DPDP Consent Manager Rules Go Live on 13 November 2026: What to Do

As of 3 October 2026. The DPDP Rules were notified on 13 November 2025 with an 18-month phased rollout, and Phase 2, the Consent Manager framework, starts on 13 November 2026.

Key fact	Detail
Law	Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025
Phase 1 (13 November 2025)	Definitions and Data Protection Board provisions in force
Phase 2 (13 November 2026)	Rule 4 and First Schedule: registration and obligations of Consent Managers
Phase 3 (13 May 2027)	Notice, consent, security safeguards, breach intimation, data principal rights, erasure, children's data
Who it applies to	Phase 2: companies applying to be Consent Managers. Phase 3: every business that processes digital personal data in India.
Official source	Ministry of Electronics and Information Technology (meity.gov.in)

This guide is for founders, CTOs, compliance heads and IT managers of Indian businesses that hold customer, patient, student or employee data. After reading it you will know whether the 13 November 2026 date affects you directly, what a Consent Manager actually is, and which steps to start now so your website, app and internal systems are ready for the bigger deadline in May 2027.

What happens on 13 November 2026 under the DPDP Rules

On 13 November 2026, the Consent Manager framework becomes operative: Rule 4 and the First Schedule set who can register as a Consent Manager with the Data Protection Board and what obligations that registered entity carries.

The DPDP Rules were notified on 13 November 2025 and phased over 18 months. The first phase brought definitions and the Data Protection Board into force immediately. The second phase, 12 months after notification, opens the Consent Manager regime. The third phase, 18 months after notification on 13 May 2027, switches on the obligations that touch every business: notices, consent, security safeguards, breach intimation, rights requests, erasure and children's data.

So Phase 2 is narrow in law but important in practice. It is the moment India's consent infrastructure starts to exist, and businesses that will have to accept consent through it should know how it works.

What is a Consent Manager under the DPDP Act

A Consent Manager is a registered entity that gives individuals a single, interoperable platform to give, manage, review and withdraw their consent to data fiduciaries. It acts on behalf of the individual, not the business collecting the data.

Think of it as a consent wallet. Instead of tracking privacy settings in fifty apps, a person can see and revoke consents in one place, and the Consent Manager passes those instructions to each business. The Act allows a data principal to use a Consent Manager. It does not force every business to route consent through one.

The eligibility conditions in the First Schedule are strict. As reported in legal summaries of the Rules, the applicant must be a company incorporated in India, with a minimum net worth of Rs 2 crore, adequate technical and operational capacity, and conflict-of-interest safeguards that limit its stake in the data fiduciaries it serves. Read the First Schedule on the MeitY notification for the exact conditions.

Does my business need to register as a Consent Manager

Almost certainly not. Registration is for companies that want to run a consent platform as a service for individuals. A retailer, hospital, school, factory or SaaS company collecting data for its own purposes is a data fiduciary, not a Consent Manager.

The common mistake we hear from business owners is that "DPDP compliance starts in November". For most businesses, the November 2026 date changes nothing legally. What does change is that registered Consent Managers will begin to exist, and over time your customers may start managing consent through them. Your systems should be able to receive and honour those instructions.

Your role	Example	Does 13 November 2026 apply directly?
Data fiduciary	A pharmacy chain, coaching institute, real estate developer, D2C brand	No direct duty. Prepare for May 2027.
Data processor	A software vendor or call centre processing data for a client	No direct duty. Expect contract updates from clients.
Consent Manager applicant	A company building a consent platform for individuals	Yes. Registration and First Schedule obligations.
Significant data fiduciary	Large processors notified by the government	Main extra duties apply with Phase 3.

DPDP Rules 2025 timeline: what is due in each phase

The DPDP Rules 2025 run in three phases: Board and definitions from 13 November 2025, Consent Managers from 13 November 2026, and the main fiduciary obligations from 13 May 2027. Plan budgets around the third date.

