The Digital Personal Data Protection Act, 2023 (DPDPA), together with the Digital Personal Data Protection Rules, 2025 (DPDP Rules), establishes India’s first comprehensive statutory framework governing the collection, processing, storage, and transfer of digital personal data (Ministry of Electronics & Information Technology, 2025). The framework is implemented in three phases: the Consent Manager Framework under Rule 4 becomes operational on 13 November 2026, with full substantive compliance across remaining obligations due by 13 May 2027.
The November 2026 deadline constitutes Phase II implementation and is the first operational milestone requiring concrete technical and infrastructural modification by organizations processing personal data. Unlike Phase I, which established institutional infrastructure, Phase II introduces functional intermediary infrastructure that directly affects data processing operations across sectors.
1. Regulatory Context: The DPDPA Implementation Timeline
The DPDP Rules implement the DPDPA through a structured three-phase approach, providing organizations an extended implementation period with clear milestones. Phase I (13 November 2025) established institutional infrastructure, including the constitution of the Data Protection Board of India (DPBI). Phase II (13 November 2026) operationalizes the Consent Manager registration framework under Rule 4; the central government is expected to operationalize the framework between June and August 2026, enabling Data Principals to manage, review, or withdraw consent across multiple services through interoperable platforms. Phase III (13 May 2027) activates all substantive obligations, including notice requirements, consent mechanisms, security safeguards, breach notification protocols, and data subject rights mechanisms.
November 2026 is expected to mark the end of the initial soft enforcement phase, with the DPBI transitioning from compliance guidance toward active supervision and enforcement (India Briefing, 2026); the preceding period therefore constitutes a critical window for infrastructure development.
2. The Consent Manager Framework: Regulatory Architecture and Institutional Design
2.1 Definition and Scope
A Consent Manager constitutes a specifically regulated intermediary category established under Sections 6(7) to 6(9) of the DPDPA and Rule 4 of the DPDP Rules 2025 (Ministry of Electronics & Information Technology, 2025). A Consent Manager operates as a DPBI-registered intermediary platform that enables individuals to manage their consent across multiple organizations from a single interface. The architecture departs from traditional models by creating a distinct regulatory class of intermediary whose primary function centers on consent intermediation, rather than positioning consent management as a subsidiary responsibility of Data Fiduciaries. Consent Managers are accountable directly to the Data Principal and must maintain interoperability, ensuring individuals are not locked into a single platform.
2.2Eligibility Requirements for Consent Manager Registration
Entities seeking registration must satisfy financial, technical, and governance thresholds. Applicants must be companies incorporated in India with a minimum net worth of INR 2 crore. The interoperable platform must meet the data protection standards and assurance framework published by the Board and implement adequate safeguards for the personal data processed through it; technical standard certifications such as ISO 27001 or SOC 2 are expected to be required as supporting documentation. Applications must include corporate documents, financial statements, technical specifications of the platform, independent certification reports, and details of directors and Key Managerial Personnel. These criteria ensure that only entities possessing requisite financial stability, technical capability, and governance infrastructure may operate as intermediaries in the consent ecosystem.
2.3Core Functions of Consent Managers
Consent Managers perform four primary functions. First, consent capture and recording: enabling Data Principals to communicate consent decisions through a standardized interface, with comprehensive documentation of the time, manner, and scope of authorization. Second, consent lifecycle management: facilitating modification and withdrawal of consent, with immediate propagation of changes to affected Data Fiduciaries. Third, interoperability: allowing a Data Principal to grant, modify, or withdraw consent across numerous organizations without platform-specific constraints. Fourth, record retention: maintaining auditable records of all consent transactions, with cryptographic proof and audit trails, for at least seven years.
3. Data Fiduciary Obligations and Consent Manager Integration
3.1The Consent Integration Mandate
The regulatory framework does not render Consent Manager participation voluntary. Every Data Fiduciary relying on consent as the lawful basis for processing must integrate with registered Consent Managers, a mandatory operational requirement for most organizations processing personal data of Indian residents. Integration requires application programming interfaces (APIs) capable of receiving, processing, and acting upon consent signals transmitted through Consent Manager platforms.
