consent managers to be registered with the Board, and section 27(1)(d), which lets the Board look into breaches of registration conditions. In India, 13 November starts at 00:00 IST, which is 18:30 UTC (1:30 p.m. EST) on 12 November.

In January 2026 MeitY consulted industry on shortening some deadlines. As of early November 2026 we found no Gazette amendment that changes these dates, so the schedule above still applies.

What a consent manager is

Under the DPDP Act, 2023, a consent manager is a person registered with the Board that acts as a single point of contact through an accessible, transparent and interoperable platform. A user (a "data principal") can use it to give, manage, review and withdraw consent; under the Rules, this covers data fiduciaries onboarded onto that platform.

Who can register: the First Schedule, Part A

An applicant must meet all of the conditions in Part A, including:

• it is a company incorporated in India;
• its net worth is at least two crore rupees (₹2 crore, defined as total assets minus liabilities in its books);
• its directors and senior management have a record of fairness and integrity;
• its memorandum and articles of association lock in the conflict-of-interest rules, and those clauses can be changed only with the Board's approval;
• an independent certification confirms its platform meets the data protection standards and assurance framework the Board publishes on its website.

How registration works

Under Rule 4, an applicant files the particulars and documents that the Board publishes on its website. The Board can make whatever inquiry it sees fit. It then either registers the company and lists it online, or rejects the application with written reasons. After giving a hearing, it can also direct corrective steps, or suspend or cancel a registration in the interests of users.

One practical gap: in an order reported on 10 October 2026, the Kerala High Court recorded the Centre's statement that the Board had been constituted but was not yet functional. The court said it expected the Board to be made functional within eight weeks. Until the Board publishes its application requirements and standards, there is no practical way to file.

Obligations once registered: Part B

• Keep a record of consents given, denied or withdrawn, the notices sent with consent requests, and any data shared with another fiduciary.
• Give users access to that record, provide it in machine-readable form on request, and keep it for at least seven years (longer if agreed or required by law).
• Share data in a way that the consent manager itself cannot read.
• Act in a fiduciary capacity towards users, avoid conflicts of interest with data fiduciaries, and not subcontract its duties.
• Publish its promoters, directors, senior management and shareholders above 2%, run audits and report them to the Board.
• Not transfer control by sale or merger without the Board's prior approval.

What changes for apps and websites

On 13 November 2026 nothing becomes mandatory for an ordinary app. The Rules do not require any data fiduciary to use a consent manager. The notice, consent-withdrawal and security duties that affect most products start on 13 May 2027. What the new stage creates is a registered option: from 2027, users may be able to manage consent for an app through a registered platform instead of only inside that app. See also our privacy coverage and regulation news.

Frequently asked questions

When do DPDP consent manager rules take effect?

On 13 November 2026, one year after the Rules were published in the Gazette on 13 November 2025.

What is the minimum net worth for a consent manager?

Two crore rupees (₹2 crore), and the applicant must be a company incorporated in India.

How long must consent records be kept?

At least seven years, or longer if the user and consent manager agree or a law requires it.

Is this the main DPDP Act deadline?

No. Most obligations for businesses start on 13 May 2027. For a US comparison, see California's DROP data broker deletion tool.