A year ago today the DPDP Rules were notified. Phase 2 starts now, on 13 November 2026, and the internet is full of people telling businesses to panic. Most of them can relax. A few cannot.
This page is the hub for our Consent Manager coverage. It sorts the facts from the noise, then points you to the detailed guides. If you want the mechanics of Rule 4, start with our 13 November Consent Manager explainer. If you want the big picture, our complete guide to DPDP in India is the base.
Quick answer: On 13 November 2026, Rule 4 of the DPDP Rules and Section 6(9) of the Act start, which opens registration for Consent Managers. Ordinary businesses face no new duties that day. Most obligations, including notice, consent, safeguards and breach reporting, begin on 13 May 2027. Using a Consent Manager is optional, and a consent tool does not make you one.
A year in three lines
On 13 November 2025 the Government notified the DPDP Rules, 2025, with a staged rollout described in PIB’s note on the notified Rules.
Since then, Rules 1, 2 and 17 to 21 have been in force. They cover definitions and the Data Protection Board’s set-up. Our guide to the Board explains its role.
The heavy lifting for businesses was always set for later. That is where we are heading.
What switches on today
Rule 1(3) says Rule 4 comes into force one year after the Gazette’s publication. Rule 4 sets out how a company registers as a Consent Manager. Section 6(9) of the DPDP Act, 2023 makes registration with the Board a condition of acting as one.
A Consent Manager is a registered intermediary through which a person can give, manage, review and withdraw consent across many businesses. Think of it as a rough cousin of UPI: a shared layer between you and many counterparties, so you do not deal with each one separately. The analogy breaks at one point. A Consent Manager must not be able to read the personal data passing through it, which is a core Part B condition.
Rule 4 matters to companies that want to become Consent Managers, not to the average business. To apply, a company must be incorporated in India, have net worth of at least ₹2 crore, and meet the other Part A conditions in the First Schedule. Independence is a hard bar. Part A expects the company’s articles to bind it to the conflict-of-interest duties in Part B, and changes need the Board’s prior approval.
No. Under Section 6 of the Act, using one is the individual’s choice. Your own consent duties still apply.
Three myths worth retiring.
The timeline, with a marker
You are at the middle point of the graphic above. Nothing new binds ordinary businesses today. But the gap is shorter than it feels. Six months is roughly one budget cycle, one vendor renewal round and one audit. MeitY has floated a shorter runway in the past, and we found no published amendment to Rule 1, so 13 May 2027 stands. Watch for change anyway.
Three decisions for this quarter
Will you rely on a Consent Manager at all? Optional does not mean ignorable. If your customers can use one, your systems must be able to receive their instructions. The Board has not published the technical standards, so design for flexibility, not for a guessed format. Our Consent Manager explainer covers the role.
Review your consent architecture. Check that every record shows purpose, notice version, channel and time, and that withdrawal reaches every vendor. The consent lifecycle guide and the consent mistakes post are good checklists.
Check whether you might be a Significant Data Fiduciary. Section 10 lets the Central Government designate them, with extra duties. We found no notification designating anyone yet, but volume and sensitivity of data are the factors. Read what SDF status would require.
The six months before May 2027
Month
Focus
What to finish
November
Notices
Rewrite notices in plain language, itemising data and purposes
December
Consent
Records that prove who agreed, to what, and when. Test withdrawal
January
Security
Safeguards and logs, including vendor access
February
Breach response
Run a drill: who decides, who informs the Board, how fast
March
Retention
Erasure rules, the one-year log floor, and sector record duties. See the retention policy guide
April
Grievance redressal
Intake, owners, response clock, evidence
One theme a month keeps the work finishable.
Free webinar: healthcare teams hear the most 13 November myths of anyone. 9 DPDP misconceptions in healthcare works through the nine we are asked about most, with a hospital readiness checklist for everyone who registers.
What is still unclear
Quite a lot. MeitY has advertised the posts of Chairperson and four Members of the Board. At our last check on 10 November we found no appointment announcement, and no published application form or portal. Rule 4 sets no decision deadline, no fee and no appeal route. The Part A certification standards are also unpublished.
