Consent Managers Under the DPDP Act: What Changes for Your Business from 13 November 2026

From 13 November 2026, companies can apply to the Data Protection Board of India to become registered Consent Managers. The date has been widely reported as the moment Consent Managers “go live”, and some business owners have understood it as a new deadline for themselves. It is not. What begins in November is the registration of the platforms. What those platforms will mean for your business, and the duties that come with them, begin on 13 May 2027. This guide explains what a Consent Manager is, what starts when, what a Consent Manager must do, and what a business is sensible to prepare.

It is written for business owners and the Chartered Accountants who advise them. For the wider picture of how consent works under the Act, see DPDP consent requirements, and for every date in the Act and Rules, see the DPDP implementation timeline.

Quick Answer: What Changes on 13 November 2026?

Rule 4 of the DPDP Rules 2025 comes into force on 13 November 2026. Rule 1(3) says Rule 4 “shall come into force one year after the date of publication”, and the Rules were published on 13 November 2025. On the same date, two provisions of the Act come into force under the commencement notification (G.S.R. 843(E)): Section 6(9), which requires every Consent Manager to be registered with the Board, and Section 27(1)(d), which lets the Board inquire into a breach of a registration condition. In short, from 13 November 2026 a company can apply to become a Consent Manager, and the Board can register, supervise, suspend or cancel one. An ordinary business has no new duty on that date. The customer’s right to use a Consent Manager to give or withdraw consent to you (Section 6(7)) applies from 13 May 2027, together with your own consent duties.

Which Consent Manager Rules Apply, and From When?

The Act and the Rules came into force in three stages. The provisions about Consent Managers are spread across all three, which is why the dates are easy to mix up.

The pattern is simple once it is laid out. November 2026 is when the register opens. May 2027 is when the register starts to matter in day-to-day dealings between customers and businesses.

Does My Business Have to Do Anything on 13 November 2026?

For a business that only collects and uses its own customers’ data, no. Nothing in Rule 4, Section 6(9) or Section 27(1)(d) places a duty on an ordinary Data Fiduciary (the Act’s term for a business that decides why and how personal data is used; see what a Data Fiduciary is). Those provisions are addressed to the companies that wish to become Consent Managers, and to the Board.

Two kinds of business should look more closely at the November date:

• A company that plans to operate a Consent Manager platform. It may apply from 13 November 2026, and it must meet every condition in Part A of the First Schedule (set out below).
• A business whose customers already use account-aggregation or consent platforms, such as lenders and other financial businesses. They will want to follow which platforms register with the Board, because their customers are the ones most likely to use them once Section 6(7) applies.

For everyone else, the useful step in November is to note the date, watch the Board’s website for the first registrations, and continue preparing for 13 May 2027.

What Happens When a Customer Withdraws Consent Through a Consent Manager?

From 13 May 2027, Section 6(7) provides that the customer “may give, manage, review or withdraw her consent to the Data Fiduciary through a Consent Manager.” The word is may. Using a Consent Manager is the customer’s choice, not a requirement, and the customer can still give or withdraw consent directly with you.

The Act and the Rules do not require a business to join a Consent Manager platform. Part B of the First Schedule refers to a business “onboarded onto such platform”, which describes how the arrangement works when a business does join, without making joining compulsory.

What does not change is the right to withdraw. Section 6(4) lets the customer withdraw consent “at any time, with the ease of doing so being comparable to the ease with which such consent was given.” Section 6(6) then requires you, within a reasonable time, to stop the processing and to cause your service providers (Data Processors) to stop, unless another law requires or allows it to continue. The Act does not set out a separate procedure for a withdrawal that reaches you from a platform you have not joined. The sensible course is to treat a withdrawal from a registered Consent Manager the way you would treat one made directly: confirm that the customer can be identified, act on it within your usual time, and record what you did. If an instruction comes from a platform that does not appear on the Board’s list, ask the customer to confirm directly before acting.

Withdrawal has limits that apply whichever way it arrives. Under Section 6(5), processing done before the withdrawal remains lawful, and the customer bears the consequences of withdrawing. The Act’s own illustration: a shopping app may stop letting the customer place new orders, but must still deliver an order already paid for. For the other requests a customer can make, see the eight types of data request under the DPDP Act.

Who Can Become a Consent Manager?

Rule 4(1) allows a person who meets the conditions in Part A of the First Schedule to apply to the Board, “by furnishing such particulars and such other information and documents as the Board may publish in this behalf on its website.” Under Rule 4(2), the Board may make such inquiry as it thinks fit and either registers the applicant and publishes its particulars on its website, or rejects the application with reasons. The nine conditions in Part A are:

For a CA, several of these will be familiar ground. “Net worth” has a defined meaning in the Schedule’s note: total assets less liabilities, as they appear in the Consent Manager’s books of accounts. “Company”, “control”, “director”, “key managerial personnel”, “promoter” and “senior management” carry their Companies Act, 2013 meanings. These are conditions of registration, not only of application: Rule 4(4) and 4(5) let the Board direct a Consent Manager that is not adhering to them, and, after giving it a hearing, suspend or cancel its registration.