1. Now to December 2026: data mapping. List every place personal data enters your business: website forms, apps, WhatsApp, POS, HRMS, CRM, spreadsheets, CCTV.
2. January to March 2027: build. Rewrite notices in plain language, add consent capture and withdrawal, set retention periods, harden access control and logging.
3. April 2027: test. Run a mock breach, a mock access request and a mock erasure request end to end.
4. From 13 May 2027: operate. Respond to rights requests, report breaches, delete data on schedule.

For the developer-level checklist, see our companion post on the DPDP compliance checklist for websites and apps.

What Indian businesses should do before November 2026

Before November 2026, businesses should finish a data inventory, identify the lawful basis for each use, and make consent a stored, timestamped record that can be withdrawn. These steps cost little now and are prerequisites for everything due in May 2027.

• Data inventory: what personal data, where it lives, who can see it, how long it is kept.
• Purpose list: one line per purpose, such as billing, delivery, marketing, payroll.
• Consent records: store who agreed, to which notice version, when, and through which channel.
• Withdrawal path: withdrawing must be as easy as giving consent.
• Vendor list: every processor, from your SMS provider to your cloud host, with a contract clause on DPDP.
• Owner: one named person responsible, with a published contact for data questions.

How Consent Managers will connect to your website and app

Consent Managers will need to send consent and withdrawal instructions to your systems and receive confirmation. In practice that means your consent store needs an API, unique consent identifiers and an audit trail rather than a checkbox in a database column.

The technical standards for interoperability are for the Board and the ecosystem to settle, so do not build to a guessed specification. What you can do now is separate consent from the rest of your data model. Keep a consent table with the principal, purpose, notice version, status, source and timestamps. Expose internal functions to grant, withdraw and query consent. When a standard API appears, you add an adapter instead of refactoring your whole application.

A simple consent record

consent_id      : uuidprincipal_ref   : customer_id or hashed phonepurpose_code    : MARKETING_WHATSAPPnotice_version  : 2027-05-v1status          : GRANTED | WITHDRAWNsource          : web_form | app | consent_managergranted_at      : timestampwithdrawn_at    : timestamp or null

This structure works whether consent arrives from your own form or from a registered Consent Manager.

What we see when Indian businesses start DPDP work

On web app, CRM and HRMS projects for clients in Rajkot, Ahmedabad and Surat, the first DPDP finding is almost always the same: personal data sits in far more places than the owner thinks, and most of it has no retention rule.

A real estate developer's sales team had leads in the CRM, in two shared spreadsheets and in personal WhatsApp chats of seven agents. A coaching institute stored parent phone numbers in its fee system, its attendance app and a bulk SMS panel. A diagnostics lab kept patient reports indefinitely because nobody had decided otherwise. None of these are hard to fix, but each needs a decision by the owner before a developer can implement it.

Our advice to these clients has been to treat DPDP as a data clean-up project with a legal deadline, not as a banner to paste on the website.

How to decide your DPDP budget and priorities

Budget according to how much personal data you hold and how sensitive it is. A brochure website with one enquiry form needs a few days of work; a hospital, school or fintech app needs a proper project with access control, logging and data rights workflows.

Business type	Typical scope	Indicative effort
Brochure website with enquiry form	Notice, consent checkbox with record, retention rule	2 to 5 days
E-commerce store or D2C brand	Consent store, marketing opt-outs, account deletion, vendor contracts	2 to 4 weeks
Hospital, school, HR or fintech system	Role-based access, audit logs, rights requests, breach runbook, children's data handling	1 to 3 months

Projects of the third kind usually fall between Rs 1.5 lakh and Rs 6 lakh with us, depending on the number of systems involved. A short scoping call is enough to place you in a band.

Related reading and next step

Read the developer-level DPDP compliance checklist, our guide to GDPR when outsourcing to India if you also serve European customers, and see how we build consent and audit features into custom web applications and CRM software. For a fixed quote on a DPDP readiness project for your website, app or internal systems, write to us through the contact page or WhatsApp +91 7265004040.