Consent Managers Under the DPDP Rules: What Changes on 13 November 2026

Most of India's data protection obligations take effect in May 2027. One element arrives six months earlier. On 13 November 2026, Rule 4 of the Digital Personal Data Protection Rules, 2025 commences, along with the First Schedule. Together they bring the Consent Manager framework into operation.

Consent Managers are among the more distinctive features of India's regime. This note explains what they are, who can become one, and what businesses that collect consent should prepare for.

What is a Consent Manager?

Section 2(g) of the Digital Personal Data Protection Act, 2023 defines a Consent Manager as a person registered with the Data Protection Board who acts as a single point of contact. Through an accessible, transparent and interoperable platform, it enables a Data Principal to give, manage, review and withdraw consent.

Under Section 6, a Data Principal may give or withdraw consent to a Data Fiduciary through a Consent Manager. The Consent Manager is accountable to the Data Principal and acts on her behalf. For individuals, this means one dashboard instead of many privacy settings. For businesses, it means consent may arrive, and be withdrawn, through an intermediary.

Who can register

Part A of the First Schedule sets the conditions for registration. In summary, an applicant must:

• be a company incorporated in India;
• have adequate technical, operational and financial capacity, including a net worth of at least ₹2 crore;
• have a sound financial condition, and directors and key managerial personnel of integrity;
• include conflict-of-interest safeguards in its constitutional documents, which cannot be amended without the Board's approval; and
• have its platform independently certified against the Board's technical standards.

The Board verifies compliance before it grants registration and publishes details of registered Consent Managers.

Obligations once registered

Part B of the First Schedule sets continuing obligations. Several of them shape how the market will work:

• Data-blind design. Personal data shared through the platform must not be readable by the Consent Manager.
• Record-keeping. Records of consents given, reviewed or withdrawn, the related notices and the data sharing must be kept for at least seven years, and made available to the Data Principal in machine-readable form.
• No subcontracting of its obligations, and service through its own website or app.
• Fiduciary conduct. It must act in the Data Principal's interest, manage conflicts of interest, and publish information on its promoters, directors and significant shareholders.
• Board approval for any transfer of control, by sale, merger or otherwise.

The Board may direct a Consent Manager to remedy non-compliance and may suspend or cancel its registration.

What this means for Data Fiduciaries

The Rules do not require a business to use a Consent Manager. They do, however, require a business to respect consent given or withdrawn through one. In practice, businesses that rely on consent should prepare on three fronts.

• Systems. Consent records must be able to receive and act on signals from an external platform, including withdrawals, without manual work.
• Process. When consent is withdrawn, processing must stop within a reasonable time, and processors must be instructed to stop as well.
• Contracts. Where a business integrates with a Consent Manager, the agreement should address service levels, technical standards, liability and audit.

Sectors that already work with India's account aggregator framework will recognise the model. For others, the change is operational as much as legal.

For businesses considering registration

Prospective Consent Managers should test their corporate structure against the conflict-of-interest requirements early. A platform owned by, or commercially tied to, a large Data Fiduciary will face close scrutiny. The independent certification requirement also means technology decisions cannot wait for the regulatory filing.

Conclusion

The Consent Manager framework is the first substantive part of the DPDP Rules to commence after the Board itself. Even businesses that never integrate with a Consent Manager should treat 13 November 2026 as a useful checkpoint. It is a good moment to confirm that their consent architecture will be ready for 13 May 2027.

Frequently asked questions

When does the Consent Manager framework start?

Rule 4 and the First Schedule of the DPDP Rules, 2025 commence one year after notification, on 13 November 2026.

Is it mandatory for businesses to use a Consent Manager?

No. A Data Principal may choose to give or withdraw consent through a Consent Manager, and a business must respect consent communicated that way.

What net worth does a Consent Manager need?

The First Schedule requires a net worth of at least ₹2 crore, together with technical, operational and governance conditions.

This article is for general information only and is not legal advice. It reflects the law as understood on 14 October 2026.