Consent managers under DPDP: what they are, and what changes on 13 November 2026

A consent manager under India’s Digital Personal Data Protection (DPDP) Act is a company registered with the Data Protection Board that gives individuals one place to give, manage, review and withdraw their consent across many organisations. It works for the individual, not for the businesses asking for consent, and it must be built so that it cannot read the personal data passing through it. From 13 November 2026, every consent manager must be registered with the Board under section 6(9) of the Act and Rule 4 of the DPDP Rules, 2025.

For most companies, that date brings no new duty. This guide explains what the law says, what is still unclear as of 24 October 2026, and what founders, product, legal and compliance teams should check now.

What is a consent manager under the DPDP Act?

Section 2(g) of the Act defines a consent manager as:

“a person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform.”

The Data Principal is the individual whose data it is. Three parts of the definition matter in practice.

• Registration is part of the definition. A business that is not registered with the Board is not a consent manager under the Act, whatever its marketing says.
• It acts for the individual. Section 6(8) makes the consent manager accountable to the Data Principal, and the Rules say it acts in a fiduciary capacity towards her.
• It works across organisations. The idea is one dashboard for consents given to many Data Fiduciaries, such as banks, insurers and apps, instead of a separate settings page at each one.

Section 6(7) makes this an option for the individual: she “may give, manage, review or withdraw her consent to the Data Fiduciary through a Consent Manager”. Nothing in that wording forces anyone to use one.

If you know RBI’s account aggregator system, the model will look familiar: under RBI’s directions, no customer financial information an aggregator accesses “shall reside with” it.

What exactly changes on 13 November 2026?

Two provisions of the Act and one rule come into force:

• Section 6(9). Every consent manager must be registered with the Board, subject to the technical, operational, financial and other conditions in the Rules.
• Section 27(1)(d). The Board can inquire into a breach of any condition of a consent manager’s registration.
• Rule 4 and the First Schedule. The application process, the conditions for registration (Part A) and the obligations of registered consent managers (Part B).

Under Rule 4, an applicant applies with the particulars the Board publishes on its website. The Board may make any inquiry it thinks fit, then either registers the applicant and lists it on the Board’s website, or rejects the application with reasons. If a consent manager stops meeting the conditions, the Board can direct it to comply and, after a hearing, suspend or cancel its registration.

Several related provisions do not start in November. The individual’s right to use a consent manager (section 6(7)), its accountability to her (section 6(8)), grievance redressal (section 13 and Rule 14) and the Board’s penalty powers (section 33) all start on 13 May 2027. AZB & Partners notes that the Act allows penalties of up to ₹50 crore for non-compliance by consent managers.

Is it 13 or 14 November?

Rule 1(3) says Rule 4 starts “one year after the date of publication of this Gazette”. The Gazette issue is dated 13 November 2025, and MeitY told the Lok Sabha in August 2026 that the Rules were notified that day. But the Gazette copy was uploaded on 14 November, a PIB backgrounder says the Rules were notified on 14 November, and some commentators, including an October 2026 SCC Online blog post, use 14 November 2026. Plan to the earlier date.

Who can register, and what must a consent manager do?

Part A of the First Schedule lists nine conditions for registration. Part B lists thirteen obligations that apply once registered. The table groups them by area.

Two points deserve a closer read.

• Data-blind design. Part B item 2 requires data to be shared so that its contents are “not readable by” the consent manager. It is a switchboard, not a store of customer data.
• No sub-contracting. The rule is not limited to core functions. A consent manager must not sub-contract or assign any of its obligations under the Act and Rules. How this applies to cloud hosting or support vendors is not spelt out, so applicants should take advice.

Is the Data Protection Board ready to accept applications?

Not on the public record, as of 24 October 2026.

• The Board was legally established on 13 November 2025.
• MeitY invited applications for a Chairperson and four Members on 6 May 2026, and the advertisement appeared in Employment News on 6 June 2026.
• On 12 August 2026, a Lok Sabha question asked whether any consent managers had been registered and what the timeline was. The written answer described “Phase 2 (within one year): Registration and functioning of Consent Managers” but gave no date for applications to open.
• In early October 2026, in a public interest case about Digi Yatra, the Centre told the Kerala High Court that the Board had been constituted but not yet made functional. The court said it expected the Board to be made functional within eight weeks, a window that runs past 13 November.

