Consent Managers Go Live on 13 November 2026: What Data Fiduciaries Must Do Now

The DPDP Rules 2025 were notified on 13 November 2025 with a staggered commencement. The first operational milestone arrives one year later, on 13 November 2026, when Rule 4 and the First Schedule (the Consent Manager framework) commence along with the related provisions of the Act (Section 6(9) and Section 27(1)(d)).

From that date, entities can apply to the Data Protection Board to be registered as Consent Managers.

What is a Consent Manager?

A Consent Manager is a Board-registered intermediary that gives a Data Principal a single, interoperable platform through which they can give, manage, review and withdraw consent across many Data Fiduciaries. Think of it as the consent equivalent of an Account Aggregator: the person sees and controls every consent in one place.

Who can register (First Schedule, Part A)

The conditions for registration include:

• The applicant must be a company incorporated in India.
• A net worth of at least ₹2 crore.
• Sufficient technical, operational and financial capacity, and a sound financial condition.
• Integrity of management and general character of the business.
• Constitutional documents that prevent conflicts of interest with Data Fiduciaries, which cannot be amended without the Board's approval.
• Independent certification that the interoperable platform conforms to the technical and data-protection standards the Board publishes.

What registered Consent Managers must do (Part B)

• Let Data Principals give consent directly or through a Data Fiduciary's own platform.
• Ensure the personal data being shared is not readable by the Consent Manager itself.
• Keep consent records, including what was consented to, granted, reviewed or withdrawn, for at least seven years.
• Act in a fiduciary capacity, avoid conflicts of interest, and not sub-contract its core obligations.

What changes for ordinary Data Fiduciaries on 13 November?

Less than the headlines suggest. Your own consent, notice and withdrawal obligations under Sections 5 and 6 do not commence until the 18-month mark in May 2027. But from November:

1. Data Principals may begin to arrive through Consent Managers. Your consent stack must be able to receive, honour and log consent artefacts and withdrawals that come from a registered Consent Manager, not just from your own UI.
2. Withdrawal must propagate. If a person withdraws through a Consent Manager, the withdrawal must reach every system and processor that relies on that consent.
3. Vendor diligence starts now. If you plan to integrate with a Consent Manager, check its registration status on the Board's register before you sign anything.

Open questions

As of mid-October 2026, reports indicate the Board's registration portal and technical standards had not been publicly released, and the Board's Chairperson and Members had not yet been appointed (see Data Protection Board status). Expect the first registrations to take time after 13 November.

How Data Adhikaar helps

Sammati, our consent agent, already stores consent as structured, versioned artefacts with a full audit trail, which is the shape a Consent Manager integration needs. Read our consent management guide or try the consent notice generator.

Position as of 15 October 2026. Not legal advice.