Designed by Magnific
| Type | Update |
|---|---|
| Practice group | Information Technology and Artificial Intelligence |
| Publication date | 10 November 2026 |
| Authors | Shrishti Sharma and Tushar Todi |
| Law as at | 30 October 2026 |
What changes on 13 November 2026
Rule 4 of the Digital Personal Data Protection Rules, 2025 (‘DPDP Rules’ or ‘Rules’) comes into force on 13 November 2026, one year after the Rules were notified. From that date, a person that wishes to act as a consent manager under the Digital Personal Data Protection Act, 2023 (‘DPDP Act’ or ‘Act’) can apply to the Data Protection Board of India (‘Board’) for registration. Section 6(9) of the Act, which requires consent managers to be registered with the Board, takes effect on the same date.
A consent manager is a person who acts as a single point of contact, through an interoperable platform (website or app), to enable an individual (Data Principal) to give, manage, review and withdraw consent for the processing of their personal data across different businesses. It owes its duties to the individual, in a fiduciary capacity.
Please note that the notification does not state the date of 13 November 2026. G.S.R. 843(E) and Rule 1 of the DPDP Rules (as corrected by G.S.R. 892(E)) give only the period, one year from publication, and the calendar date above is computed accordingly, however some commentators arrive at the 14th November. In our view, it is prudent to work with the 13th.
Who can register
The First Schedule to the Rules sets the conditions. An applicant must:
- be a company incorporated in India, with a net worth of at least ₹2 crore;
- have sufficient technical, operational and financial capacity, and directors, key managerial personnel and senior management of the applicant company should be individuals with a general reputation and record of fairness and integrity;
- have its interoperable platform independently certified against the Board’s standards; and,
- include provisions in its constitutional documents to avoid conflict of interest with Data Fiduciaries and to have in place measures to ensure that no conflict of interest arises on account of its directors, key managerial personnel and senior management holding a directorship, financial interest, employment or beneficial ownership in Data Fiduciaries, or having a material pecuniary relationship with them.
Once registered, a consent manager cannot subcontract or assign its obligations, and its platform must not allow it to read the personal data passing through it. It must keep records of consents given, denied and withdrawn for at least seven years, and needs the Board’s prior approval for any change of control. The Board may suspend or cancel its registration.
What it means for other businesses
Businesses that process personal data, referred to in the Act as Data Fiduciaries, are not required to use Consent Managers. Their consent obligations, including the right of individuals to act through a Consent Manager, apply from 13 May 2027, when the remaining provisions of the Act and the Rules come into force.
November 2026 is therefore principally a date for companies seeking registration as Consent Manager. For other businesses, it offers early sight of the consent managers that customers can use to share data held elsewhere with them from May 2027.
What to do now
Companies planning to register should test their net worth, platform certification and constitutional documents against the First Schedule to the Rules before applying. Item 6 of Part A of the First Schedule also requires that the applicant’s directors, key managerial personnel and senior management are “individuals with a general reputation and record of fairness and integrity”. Neither the Rules nor the Data Protection Board has said what this means or how it should be evidenced. Until they do, the fit and proper person test in Schedule II of the SEBI (Intermediaries) Regulations, 2008 is a useful reference point. Applicants could obtain signed declarations from each individual, check DIN status and section 164 disqualifications on the MCA portal, and run litigation, regulatory action and economic offence searches in each jurisdiction where the individual has lived or worked. These steps are not prescribed, and the checks should continue after registration, since rule 4(5) allows the Board to suspend or cancel a registration in the interests of Data Principals.
Data fiduciaries should identify where and how they collect consent, decide whether to accept consent given through registered consent managers, and review any agreements with platforms that will handle consent on their behalf, so that these are in place before May 2027.
Shrishti Sharma (Ms.) and Tushar Todi (Mr.)
Shrishti Sharma (Ms.)