We have found no announced appointments, no application particulars and no published data protection standards and assurance framework, which Part A’s certification condition depends on. Our reading: the legal requirement starts on 13 November, but the route to registration depends on steps the Board has not yet taken publicly. Check official MeitY and Board channels before relying on any claim that applications are open.

Do ordinary companies have to use a consent manager?

No. Neither the Act nor the Rules require a Data Fiduciary to use or join a consent manager platform. AZB & Partners put it simply: “the DPDP Rules do not mandate that data fiduciaries use a consent manager.” Part B of the First Schedule talks about Data Fiduciaries “onboarded onto such platform”, which is a choice.

Some points apply whether or not you join one:

• Your consent duties stay with you. From 13 May 2027 you must give a standalone notice under Rule 3, and section 6(10) puts the burden on you to prove notice and consent. A consent manager’s records may help, but keep your own.
• Withdrawals must be acted on. Section 6(6) requires you, and your processors, to stop processing within a reasonable time after consent is withdrawn. The law does not say how to treat a withdrawal from a platform you have not joined. Our view: act on any genuine withdrawal, whatever channel it arrives through.
• It matters only where consent is your basis. Processing under the legitimate uses in section 7, such as employment purposes, does not rely on consent.

How would integration with a consent manager work?

The Rules give an illustration. Banks B1 and B2 are onboarded onto platform P, and B1 asks X, through P, for consent to use her bank statement. X can consent and share the statement directly from her digital locker, or route her consent through B2, where she banks, and instruct B2 to send the statement to B1. Under Part B, P must record the consent and the sharing, and must not be able to read the statement.

For a Data Fiduciary, joining a platform is likely to mean four connections: sending consent requests with your notice, receiving consents and refusals, receiving withdrawals fast enough to act on them, and exchanging data in a form the consent manager cannot read. The Board has not published technical standards yet, so avoid assuming one vendor’s format will become the standard.

What should you ask a vendor selling “DPDP consent management”?

Many products marketed for DPDP consent are tools you buy and control, which makes the vendor your data processor. A registered consent manager is different: it works for your customers. Ask:

1. Are you registered with the Data Protection Board as a consent manager? Where is your entry on the Board’s website? No one can be registered before Rule 4 starts.
2. If not, will you sign a data processing contract with security and breach-reporting clauses?
3. Can your platform read the personal data passing through it? How do you show it cannot?
4. Can we export a complete record of each notice, consent and withdrawal?
5. How quickly do withdrawals reach us, and can we pass them on to our processors?
6. If you plan to register, how will you meet the conflict-of-interest rules while selling to Data Fiduciaries?

What to do before 13 November 2026

For every organisation

• List where you rely on consent, and where you rely on a legitimate use instead.
• Check that you can show the notice and consent behind each consent-based purpose.
• Test a withdrawal from start to finish, including your processors.
• Tell product, sales and procurement teams that no vendor can claim to be a registered consent manager until the Board publishes a list.
• Decide who watches MeitY and Board announcements, and keep 13 May 2027 as your main deadline.

If you are thinking of becoming a consent manager

• Confirm you are an Indian company with a net worth of at least ₹2 crore.
• Prepare amendments to your memorandum and articles on conflicts of interest.
• Map directors’ and senior managers’ links with Data Fiduciaries, and prepare the shareholding disclosures.
• Design for data-blind sharing and seven-year records, and plan for independent certification once the Board’s standards are out.
• Review outsourcing arrangements against the no-sub-contracting rule.

Where does this leave your team?

For most companies, 13 November 2026 is a date to understand rather than a deadline to meet. The work that matters is getting notices, consent records and withdrawals right before 13 May 2027, and making sure the staff who handle these requests know what to do. Our DPDP Rules timeline sets out every date, and the readiness test gives a quick view of where you stand. If you would like awareness training for teams that handle consent and customer requests, get in touch.

This article is general information, not legal advice. AuditDPDP is an independent training provider and is not affiliated with MeitY or the Data Protection Board of India. Facts are as published or reported up to 24 October 2026.