What changes for Indian businesses when DPDPA Consent Manager registration opens on 13 November 2026?

The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025 with a staggered start. Phase one switched on definitions and the Data Protection Board. Phase two arrives next week, on 13 November 2026, and it is the one most often misread. Many CTOs we speak to assume their consent flows must be live by that date. They need not be. This article sets out what actually changes, who it affects, and what a sensible Indian business should do in the six months that follow.

What exactly comes into force on 13 November 2026?

Two things. Section 6(9) of the DPDP Act, 2023, which empowers the government to prescribe how Consent Managers are registered and regulated, and Rule 4 of the DPDP Rules, 2025, read with the First Schedule. Together they open the door for companies to apply to the Data Protection Board for registration as a Consent Manager. Nothing else in the Rules moves on that date; Rules 3 and 5 to 16, which carry the notice, security, breach and rights obligations, remain scheduled for 13 May 2027.

A Consent Manager is a registered intermediary through which an individual can give, manage, review and withdraw consent across many data fiduciaries from one place, in the way Section 6(7) describes. Think of the Account Aggregator model in finance, extended to all personal data: the intermediary carries the consent artefact, never the data itself.

Who can register as a Consent Manager?

Part A of the First Schedule sets the entry conditions. They are deliberately demanding, because the Consent Manager acts in a fiduciary capacity towards the individuals who use it.

Condition (First Schedule, Part A)	What it means in practice
Company incorporated in India	An LLP, trust or foreign entity cannot apply directly
Net worth of not less than ₹2 crore	Total assets minus liabilities as per the books of account
Technical, operational and financial capacity	Evidence of a working platform, team and funding runway
Reputation of directors and key managerial personnel	A record of fairness and integrity; the Board may inquire
Memorandum and articles lock in independence	Conflict-of-interest rules in Part B must be written into the constitution; changes need Board approval
Independent certification of the platform	An assessor confirms the interoperable platform meets the Board's published data protection standards

Rule 4 says the application is made in the form and with the documents the Board publishes on its website. It also lets the Board make any inquiry it considers fit before registering an applicant and publishing its details. In other words, the registration process only starts in practice once the Board has published its application particulars, and public reporting through October 2026 indicates the Board was constituted but not yet operational. Watch the Board's website and the MeitY notifications page rather than relying on the calendar alone.

What must a registered Consent Manager do?

Part B of the First Schedule lists thirteen continuing obligations. The ones that shape the whole ecosystem are these:

1. Stay data-blind. Personal data must be made available to a transferee fiduciary in a way that its contents are not readable by the Consent Manager. The intermediary moves consent, not data.
2. Keep an auditable record. Every consent given, denied or withdrawn, every accompanying notice and every sharing event must be recorded, kept for at least seven years, and made available to the individual in machine-readable form.
3. Never sub-contract. Obligations under the Act and Rules cannot be assigned or sub-contracted.
4. Avoid conflicts of interest. No directorships, financial interests or material pecuniary relationships between the Consent Manager's leadership and the data fiduciaries it serves; shareholders above 2% must be published.
5. Submit to audit and control. Periodic reports to the Board on technical and organisational controls, and no change of control without the Board's prior approval.

Rule 4 also gives the Board the power to direct a non-compliant Consent Manager, and after a hearing, to suspend or cancel its registration in the interests of data principals. This is a licensed role, not a product category.

Does your business need a Consent Manager?

Almost certainly not as a registrant. The Act does not require any data fiduciary to route consent through a Consent Manager, and the ₹2 crore net worth and conflict-of-interest rules are designed to keep fiduciaries from registering their own. What the Act does require, from 13 May 2027, is that you can accept consent and withdrawals that arrive through one. Section 6(8) makes the Consent Manager accountable to the individual and able to act on their behalf, so a withdrawal routed through a registered intermediary carries the same weight as one submitted on your own form.

This is where the confusion between a Consent Manager and a consent management platform does real damage. A platform such as DAPro (Data Adhikaar) is tooling that a fiduciary runs to issue notices, capture consent and prove it; a Consent Manager is a third party registered with the Board that individuals use. We explained the distinction in Consent Managers vs consent management platforms. You need the first; you must be able to interoperate with the second.

What should a data fiduciary do between now and May 2027?

Six months is enough if the sequence is right. Our recommended order for a mid-size Indian company:

1. Map every consent you rely on today and which of the Act's legitimate uses under Section 7 covers the rest.
2. Redesign notices to Rule 3. Itemised purposes, the specific personal data, the withdrawal route and the Board's complaint route, in English or any of the 22 Eighth Schedule languages the individual chooses. See our consent management guide.
3. Build an append-only consent ledger that stores the notice version, timestamp, channel and withdrawal state, so you can meet the Section 6 burden of proof in a Board proceeding.
4. Expose a withdrawal endpoint. Design it so a registered Consent Manager can call it, not just your own web form. Interoperability standards will come from the Board, but a clean API with idempotent withdrawal is the safe starting point.
5. Decide whether you are a Significant Data Fiduciary. If so, appoint an India-resident DPO and plan the annual DPIA and audit under Rule 13. Our DPO guide walks through the tests.
6. Rehearse the 72-hour breach drill under Rule 7 before it is mandatory, with the Board's reporting format in hand.

The full phase-by-phase calendar is in our DPDPA compliance timeline. A MeitY proposal from January 2026 to shorten the Significant Data Fiduciary window from 18 to 12 months has not been gazetted at the time of writing, so 13 May 2027 remains the operative date.

Why 13 November 2026 still matters, even with no new duty

Three reasons. First, the day the Board starts accepting Consent Manager applications is the day it is demonstrably functioning, which makes the May 2027 enforcement date credible. Second, the first registered Consent Managers will set the de facto interoperability standard that your consent endpoints must meet; being an early fiduciary partner gives you a say. Third, the penalty schedule is already law: up to ₹250 crore for failing to maintain reasonable security safeguards, ₹200 crore for breach-notification and children's-data failures, and ₹50 crore for residual contraventions. The Board that registers Consent Managers is the same Board that will levy them.

How Qodequay helps

DAPro (Data Adhikaar) is Qodequay's DPDPA compliance platform for data fiduciaries: notices in 22 languages, a tamper-evident Evidence Vault that stores every consent and withdrawal with its notice version, and 25+ connectors to CRM, HRMS and core systems. Qodequay Technologies is ISO 27001:2022 and ISO 9001:2015 certified. If you want a six-month plan to May 2027 mapped to your own systems, book a 30-minute DPDPA readiness call.

This article is for general information and is not legal advice. Confirm obligations and dates against the official texts of the DPDP Act, 2023 and the DPDP Rules, 2025 as published in the Gazette of India, and consult qualified counsel for your situation.