What Must a Registered Consent Manager Do?

Rule 4(3) says a Consent Manager “shall have obligations as specified in Part B of First Schedule.” There are thirteen. Grouped by purpose:

Serving the customer

• Let the customer give consent to a business on the platform, either directly or routed through another business on the platform that holds the data (item 1). The Rules illustrate this with a customer who uses the platform to let one bank receive her account statement from another bank.
• Run a website or app, or both, as the main way customers use the service (item 5).
• Act in a fiduciary capacity in relation to the customer (item 8).

Handling data and records

• Ensure that personal data made available or shared through the platform is “not readable by it”: the Consent Manager passes the data on without being able to read its contents (item 2).
• Keep a record of consents given, denied or withdrawn, of the notices that came with each consent request, and of data shared with a receiving business (item 3).
• Give the customer access to that record, provide it in machine-readable form on request, and keep it for at least seven years, or longer if agreed with the customer or required by law (item 4).
• Take reasonable security safeguards to prevent a personal data breach (item 7).
• Not sub-contract or assign any of its obligations (item 6).

Independence from businesses

• Avoid conflicts of interest with businesses, including their promoters and key managerial personnel (item 9).
• Have measures so that no conflict arises from its own directors or senior management holding a directorship, financial interest, employment or ownership in a business, or a material financial relationship with one (item 10).
• Publish its promoters, directors, key managerial personnel and senior management, every shareholder above 2%, and every body corporate in which its leadership holds more than 2% (item 11).

Oversight

• Have audit mechanisms that review its controls, its continued fulfilment of the registration conditions and its compliance, and report the outcome to the Board periodically and when the Board directs (item 12).
• Not transfer control of the company, by sale, merger or otherwise, without the Board’s prior approval (item 13).

Is a Consent Manager the Same as a Consent Tool or Cookie Banner?

No, and the difference matters when a vendor describes its product. The software a business uses to show its own consent notice, record consent and handle withdrawals is a tool for the business. It is chosen and paid for by the business, and it serves the business’s own duties as a Data Fiduciary. A registered Consent Manager is the opposite arrangement: it is registered with the Board, accountable to the customer, and required by Part B to stay independent of the businesses on its platform.

A product may be called a “consent manager” in its marketing without being a Consent Manager under the Act. Only a company registered under Rule 4 is one, and the Board’s website is where its registration can be checked. For the narrower question of website cookies, see why a cookie banner is not DPDP compliance.

What Should Your Business Prepare Before May 2027?

Because the duties that touch your business start on 13 May 2027, the preparation is the same work you are already doing for that date. Five points bear directly on Consent Managers:

1. A withdrawal route that is as easy as giving consent. Rule 3(c)(i) requires your notice to describe how the customer can withdraw consent, “with the ease of doing so being comparable to that with which such consent was given.” See how to write a DPDP privacy notice.
2. A consent record you can produce. Section 6(10) puts the burden on you to prove that notice was given and consent obtained. A customer’s Consent Manager will keep its own record of the consent, but that does not replace yours. See what a consent record must contain.
3. A clear identifier. Rule 14(1)(b) asks you to publish the particulars, such as a customer ID, mobile number or email address, that you need to identify a customer. The same identifier is what lets you match a withdrawal from any channel to the right record.
4. One withdrawal process, whatever the channel. Decide who acts on a withdrawal, how quickly, and how your service providers are told to stop. A withdrawal by email, by a link in your notice, or through a Consent Manager should end in the same place.
5. A decision on joining a platform, if it is relevant to you. Most small businesses will not need to. A business whose customers move financial or similar records between institutions may find that its customers expect it. That is a commercial decision, not a legal requirement.

If you want to draft the consent notice now, the free consent notice generator builds one in your browser, with nothing you type sent to us or stored.

A Note for CAs Advising Clients

Clients are likely to ask about the November date. For most SMB clients, the accurate answer is short: it opens registration for Consent Managers and creates no new duty for them; their own consent obligations begin on 13 May 2027. The question to put to each client is whether their customers are likely to manage consent through a platform, and whether the client’s withdrawal process would cope if they did.

A small number of clients may consider applying to become a Consent Manager. Part A is in large part a familiar diligence exercise: incorporation, a net worth of ₹2 crore computed from the books, the fitness of directors and key managerial personnel, and amendments to the memorandum and articles of association. The independent certification of the platform under item 9 depends on standards the Board publishes on its website; check there for the current framework before advising on readiness. For the wider client review, our DPDP audit checklist for CAs covers consent, notices and records.