DPDP Rules: The Consent Manager Framework Goes Live in November 2026, and What Businesses Should Do Before May 2027

The short version

India's Digital Personal Data Protection Act, 2023 is being switched on in stages. The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025 and set the calendar: some provisions started at once, one part starts on 13 November 2026, and almost everything else starts on 13 May 2027.

The November 2026 stage is narrower than the headlines suggest. It brings in Rule 4, which lets companies apply to the Data Protection Board to be registered as Consent Managers: regulated intermediaries that help a person give, review and withdraw consent across the businesses that hold their data. It also brings in the two Act provisions that support that registration. It does not bring in the notice, consent, security, breach, retention, children's data or penalty provisions. Those start in May 2027, and no penalty can be imposed before then.

Three things matter for a business reading this today.

• Nothing in the Rules makes it compulsory to join a Consent Manager.
• The big deadline is 13 May 2027. That is when the Rules on notice, security safeguards, breach reporting, erasure, children's data and Significant Data Fiduciaries apply, and when penalties of up to ₹250 crore become available.
• The regulator is not yet fully in place. As of the latest sources we found (late September 2026), the Data Protection Board had been legally established but no Chairperson or Members had been announced, and the standards a Consent Manager must meet had not been published.

The practical advice: do not rush into Consent Manager integrations, and do not treat November as the compliance deadline. Use the months to May 2027 to build the notice, breach, retention and rights processes the Rules require.

Current to 4 October 2026.