DPDP consent managers: the rules that start on 13 November 2026

The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025 and come into force in stages. The second stage starts on 13 November 2026: Rule 4, which covers the registration and duties of consent managers. It is the first new part of the DPDP framework to take effect since the Data Protection Board was set up, and the last stop before the main duties for businesses apply on 13 May 2027.

What a consent manager is

Under Section 2(g) of the DPDP Act, 2023, a consent manager is a person registered with the Data Protection Board who acts as a single point of contact that lets an individual (the Data Principal) give, manage, review and withdraw consent through an accessible, transparent and interoperable platform. Section 6(7) to 6(9) allow individuals to manage consent through a consent manager, make the consent manager accountable to the individual and act on their behalf, and require it to be registered with the Board.

In practice, think of it as a consent dashboard that sits between people and the businesses that process their data. Instead of tracking consents app by app, a person can see in one place which businesses hold their consent, for what purpose, and withdraw it there.

The DPDP timeline at a glance

Who can register as a consent manager

Part A of the First Schedule to the Rules lists the conditions an applicant must meet:

• It is a company incorporated in India.
• It has a net worth of at least ₹2 crore (total assets minus liabilities, as per its books of account).
• It has sufficient technical, operational and financial capacity, a sound financial condition, and adequate business volume, capital structure and earning prospects.
• Its directors, key managerial personnel and senior management have a reputation for fairness and integrity.
• Its memorandum and articles of association contain the conflict-of-interest and disclosure obligations from Part B, and can be changed on these points only with the Board's prior approval.
• Its operations are in the interests of Data Principals.
• An independent certification confirms its platform meets the interoperability standards published by the Board and has appropriate technical and organisational safeguards.

What a registered consent manager must do

Part B of the First Schedule sets out the ongoing obligations. The main ones:

1. Let people give consent to a business on its platform, directly or through another business on the platform.
2. Not be able to read the personal data that is shared through it.
3. Keep a record of every consent given, denied or withdrawn, the notices behind them, and any sharing between businesses, give the person access to it (in machine-readable form on request), and keep it for at least seven years.
4. Offer its services mainly through its own website or app.
5. Not sub-contract or assign its obligations under the Act and Rules.
6. Take reasonable security safeguards against personal data breaches.
7. Act in a fiduciary capacity towards the individual and avoid conflicts of interest with the businesses on its platform.
8. Publish its promoters, directors, key managerial personnel and senior management, shareholders holding more than 2%, and companies in which those people hold more than 2%.
9. Run effective audits and report the outcome to the Board periodically and when asked.
10. Not transfer control, by sale, merger or otherwise, without the Board's prior approval.

How registration works under Rule 4

1. A company that meets the Part A conditions applies to the Data Protection Board with the particulars, information and documents the Board publishes.
2. The Board may make whatever inquiry it considers fit and call for more information.
3. If satisfied, the Board registers the applicant and publishes its details on the Board's website; if not, it rejects the application with reasons.
4. If a registered consent manager stops meeting the conditions or its obligations, the Board can, after giving it a hearing, direct it to fix the problem, and where needed in the interests of Data Principals, suspend or cancel its registration.

Check the Data Protection Board's website for the application format before you apply, as the Board publishes the particulars it needs.

What it means for every other business

Most businesses will never become a consent manager, and using one is optional. But consent managers change how consent and withdrawals can reach you, so it is worth preparing now, well before 13 May 2027:

• Map your consent: for each purpose, what data you collect, where it is stored and which vendors receive it.
• Keep a proper consent record: who consented, to what purpose, when, through which channel and against which version of your notice.
• Make withdrawal as easy as giving consent, and make sure a withdrawal actually stops processing in every system and vendor that uses the data.
• Rewrite your notice so each purpose is itemised in clear language, as Rule 3 requires. See our guide to DPDP consent and notice.
• If you plan to work with a consent manager, check that it is registered with the Board and review its security, audits and contract terms.

Not sure where you stand? The free DPDP readiness check takes a few minutes, and the DPDPA 2027 compliance roadmap gives a month-by-month plan.

How CorpBridge can help

We help businesses get ready for the DPDP Act with a gap check, privacy notices and consent flows, a breach response plan and ongoing data protection officer support. See DPDP Act compliance, DPO as a service and the website legal pack, or book a free consultation.

This guide is general information, not legal or tax advice. Rules and thresholds change; speak to an expert about your situation.