Consent Managers

DPDP Consent Managers: What Changes on 13 November 2026

By Kaivan Tech · Published 4 November 2026 · Updated 4 November 2026 · Checked against the official Act and Rules

Short answer

A Consent Manager is a company registered with the Data Protection Board of India that gives people a single, interoperable platform to give, manage, review and withdraw consent across businesses. Rule 4 of the DPDP Rules, 2025, which sets how Consent Managers register and what they must do, comes into force on 13 November 2026.

In force from: 13 November 2026 (Rule 4)
Registered with: The Data Protection Board of India
Must be: A company incorporated in India with net worth of at least ₹2 crore
Main DPDP deadline: Still 13 May 2027 for most business obligations

What a Consent Manager does

The Act defines a Consent Manager as a person registered with the Board who acts as a single point of contact so a Data Principal can give, manage, review and withdraw consent through an accessible, transparent and interoperable platform (Section 2(g)). Instead of hunting through every company’s settings, a person can see and change their consents in one place.

Who can become a Consent Manager

Part A of the First Schedule to the Rules sets the registration conditions. Among them:

The applicant is a company incorporated in India
It has sufficient technical, operational and financial capacity
Its net worth is not less than ₹2 crore
Its directors and key managerial personnel have a general reputation for fairness and integrity
Its platform has been independently certified against the Board’s interoperability and data protection standards

Does my business have to use a Consent Manager?

No. 13 November 2026 is when the Consent Manager framework starts, not a deadline for every business. You can keep collecting consent directly. But your consent records must be able to work with a Consent Manager when a Data Principal uses one, and your core consent, notice and withdrawal obligations apply from 13 May 2027.

What to change in your website and app now

Record consent per purpose, with the notice version shown, timestamp and source
Make withdrawal as easy as giving consent, as Section 6(4) and Rule 3 require
Stop bundling: consent must be limited to data necessary for the stated purpose (Section 6(1))
Expose consent status through an API or admin view so a future Consent Manager integration is an integration, not a rebuild

Need this done in your own systems?

Kaivan Tech assesses websites, apps and business systems against the DPDP Act and Rules, then implements the fixes: consent and notice flows, rights workflows, logging, retention and breach readiness.

See our DPDP compliance services

Frequently asked questions

What is a Consent Manager under the DPDP Act?+

A Consent Manager is a person registered with the Data Protection Board who acts as a single point of contact for individuals to give, manage, review and withdraw their consent through an accessible, transparent and interoperable platform (Section 2(g) of the DPDP Act, 2023).

When do the DPDP Consent Manager rules come into force?+

Rule 4 of the DPDP Rules, 2025 comes into force on 13 November 2026, one year after the Rules were published on 13 November 2025.

Is using a Consent Manager mandatory for businesses?+

No. Businesses may collect consent directly. A Consent Manager is an option for individuals; businesses need to be able to honour consent given or withdrawn through one.

What are the eligibility conditions for a Consent Manager?+

Under Part A of the First Schedule to the DPDP Rules, an applicant must be a company incorporated in India with sufficient capacity, sound finances and management, a net worth of at least ₹2 crore, and an independently certified platform, among other conditions.

Related DPDP guides

Sources

This guide explains the law in general terms and is not legal advice. Have a qualified Indian legal professional confirm how the Act and Rules apply to your organisation.