3.2Technical Requirements for Data Fiduciaries
Organizations must build or update API infrastructure to receive consent signals, record them accurately, and act on withdrawals without delay, with records retained for seven years (Progressive, 2026). Real-time consent enforcement is required at the authorization layer; batch synchronization architectures create a direct compliance gap under the DPDP withdrawal standard. Withdrawal acknowledgment mechanisms must confirm receipt of withdrawal instructions and confirm execution of data deletion or processing cessation within defined timeframes. Data Fiduciaries must also maintain logs of all consent-related transactions, including timestamps, consent status changes, and processing activities under recorded consents, accessible for regulatory inspection.
3.3Interoperability Requirements
The regulatory framework emphasizes interoperability to prevent vendor lock-in and ensure that Data Principals retain genuine choice in consent platforms. Consent Managers are prohibited from sub-contracting or assigning their core obligations to any other entity, establishing direct accountability. Data Fiduciaries must implement architectures capable of integrating with multiple Consent Manager platforms simultaneously, so that a Data Principal may select from multiple providers without separate integration infrastructure for each.
3.4Cross-Border Data Transfer Considerations
The DPDPA does not mandate absolute data localization but imposes conditions upon cross-border processing of consent records. Storage or processing outside India must provide an equivalent level of protection and maintain lawful accessibility for Indian regulators; consent logs or audit trails hosted in a jurisdiction that refuses lawful access may render the Consent Manager non-compliant and subject to suspension or cancellation of registration.
4. Implementation Timeline and Critical Milestones
4.1Pre-Registration Phase (September–October 2026)
Organizations must finalize technical architecture specifications and API design; complete data mapping and identification of consent-dependent processing streams; implement audit logging infrastructure and consent record retention systems; establish secure channels for receiving and implementing Consent Manager instructions; and complete security assessments and certifications such as ISO 27001, SOC 2, or equivalent. Delays in these activities create cascading compliance risk across subsequent phases.
4.2. Consent Manager Registration (13 November 2026)
Registration with the DPBI begins on 13 November 2026, with the Board’s portal expected to go live well before the deadline. Given the INR 2 crore net worth threshold, the expected need for technical certifications, and the governance requirements, organizations that delay preparation may face challenges in meeting eligibility criteria in time.
4.3 Integration and Operational Readiness (November 2026 – May 2027)
Enterprises that need to integrate must begin API-level development work by 13 November 2026, not after it. Organizations must integrate with registered Consent Manager platforms, test the accurate receipt and implementation of consent signals, configure authorization layers for real-time consent enforcement, and establish monitoring systems to detect and respond to consent withdrawal instructions. This phase should not be deferred until after the November deadline, as the May 2027 compliance date approaches rapidly thereafter.
4.4. Full Compliance (13 May 2027)
Full substantive compliance across all remaining obligations is due by 13 May 2027, at which point all notice, consent, security, breach reporting, and data subject rights obligations become enforceable. This represents the final compliance milestone, with no extension provisions anticipated.
5. Compliance Obligations and Operational Requirements
5.1 Consent Record Retention
Consent Managers must retain consent records for at least seven years. Data Fiduciaries must maintain corresponding records documenting the basis upon which processing activities proceeded, the consent authorizations pursuant to which such processing occurred, and the dates upon which consent was obtained, modified, or withdrawn. This extended retention period enables regulatory inspection, individual rights claims, and forensic investigation.
5.2. Immediate Notice of Consent Changes
Any consent or withdrawal must be immediately communicated to relevant Data Fiduciaries through secure, authenticated channels. Consent Managers should design webhook-based notification systems with retry logic, maintain delivery acknowledgements from fiduciaries to close the transaction loop, and adopt asynchronous queues to handle large volumes safely. Organizations must therefore implement event-driven architectures capable of processing notification events as they occur, since the immediacy requirement excludes periodic batch notification.
5.3. Data Minimization and Processing Limitation
Organizations face compliance deadlines requiring redesign of consent workflows, implementation of the Consent Manager interface, and deployment of automated data minimization and erasure systems. Processing activities must be audited to identify those dependent upon consent as a legal basis and must cease immediately upon consent withdrawal, without manual intervention.
5.4. Governance and Audit Requirements
Significant Data Fiduciaries, defined as organizations processing personal data at scale, must commission annual Data Protection Impact Assessments covering consent workflows, authorization enforcement, and withdrawal processing. Independent audits require embedding privacy-by-design principles and robust audit trails, while the mandatory one-year retention of logs for security purposes demands architecture ensuring traceability and rapid breach response.
