DPDP consent managers: registration stage begins November 13, a year after rules
By Karan BansalTech Startups Correspondent, Peepals Tech
Representative image: juliasorokina / Pixabay
India's DPDP Rules reach their first milestone on 13 November 2026, when registration of consent managers is due to begin; most other duties apply from May 2027.
What Happened
India's data protection regime reaches its first scheduled milestone this week. Under the phased timeline of the Digital Personal Data Protection (DPDP) Rules, 2025, the process for registering consent managers with the Data Protection Board of India is due to take effect on Friday, 13 November 2026, a year after the rules were notified, according to law-firm analyses of the rules. The government notified the rules in November 2025 to bring the Digital Personal Data Protection Act, 2023 into operation, with an 18-month phased timeline. Most remaining obligations for companies that handle personal data take effect from May 2027.
Key Facts
- The DPDP Rules, 2025 were notified on 14 November 2025, according to the government's press release; some legal summaries give 13 November.
- The government described an 18-month phased compliance timeline.
- The 12-month stage, due on 13 November 2026, brings in the process for registering consent managers, according to law-firm analyses.
- Consent managers must be Indian companies, the government said, and are registered with the Data Protection Board.
- Most other obligations on data fiduciaries, the companies that decide how personal data is used, apply at the 18-month mark in May 2027.
- Whether the Board has published its full application procedure for consent managers was not clear in public reports.
Why It Matters
The DPDP Act is India's main law on how companies and the government collect and use people's personal data. It rests on consent: in most cases a company needs a person's clear permission before using their data, and must let them withdraw it. A consent manager is a registered company that acts as a single point of contact for a person to give, manage, review and withdraw consent across many apps and services, instead of handling each one separately.
For start-ups, the consent-manager stage creates a new kind of regulated business. Firms that want to offer consent management, whether as a dashboard for users or as a service for apps, will need to register with the Data Protection Board and meet its conditions. For other businesses, the registration of consent managers is a signal to prepare, since the bigger set of obligations follows in May 2027.
The phased approach was meant to give companies, especially smaller ones, time to change their systems. The coming months are the last stretch before the main obligations start, and start-ups that collect user data, from fintech and health apps to e-commerce and education platforms, will need consent records, clear privacy notices and processes to answer user requests.
Peepals timeline: The DPDP Act was passed in 2023. On 14 November 2025, the government notified the DPDP Rules, 2025, with an 18-month phased timeline. On 13 November 2026, the 12-month stage, registration of consent managers, is due to take effect. The 18-month stage, when most remaining obligations for data fiduciaries apply, follows in May 2027.
| Stage | Date | What happens |
|---|---|---|
| Rules notified | 14 November 2025 | Act brought into operation |
| 12 months | Friday, 13 November 2026 | Registration of consent managers |
| 18 months | May 2027 | Most obligations on data fiduciaries apply |
Impact
Short-term: Companies planning to become consent managers can apply once the Data Protection Board's procedure is in place.
Long-term: If consent managers take off, Indians could get one place to see and control which apps hold their data. For businesses, the main test arrives in May 2027, when most obligations, and the risk of penalties for breaking them, apply.
Who is affected: Start-ups and companies that collect personal data; firms planning to offer consent-management services; privacy and compliance professionals; and every internet user in India whose data these companies hold.
What to watch next: Whether the Data Protection Board publishes the consent-manager application process around 13 November 2026, and the May 2027 stage for most remaining obligations.
Key Takeaway
A year after the DPDP Rules were notified, the consent-manager registration stage is due on 13 November 2026, with most data protection obligations following in May 2027.
Questions and Answers
What is a consent manager under the DPDP Act?
A consent manager is a company registered with the Data Protection Board that gives people one place to give, manage, review and withdraw their consent to the use of their personal data across services.
When does DPDP consent manager registration start?
Under the rules' phased timeline, the consent-manager registration stage is due on 13 November 2026, a year after the rules were notified, according to legal analyses.
When do most DPDP obligations apply to companies?
Most remaining obligations apply at the 18-month mark, in May 2027.
Can a foreign company be a consent manager in India?
No. The government said consent managers must be Indian companies.
Disclaimer: Prepared by the Peepals newsroom from publicly available sources with AI assistance. Information is accurate to the best of our knowledge at the time of publication and may change. Images may be representative. Not professional advice. Report an error via our contact page.
By Karan Bansal, Tech Startups CorrespondentCovers Tech Start-ups & Stories and more for Peepals Tech. All stories by Karan Bansal
ChatGPT India: now OpenAI's largest market by weekly users, says India MD
AI layoffs bill: Erwin Tulfo seeks six-month notice, double severance
Get the day's stories in your inbox
Peepals Weekly: the week decoded, free. One email a week, unsubscribe in one click.
Karan Bansal is a pen name of the Peepals Global Editorial Team, which researches, fact-checks and publishes every story. The portrait is an illustration.
