DPDP Consent Managers: What Changes on 13 November 2026

Most of the DPDP calendar belongs to 13 May 2027. One date does not. On 13 November 2026, Section 6(9) of the Act and Rule 4 of the DPDP Rules, 2025 begin, and companies can apply to the Data Protection Board to be registered as Consent Managers.

For most businesses that date does not make you a Consent Manager. It does change who might send your systems a consent instruction. Here is what starts, what waits, and what to do meanwhile.

What a DPDP Consent Manager is, and is not

Section 2(g) of the DPDP Act describes a Consent Manager as a person registered with the Board who acts as a single point of contact, through an accessible, transparent and interoperable platform, so a Data Principal can give, manage, review and withdraw consent. Sections 6(7) to 6(9) add three things. The individual decides whether to use one. The Consent Manager answers to the individual. And it must be registered.

It is not a cookie banner, or the consent module in your compliance software. Our explainer on the Consent Manager under the DPDP Act covers the legal text and registration conditions in depth. This article sticks to timing and operations.

What starts on 13 November 2026, and what waits

Registration opens about six months before most fiduciary duties begin.

That gap is the useful part: a Consent Manager can be registered before your own consent duties are enforceable. Rule 4 leaves application particulars to the Board’s website, and technical standards are the Board’s to set. Watch for both. Reports suggest the Board’s Chairperson and Members were still to be named in autumn 2026, so treat approval timelines as unconfirmed. Our guide to the Data Protection Board tracks how it works. Some sources say 14 November and 14 May; confirm against the Gazette.

Register, integrate or watch?

What a registered Consent Manager can and cannot do

The First Schedule to the Rules sets the terms. The practical points:

• It cannot read the personal data passing through its platform. The architecture has to keep the contents unreadable to it.
• It keeps records of consents given, denied and withdrawn, the notices behind them, and onward sharing, for at least seven years.
• It cannot subcontract its obligations, and it acts in a fiduciary capacity toward the individual.
• Its control cannot be sold or merged away without the Board’s approval.
• After a hearing, the Board can direct fixes, or suspend or cancel a registration where that is needed to protect Data Principals.

Use the same list as a due-diligence sheet if a Consent Manager approaches you: ask for proof of registration, the independent certification, and how data blindness works in the architecture. The Consent Manager carries the decision. The data stays with you.

An illustration: a withdrawal arrives

Take a hypothetical lending app with an SMS vendor, an analytics tool and a collections agency. A customer, using a registered Consent Manager, withdraws consent for marketing messages.

The app needs a new log entry: what was withdrawn, when, and through whom. The SMS vendor has to stop. Analytics events tied to that purpose have to stop. Whether the loan itself continues depends on its own lawful basis, a question for counsel.

Teams usually trip on the second hop. The app complies, the vendor keeps sending, and nobody can prove either way. The Board’s technical standards for these instructions are not out yet, so build the internal path first.

A six-month readiness plan

Six jobs between registration opening and the May 2027 duties.

• November. List every purpose you rely on consent for, and the system holding each one. A data registry beats a spreadsheet hunt.
• December. Make notices itemised, and store one record per purpose with a timestamp, notice version and channel. Our consent lifecycle guide shows the stages.
• January. Build the withdrawal path through your own systems, then out to vendors. Set an internal time limit and test it.
• February. Update processor contracts so withdrawals bind them. Vendor governance records belong here.
• March. Plan authenticated, logged inbound access for instructions. Hold the final design until the Board publishes standards.
• April. Run a tabletop on a bulk withdrawal. Check that the log tells the whole story.

Mistakes to avoid

• Treating a consent platform as a registered Consent Manager. The common consent mistakes start here.
• Believing every business must integrate on day one. Using one is the individual’s option under Section 6(7).
• Storing the answer but not the notice it answered.

Where RuleExpert fits

RuleExpert is not a registered Consent Manager and does not claim to be. Its consent module is built for Data Fiduciaries. By its own description it captures consent across channels, keeps an append-only log, runs a no-login withdrawal portal with timers, and produces an evidence pack. Pair it with the registry and vendor records so a withdrawal reaches every place the data sits.

How instructions from a registered Consent Manager would flow in depends on standards not yet published, so raise that on a demo. Software supports your compliance work. It does not replace legal advice. Book a RuleExpert Demo, or begin with the free DPDP Scorecard. For wider context see our DPDP compliance solution overview and the consent management software guide.

Frequently asked questions

What is a Consent Manager under the DPDP Act?

It is a person registered with the Data Protection Board that gives a Data Principal one interface to give, manage, review and withdraw consent across Data Fiduciaries. It answers to the individual, not to the businesses it connects.

Is it mandatory to use a Consent Manager?

No. Under Section 6(7) the Data Principal may choose one. Businesses are not required to register or buy one, but they should be able to honour consent decisions that reach them through one.

What happens on 13 November 2026?

Section 6(9) and Rule 4 begin. Eligible companies can apply to the Board for registration as Consent Managers. Most duties for ordinary Data Fiduciaries start on 13 May 2027.

Who can register as a Consent Manager?

A company incorporated in India that meets Part A of the First Schedule. That includes sound financials, directors with a record of integrity, and independent certification of its platform. The Board may inquire before deciding.

What is the net worth requirement?

Part A requires net worth of not less than ₹2 crore. It is an entry threshold, not the whole financial test.

Can a Consent Manager see the personal data it handles?

No. Part B requires the platform to keep the contents of the data unreadable to the Consent Manager. It handles the consent decision and records, not the data itself.

How long must Consent Managers keep records?

At least seven years, or longer if agreed or required by law. Records cover consents given, denied and withdrawn, the notices, and sharing with other fiduciaries.

Is a consent management platform the same as a Consent Manager?

No. A platform is software a company runs for its own consent duties. A Consent Manager is a Board-registered intermediary serving the individual. The guide to DPDP consent management sets the two side by side.

Is RuleExpert a registered Consent Manager?

No. RuleExpert offers consent management tooling for Data Fiduciaries. Any vendor claiming Board registration should be able to show it.

Do businesses need to act before 13 November 2026?

Nothing new becomes enforceable for them that day. Use the months before 13 May 2027 to map consent purposes, fix records and test withdrawals. The complete guide to DPDP in India lays out the wider timeline.