6. Regulatory Penalties and Enforcement Framework
The DPDPA establishes a tiered penalty framework applicable to non-compliance with Consent Manager obligations, with penalties reaching INR 250 crore per violation and no indication of an extended grace period. Operating as an unregistered Consent Manager after 13 November 2026 without DPBI registration constitutes a violation of Section 6(9) of the Act, falling in the residual penalty tier of the Act’s Schedule, with penalties up to INR 50 crore per instance. Organizations processing multiple categories of personal data across multiple processing streams face cumulative penalty exposure, potentially exceeding INR 650 crore. Organizations that have not completed Consent Manager integration by the November deadline face immediate enforcement risk.
7. Organizational Readiness and Critical Implementation Priorities
DPDP consent manager enterprise compliance is no longer a planning exercise; for enterprises processing personal data of Indian residents at scale, 2026 is the critical build year. The registration deadline operates as a hard constraint: November 2026 is the date upon which Consent Manager infrastructure becomes operational, with no provision for extension.
Identity infrastructure programs, which affect how consent is captured, stored, enforced, and linked to Data Principal rights, typically take 12 to 18 months to implement; organizations have therefore entered the critical implementation window, requiring proportionate resource allocation as a business-critical initiative.
Organizations must also assess whether existing integration partners, service providers, and subsidiaries have independently commenced Consent Manager integration efforts. Because every Data Fiduciary must integrate with Consent Managers, data processing chains spanning data controllers, processors, and sub-contractors must each implement compatible integration architecture, creating supply-chain compliance dependencies that must be actively managed.
8. Practical Implications for Data Fiduciaries
Data Fiduciaries should undertake comprehensive data mapping to identify processing activities dependent upon consent as a legal basis, consent being the primary legal basis for most commercial data processing in India. Existing consent capture mechanisms, including website privacy policies, application permission flows, and contractual consent provisions, must then be audited against DPDP requirements.
Technical architecture assessment requires evaluating whether existing Customer Identity and Access Management (CIAM) systems, consent management platforms, and authorization enforcement architectures can integrate with Consent Manager APIs and enforce real-time consent withdrawal. Legacy systems predicated upon periodic batch synchronization or manual consent reconciliation cannot satisfy DPDP requirements, and significant infrastructure modernization may be necessary.
Legacy data management constitutes a key compliance focus during the implementation period. Personal data collected prior to the DPDP framework must be supported by valid notice and consent mechanisms consistent with the requirements of the Act and Rules. Individuals from whom data was collected prior to the Act’s enactment must receive compliant notices and the opportunity to provide renewed consent before processing continues under DPDP authority.
Conclusion
The operationalization of the Consent Manager Framework on 13 November 2026 marks a regulatory transition of significant operational consequence for Indian organizations processing personal data. Unlike institutional requirements confined to the regulatory apparatus, the Consent Manager framework imposes direct technical, operational, and governance modifications upon Data Fiduciaries themselves. The registration framework opens in November 2026, with API development work requiring commencement at that date, not after it. Organizations that defer implementation until after November 2026 encounter compressed timelines extending to the May 2027 Phase III compliance deadline and face heightened compliance risk.
The framework reflects deliberate choices prioritizing Data Principal agency, interoperability, and verifiable consent documentation over organizational convenience or legacy system preservation; organizations must commence infrastructure assessment, technology selection, and development immediately to ensure readiness before the deadline, given potential penalties reaching INR 250 crore per violation category.
