Consent Manager registration opens on 13 November 2026. Here is what changes for your business.
Section 6(9) and Rule 4 commence on 13 November 2026. What a Consent Manager is, who can register, and the three things a Data Fiduciary should do now.
This post reflects the DPDP Act, 2023 and the DPDP Rules, 2025 as of its last update; the Gazette texts govern. This is informational and is not legal advice. Liability under the DPDP Act, 2023 remains with the Data Fiduciary.
Questions
Frequently asked questions
Do businesses have to use a Consent Manager under the DPDP Act?
No. Section 6(7) says a Data Principal may give, manage, review or withdraw consent through a Consent Manager. It is an option for the Data Principal, not a duty on the Data Fiduciary. Every Data Fiduciary that relies on consent must still give notice and be able to prove consent under section 6(10).
What happens on 13 November 2026 under the DPDP Act?
Rule 4 of the DPDP Rules, 2025 commences one year after the Rules were published on 13 November 2025, and section 6(9) of the Act, which requires every Consent Manager to be registered with the Board, commences the same day under G.S.R. 843(E). Applications for registration can be made from then.
Get the next one by email
New analysis when the Act, the Rules or the Board move. Once a month at most.
Six days from now, on 13 November 2026, the first part of the DPDP framework that touches consent comes into force. Section 6(9) of the Digital Personal Data Protection Act, 2023 and Rule 4 of the DPDP Rules, 2025 both commence, and companies can start applying to the Data Protection Board to be registered as Consent Managers.
The date has produced more confusion than it deserves. Here is what it does, and what it does not, change.
What a Consent Manager is
A Consent Manager is a company registered with the Board that acts as a single point of contact through which a Data Principal can give, manage, review and withdraw her consent, on an accessible, transparent and interoperable platform (Sec 2(g)). It is accountable to the Data Principal and acts on her behalf (Sec 6(8)).
In practice the model resembles India's account aggregator framework: a neutral platform the individual uses to route consent to many organisations, without reading the data that passes through it.
It is not a consent management platform
The two are easy to confuse and very different in law.
Consent Manager
Consent management platform
Works for
The Data Principal (Sec 6(8))
The Data Fiduciary that runs it
Legal status
Board-registered intermediary (Sec 6(9), Rule 4)
Software; a Data Processor where it handles personal data
Scope
One person's consents across many Data Fiduciaries
One Data Fiduciary's consents across its own channels
Required by the Act
No; the Data Principal may choose one
No; but you must prove notice and consent (Sec 6(10))
In force from
13 November 2026
The duties it supports apply from 13 May 2027
TruPriv is software of the second kind. It is not, and is not seeking to be, a registered Consent Manager.
Who can register
Under Part A of the First Schedule to the DPDP Rules, the applicant must be a company incorporated in India with a net worth of at least ₹2 crore, sound finances and management, directors of integrity, conflict-of-interest safeguards in its articles, and an independently certified interoperable platform.
The Board may inquire into an application, then register the applicant and publish its details, or reject the application with reasons (Rule 4(2)). It can later direct a Consent Manager to correct non-adherence, and suspend or cancel its registration after a hearing (Rule 4(4)–(5)).
What it means for a Data Fiduciary
Nothing changes on 13 November 2026 for a business that is not applying to be a Consent Manager. Its own duties start on 13 May 2027. Three things are worth doing now.
Decide whether you will accept consent routed through Consent Managers. If you do, your systems need to receive, store and honour those consents, and withdrawals, alongside your own.
Keep your own evidence. A Consent Manager's records serve the Data Principal. They do not discharge your burden of proof under section 6(10). The consent notice guide sets out what that evidence starts with.
Treat vendor claims carefully. Until the Board publishes its register, no one is a registered Consent Manager.
For the full treatment, including the Part B obligations a registered Consent Manager carries, read our Consent Manager guide. To see where your own programme stands against the Act, take the free readiness assessment.
