Rule 4 of the Digital Personal Data Protection Rules, 2025, notified on 13 November 2025, takes effect one year later, on 13 November 2026. From that date, companies can register with the Data Protection Board as consent managers: platforms that let people give, review and withdraw consent across many businesses from one place. A consent manager must be a company incorporated in India with a net worth of at least ₹2 crore and must meet the Board's technical, operational and conflict-of-interest conditions. Using a consent manager is optional for businesses; the main DPDP duties, including notice, consent, security and breach reporting, still apply from 13 May 2027.
| Who is affected | Companies planning to offer consent management platforms, and businesses (banks, fintechs, health and e-commerce platforms) that collect consent at scale and may connect to consent managers. |
|---|---|
| What to do | Most businesses need no action on 13 November 2026. Use the date as a checkpoint: make sure your own notices, opt-ins and withdrawal options are being rebuilt for the 13 May 2027 deadline, and decide whether you will support consent managers. |
| Source | DPDP Rules, 2025 (Rule 4) via Mondaq |
This is a plain-language summary for general information, not legal or tax advice. The court order or official document is the authoritative text. Ask an expert how it applies to you.