DPDP Consent Manager Registration Opens 13 Nov 2026

What goes live on 13 November 2026

On 13 November 2026, Rule 4 of the Digital Personal Data Protection Rules, 2025 commences. From that date the Data Protection Board of India can accept applications from Indian companies to register as Consent Managers under Section 6(7) of the DPDP Act. This is one specific commencement — the Consent Manager registration regime — not a general commencement of the Act's substantive duties, which still wait until 13 May 2027.

Two things do not change on 13 November 2026. The Act's main obligations on Data Fiduciaries — notice, consent, Data Principal rights, security safeguards, breach notification, Significant Data Fiduciary duties, cross-border transfer rules and the Chapter VIII penalty schedule — remain scheduled to commence on 13 May 2027. The Data Protection Board, which the Act establishes as the regulator and which will adjudicate Consent Manager registration applications, has still not been staffed as of early November 2026 (Lok Sabha reply of 12 August 2026; RTI reply reported by The Economic Times in October 2026). The practical consequence: Rule 4 is in force from 13 November 2026, but the Board that must adjudicate under it has no members to do so.

What a Consent Manager is under DPDP (and what it is not)

A DPDP Consent Manager is a Data Protection Board-registered intermediary that lets a Data Principal manage consents across multiple Data Fiduciaries from a single interface. Section 6(7) sets up the role; Rule 4 and the First Schedule to the DPDP Rules 2025 set the eligibility, operational and audit standards. The Consent Manager stores consent records, provides the interface for grant and withdrawal, and interoperates with Data Fiduciaries through an API.

This is not the same thing as a Consent Management Platform (CMP) in the GDPR / ePrivacy sense. A CMP is a product that captures website or app cookie consent — IAB TCF-compliant tools, cookie banner vendors, consent-receipt platforms. A DPDP Consent Manager is a regulated role: it must be registered with the Board, must store receipts in India, must be independent, and must publish its consent flow for independent audit. A well-engineered consent capture product typically does both jobs — captures receipts to CMP quality and, where applicable, feeds a registered DPDP Consent Manager — but the DPDP registered-intermediary role is a specific legal category, not a product label.

Crucially, using a registered Consent Manager is optional for the Data Fiduciary. Section 6(8) permits the Fiduciary to obtain consent directly, provided the Section 6 standard is met and a Rule 3 standalone notice precedes the consent. The Fiduciary that uses a Consent Manager offloads the receipt infrastructure, the Principal-facing interface and the audit documentation; the Fiduciary that does not use one is still DPDP-compliant provided its own consent capture meets the standard.

Eligibility: Indian company, ₹2 crore net worth, certified interoperable platform

Rule 4 and the First Schedule to the DPDP Rules 2025 set the eligibility conditions. The applicant must be a company incorporated in India (not a partnership, LLP or foreign entity). It must have a minimum net worth of ₹2 crore. Its directors and senior management must be fit and proper (the Rule contemplates a published fit-and-proper test akin to those in Indian financial regulation). It must have an interoperable platform that is independently certified against the technical and security standards the Board will prescribe. It must have adequate information-security controls, including security of consent records at rest and in transit.

As of 1 November 2026, the Board has not published the technical certification standards, the application form, the fee, or the submission channel. Industry commentary — notably the Hindu BusinessLine's late-October survey of the Indian consent-tech market — reported that applicants are preparing documentation on their own understanding of the First Schedule and are expecting the Board to publish particulars after 13 November. The Board's non-staffing is the gating constraint: a Board without members cannot publish regulations under Section 28(2) and cannot adjudicate applications under Rule 4.

First Schedule obligations once registered

A registered Consent Manager has specific obligations the First Schedule lays out. Consent records must be stored in India. Personal data handled in the course of the Consent Manager function must not be used for any purpose other than that function — the Consent Manager cannot build an advertising business, a credit score or a scoring product off the consent record stream. The Consent Manager must publish its consent flow for independent audit and must undergo periodic certification against the Board's technical standards.

The Consent Manager must not charge the Data Principal for the service. It must offer the Principal a dashboard view of grants across every integrated Fiduciary, with the ability to grant, modify or withdraw consent in that interface. The withdrawal workflow must propagate to each integrated Fiduciary — within what the Board's technical standard prescribes — so a withdrawal in the Consent Manager interface takes effect across the Principal's full consent surface. The commercial model is paid by the Data Fiduciary, and the Board may set additional conditions through regulation under Section 28(2).

Can you apply on 13 November 2026?

Rule 4 commences on 13 November 2026 so the legal power to apply exists from that date. The practical question is whether the Board can accept applications in a meaningful sense. Three things must be in place: the Board must have members to adjudicate applications under Rule 4; the Board must have published the application particulars (form, fee, submission channel) under Section 28(2) procedural regulations; and the Board must have published the technical certification standards the First Schedule references.