Author : Ketan Joshi, Associate Partner
Co-Author : Khyati, Intern
References
- AMLegals. (2026). Consent manager under DPDPA: Registration, obligations & architecture. https://amlegalsdpdpa.com/consent-manager-dpdpa
- Candour Legal. (2026, July 16). DPDP consent managers: A November 2026 deadline, but no regulator yet. https://candourlegal.com/dpdp-consent-manager-framework-2026/
- ConsentOS. (2026). Consent manager registration: Nov 2026 deadline. https://consentos.in/learn/consent-manager-role/
- DPDP Education. (2026). Rule 4: Registration and obligations of consent manager. https://dpdpaedu.org/docs/DPDPA Rules/Registration and Obligations of Consent Manager/
- Digio. (2026, June 24). DPDP consent management: What every data fiduciary must know in 2026. https://www.digio.in/blog/dpdp-consent-management-what-every-data-fiduciary-must-know-in-2026/
- Fisher Phillips LLP. (2026, February 25). India’s new data privacy rules are here: 8 steps for businesses as key compliance deadlines approach. https://www.fisherphillips.com/en/insights/insights/indias-new-data-privacy-rules-are-here
- GotTrust. (2025, December 12). The complete guide to automated consent lifecycle management under the DPDP Act and Rules. https://www.gotrust.tech/blog/the-complete-guide-to-automated-consent-lifecycle-management-under-the-dpdp-act-and-rules
- India Briefing. (2026, May 11). India’s DPDP compliance timeline: Enforcement 2026-27. https://www.india-briefing.com/news/india-dpdp-compliance-timeline-enforcement-2026-27-44740.html/
- Ministry of Electronics & Information Technology. (2025). Digital Personal Data Protection Rules, 2025 (Gazette Notification G.S.R. 846(E), November 13, 2025). Government of India.
- OpenIAM. (2026, July 16). India’s DPDP Act is now operational: What enterprises need to have in place before the consent manager deadline. https://www.openiam.com/blog/dpdp-act-consent-manager-enterprise-readiness
- Privy by IDFY. (2026, July 4). DPDP compliance guide 2026: Requirements & deadlines. https://www.privybyidfy.com/blog/dpdp-compliance-guide-2026-what-indian-enterprises-must-do-before-may-2027
- Privacy Global. (2026, May 12). DPDP consent manager registration: Complete guide. https://www.privacyglobal.org/blog/dpdp-act-consent-manager-registration
- Progressive. (2026, April 7). DPDP rules 2025 explained for data fiduciaries. https://www.progressive.in/blog/dpdp-rules-2025-explained/
- Sansa Legal. (2026). How to comply with DPDPA rules before the November 2026 phase 2 deadline. https://www.sansalegal.com/post/how-to-comply-with-dpdpa-rules-before-the-november-2026-phase-2-deadline
- Scrut. (2026, May 29). India’s DPDP rules 2025: A practical guide with implementation checklist. https://www.scrut.io/post/dpdp-rules
- Tsaaro. (2025). Consent managers under the DPDP Act and DPDP Rules, 2025: Functions, obligations, and governance. https://tsaaro.com/blogs/consent-managers-under-the-dpdp-act-and-dpdp-rules-2025-functions-obligations-and-governance
- Vinsys. (2026, June 24). DPDP act compliance deadline 2026: What Indian enterprises must do now. https://www.vinsys.com/blog/dpdp-act-compliance-deadline-nov-2026-for-consent-manager
FAQs
What is the DPDP Act and what does it do?
The Digital Personal Data Protection Act, 2023 (DPDPA), together with the DPDP Rules, 2025, is India's first comprehensive law governing how digital personal data is collected, processed, stored, and transferred. It gives individuals greater control over their data and places clear obligations on organizations that handle that data.
What is a Consent Manager?
A Consent Manager is a company registered with the Data Protection Board of India that runs an intermediary platform through which individuals (Data Principals) can give, review, modify, or withdraw their consent across many organizations from a single interface. It performs four core functions: capturing consent, managing its lifecycle, ensuring interoperability between platforms, and keeping auditable records.
Does every company have to become a Consent Manager?
No. Becoming a Consent Manager is optional and open only to eligible companies. However, every Data Fiduciary that relies on consent as the lawful basis for processing must integrate with registered Consent Managers, so the framework is effectively mandatory for most organizations processing personal data of Indian residents.
Who is eligible to register as a Consent Manager?
Applicants must be companies incorporated in India with a minimum net worth of INR 2 crore, and their platform must meet the data protection standards and assurance framework published by the Board. Technical certifications such as ISO 27001 or SOC 2 are expected to be required as supporting documentation.
What are the key deadlines to remember?
The Consent Manager registration framework becomes operational on 13 November 2026, and all remaining substantive obligations must be complied with by 13 May 2027. The government is expected to operationalize the framework between June and August 2026, so preparation should begin well before the November deadline
What happens if a company does not comply?
Penalties can reach INR 250 crore per violation, with no indication of an extended grace period. Operating as an unregistered Consent Manager after 13 November 2026 attracts penalties of up to INR 50 crore per instance, and organizations running multiple processing streams face cumulative exposure potentially exceeding INR 650 crore.
