DPDP Consent Managers: What Changes on 13 November 2026
Consent Manager registration under the DPDP Rules starts on 13 November 2026. What a Consent Manager is, who can register, and what it means for your business.
Under the DPDP Act 2023, a Consent Manager is a person registered with the Data Protection Board of India that acts on behalf of a Data Principal to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform (Section 2(g), Sections 6(7) to 6(9)). Rule 4 of the DPDP Rules 2025 and the First Schedule, which set out registration and obligations, come into force on 13 November 2026. Part A of the First Schedule requires, among other conditions, that the applicant be a company incorporated in India. Most businesses do not need to become a Consent Manager. They are Data Fiduciaries, and they must accept consent given through a registered Consent Manager while still meeting their own notice, consent and record obligations, which apply from 13 May 2027.
The short answer
On 13 November 2026, the part of the DPDP Rules 2025 that covers Consent Managers comes into force. From that date, companies can apply to the Data Protection Board of India to register as Consent Managers.
Most businesses do not need to become one. If you run a website, app or store, you are a Data Fiduciary. Your own duties under the Act (notice, consent, withdrawal, rights requests) apply from 13 May 2027. What changes is that your users may start giving and withdrawing consent through a registered Consent Manager, and your systems should be ready to honour that.
What is a Consent Manager?
Section 2(g) of the Act defines a Consent Manager as a person registered with the Board who acts as a single point of contact so a Data Principal can give, manage, review and withdraw consent through an accessible, transparent and interoperable platform.
Think of it as a consent dashboard that belongs to the user, not to any one company. Instead of visiting ten websites to withdraw consent, a person could manage it from one place.
Section 6 sets the legal frame:
- Section 6(7): a Data Principal may give, manage, review or withdraw consent through a Consent Manager.
- Section 6(8): the Consent Manager is accountable to the Data Principal and acts on their behalf.
- Section 6(9): every Consent Manager must be registered with the Board, subject to the conditions in the Rules.
Consent Manager vs consent management platform
These are easy to confuse, and many vendors blur them.
| Consent Manager | Consent management platform (CMP) | |
|---|---|---|
| Works for | The Data Principal (the user) | The Data Fiduciary (the business) |
| Registration | Must register with the Board | No registration required |
| Where it sits | A user-facing service across many businesses | Inside your website or app |
| What it does | Lets a user manage consent everywhere in one place | Shows your notice, records consent, blocks trackers |
ConsentPlix is a consent management platform. We cover the difference in depth in consent manager vs consent management platform.
Who can register as a Consent Manager?
Rule 4 and the First Schedule to the DPDP Rules 2025 set the registration conditions. Part A of the First Schedule includes, among others:
- The applicant must be a company incorporated in India.
- It must have sufficient technical, operational and financial capacity, including a minimum net worth set in the Schedule.
- Its directors and key managers must meet fit-and-proper standards.
Part B lists the ongoing obligations, including sharing personal data in a way that the Consent Manager itself cannot read it, acting in a fiduciary capacity towards users, avoiding conflicts of interest with Data Fiduciaries, and keeping records of consents given, reviewed and withdrawn.
For the exact text, read the DPDP Rules 2025 and MeitY amendments page or the complete DPDP Act bare text.
What this means for your business
- Nothing to register. Unless you plan to run a Consent Manager service, you do not apply to the Board.
- Expect consent signals from outside your banner. A user may give or withdraw consent through a registered Consent Manager. Under Section 6(4), withdrawal must be as easy as giving consent, wherever it comes from.
- Keep your own proof.Section 6(10) still puts the burden of proving consent on you. Records showing which notice version the user saw, and when, are your evidence.
- Plan for the 2027 deadline. Your core duties start on 13 May 2027. Our DPDP checklist lists what to do before then.
Key dates
| Date | What happens |
|---|---|
| 13 November 2025 | Board provisions in force |
| 13 November 2026 | Consent Manager rules (Rule 4, First Schedule) in force |
| 13 May 2027 | All remaining obligations, including notice and consent, in force |
How ConsentPlix helps
ConsentPlix records every consent and withdrawal as a signed receipt tied to the exact notice version. Notices are itemised by purpose, as Section 5 requires, and users can read them in English or any of the 22 Eighth Schedule languages. See our pricing, or check your site today with the free DPDP website scanner.
Fact-checked against Act No. 22 of 2023 and G.S.R. 846(E) as of October 2026.
Amjad Rathod
Co-Founder & Chief ArchitectLead architect of the ConsentPlix consent ledger and sub-12KB client SDK. Works on DPDP Section 6 consent flows and high-throughput privacy engineering.
Continue exploring sovereign compliance engineering.
Ready to deploy provable consent infrastructure?
Deploy in minutes with our sub-12KB SDK or schedule a customized technical consultation with our privacy engineering team.