As of 1 November 2026 none of these is in place. The best-case scenario: the government appoints Chairperson and members in late 2026, the Board publishes procedural regulations and application particulars in early 2027, and the first Consent Manager registrations begin adjudication in Q2 2027 — in time for the 13 May 2027 commencement of the substantive duties. The worst-case scenario is further delay in Board constitution, in which case Consent Manager registration is deferred past 13 May 2027. Prospective applicants that have prepared documentation can file on 13 November 2026 as a procedural step; the queue is a queue, not a decision, until the Board can adjudicate.

Do Data Fiduciaries need to integrate a Consent Manager?

No. Section 6(8) explicitly permits a Data Fiduciary to obtain consent directly from the Data Principal, provided the Section 6 standard is met: consent must be free, specific, informed, unconditional, unambiguous, and given through a clear affirmative action. The Rule 3 notice must precede or accompany the consent request, must be itemised, and must be presented in English or any Eighth Schedule language the Principal selects.

For most Data Fiduciaries operating consumer-facing digital services, in-house consent capture that meets the Section 6 standard is the default path to 13 May 2027. The Consent Manager pattern is attractive where the Fiduciary wants to delegate consent-interface design and receipt storage to a specialist, or where interoperability with other Fiduciaries is a specific value proposition (open-banking-style data sharing, for example). The decision should be based on operational fit rather than a mistaken belief that Consent Managers are mandatory. They are not.

How TruePrivacy works alongside registered Consent Managers

TruePrivacy captures DPDP-grade consent natively: Rule 3 standalone notices in all 22 Eighth Schedule languages, Section 6 clear-affirmative-action consent flows, cryptographically-signed per-Principal receipts with a tamper-evident audit log, and granular purpose-level toggles. For a Data Fiduciary that chooses in-house consent under Section 6(8), TruePrivacy's consent surface satisfies the full DPDP standard.

For a Data Fiduciary that chooses to integrate with a registered Consent Manager once registrations are live, TruePrivacy integrates via webhook / API with the Consent Manager's consent-event stream. The Consent Manager becomes the system of record for consent capture and withdrawal; TruePrivacy becomes the system of record for everything downstream — DSR intake and fulfilment, Grievance Officer workflow, breach notification, SDF controls, vendor DPAs, retention automation. The integration lets both platforms operate at their strongest without overlap, and keeps one audit trail per Data Fiduciary even where consent flows through an external intermediary.

What to do between 13 November 2026 and 13 May 2027

Six-month plan for Data Fiduciaries. First, decide the consent model: in-house under Section 6(8), or integration with a registered Consent Manager once available. If in-house, start building (or deploying) the consent surface — the Rule 3 standalone notice, the Section 6 clear-affirmative-action flow, the 22-language rendering, the per-purpose granularity, the signed receipt storage. If Consent Manager, maintain a watchlist for first registrations and prepare an integration backlog item for Q1-Q2 2027.

Second, build the dependencies that use consent. The notice generator (Rule 3), the DSR intake and fulfilment pipeline (Rules 5–6, 14), the Grievance Officer workflow (Rule 14), the breach notification pipeline (Rule 7), the retention automation (Rule 8), the Section 10 SDF module if you expect designation — each is a separate workstream and each is on the same 13 May 2027 deadline. Consent is one component in a 6-7-stream program; don't optimise it in isolation.

Third, document the choice. Whichever consent model you pick, the regulator's mitigation analysis will weight the quality of the decision as much as the choice itself. A dated decision memo recording why you chose in-house or Consent Manager, which specific operational trade-offs informed the choice, and when you plan to revisit — that memo is the kind of artefact that moves a Section 33(2) penalty analysis in your favour if a breach reaches enforcement.

What we'll update on 13 November 2026

This post is dated 1 November 2026. On the day Rule 4 commences, we'll update it with: whether the Board has published application particulars; whether any specific Consent Manager has applied publicly; whether MeitY has issued any further commencement notification; and any dated change to the 13 May 2027 timeline for the substantive duties. If you've linked this post as an evergreen reference, bookmark it — the second edit will carry the real update.

In the meantime, the baseline operational posture is: assume 13 May 2027 is firm, build the consent surface and the downstream dependencies in parallel, and treat the Consent Manager question as a model-choice question rather than a mandatory integration. The Section 6(8) in-house path is DPDP-compliant without any Consent Manager at all, and remains the most predictable path to the deadline.

Sources

DPDP Rules 2025 and commencement notification, Gazette 13 November 2025 (egazette.gov.in/WriteReadData/2025/267647.pdf). PIB release of 14 November 2025 (pib.gov.in/PressReleasePage.aspx?PRID=2190014). DPDP Rules First Schedule (Consent Manager eligibility and obligations). Hindu BusinessLine, 'DPDP privacy-tech firms weigh Consent Manager role; await regulatory certainty', late October 2026. Lok Sabha reply of 12 August 2026 on Board appointments. The Economic Times, October 2026, on the Board's RTI reply.

This post was last reviewed on 1 November 2026 by Fizer Khan (LowerPlane).