So anyone promising a guaranteed registration, or a fixed process the regulator has not published, is guessing. We were careful to say the same in our guides, and our Rule and Schedule wording comes from published transcriptions, so confirm it against the Gazette.
Where RuleExpert fits
RuleExpert is not a registered Consent Manager. It builds tooling for the business side. By its own description, the consent module keeps an append-only consent log and a withdrawal portal, and the wider platform adds a Data Registry, Vendor Governance and breach workflows. Start with the free DPDP Scorecard to see your gaps, then Book a RuleExpert Demo. The solution overview and the consent software guide go deeper. Software supports the work. It does not replace legal advice or management accountability.
What happens on 13 November 2026 under the DPDP Act?
Rule 4 of the DPDP Rules and Section 6(9) of the Act start. That opens Consent Manager registration. Most duties for ordinary businesses do not start until 13 May 2027. See Rule 1(3).
Do I have to comply with the DPDP Act by November 2026?
Not with most obligations. Rules 3, 5 to 16, 22 and 23 take effect on 13 May 2027. Some provisions, including those on the Board, have applied since 13 November 2025.
Is it mandatory to use a Consent Manager?
No. Using a Consent Manager is the individual’s choice under Section 6 of the Act. Businesses must still meet their own consent duties.
Does buying a consent management platform make me a Consent Manager?
No. A Consent Manager must be registered with the Board and meet the First Schedule conditions. A platform is software you run for your own duties. Read our comparison.
Who can register as a Consent Manager?
A company incorporated in India that meets Part A of the First Schedule, including net worth of at least ₹2 crore and independent certification. Our registration guide maps the conditions.
Is the Data Protection Board ready to register Consent Managers?
We found no announced appointments to the Board and no published application form at our 10 November check. Re-check the Board’s website before you plan around any date.
I am a Compliance Manager at RuleExpert, focused on helping organizations navigate the evolving landscape of data protection and privacy regulations in India.
With the introduction of the Digital Personal Data Protection (DPDP) Act, businesses are facing new challenges in managing personal data, ensuring consent, and maintaining compliance across systems. My work revolves around simplifying these complexities and enabling organizations to adopt structured, scalable compliance practices.
I specialize in:
DPDP compliance and privacy frameworks
Data governance and risk management
Consent lifecycle and user rights handling
Compliance automation and operational workflows
At RuleExpert, I work closely with startups, SaaS companies, and enterprises to transform compliance from a manual, documentation-heavy process into an automated, infrastructure-driven system.
I am particularly interested in how AI and automation can reshape privacy operations and help businesses build trust in a data-driven world.
In their words
What compliance teams tell us
“We always thought DPDP compliance was the client’s responsibility
since we were only executing services. The evaluation made it clear that how we handle
client data creates risk on our side too. It changed how we work internally.”
DSFounderDigital services firm
“We had a basic understanding of DPDP requirements, but the scorecard
highlighted gaps we hadn’t identified internally — especially around consent handling
and data visibility. It gave us a much clearer starting point.”
BSFounderB2B SaaS company
“The DPDP score was surprisingly insightful. Within minutes we could see
where we stood and what needed immediate attention. It simplified something that initially
felt quite complex.”
FPProduct HeadFintech platform
“After reviewing our score we opted for a consultation. The discussion was
very practical — we got clear direction on what to fix first and how to approach DPDP
compliance in a structured way.”
LGFounderLogistics company
Real client quotes, attributed by role and sector — we never name a client.
Enquiry
Talk to the team
Your enquiry is with the team
Thank you — we have it. Someone will reply by email, usually within one working day.
Nothing else is needed from you. If it is urgent, email
tushar@ruleexpert.com and it will reach the same
people.
Allowing it lets Google Analytics and Google’s advertising measurement set an
identifier and receive your IP address, the pages you view and how you reached them
— used only to see which pages work and whether a campaign led to an enquiry, never to
build a profile or to decide anything about you. Google processes this outside India, a
cross-border transfer under Section 16. Declining changes nothing about the site, and you
can change your mind any time from the footer.
An analytics identifier is personal data, so the DPDP Act applies to
it — though no Indian cookie statute requires this banner. We ask because we would
rather you chose. What we collect and why
RuleExpert
