•
•
•
•
•
•
•
Phase two of India's data protection rules starts in three weeks. Here's what a Consent Manager is, who can become one and what changes for apps and websites.
From 13 November 2026, India's Consent Manager framework under the DPDP Rules, 2025 comes into effect. A Consent Manager is a company registered with the Data Protection Board of India that gives you one dashboard to grant, review and withdraw consent you've given to different apps and businesses. This is the second of three phases; most remaining duties for businesses (notices, security safeguards, breach reporting and user rights) take effect on 13 May 2027.
This article is general information, not legal advice. Businesses should consult counsel on their specific obligations.
The Ministry of Electronics and Information Technology (MeitY) notified the DPDP Rules on 13 November 2025 and staggered them so businesses had time to prepare.
| Phase | Date | What starts |
|---|---|---|
| I | 13 Nov 2025 | Data Protection Board of India constituted; institutional provisions |
| II | 13 Nov 2026 | Consent Manager registration and obligations |
| III | 13 May 2027 | Notice, consent, security safeguards, breach notification, data principal rights, children's data rules and most remaining duties |
So November 2026 is a milestone, but it is not the date full compliance kicks in.
Think of it as a neutral middle layer between you (the Data Principal) and companies that use your data (Data Fiduciaries).
Without a Consent Manager, you give consent separately inside every app, often buried in long policies. With one, you could:
The DPDP Act (Section 6) already allows this. The Rules now set out who can do it and how.
Based on the conditions in the DPDP Rules, an applicant must broadly:
Registration is with the Board, which can also suspend or cancel it.
Even though the heaviest duties land in May 2027, companies that rely on consent should use the next few months well.
The Schedule to the DPDP Act sets maximum penalties by type of breach. The highest is up to ₹250 crore for failing to take reasonable security safeguards to prevent a personal data breach. Other categories carry lower caps. The Board decides penalties case by case, considering factors such as the nature, gravity and duration of the breach.
Some law-firm commentaries have also discussed specific penalties for unregistered Consent Managers. Businesses should rely on the text of the Act and Rules rather than estimates in secondary articles.
In the short term, probably not much that you'll notice on 13 November. As Consent Managers register and connect with apps, you may start seeing options like "Manage consent via [platform name]". Over time, this should make it easier to:
Your full rights — such as asking a company what data it holds about you, correcting it, or nominating someone to act on your behalf — become enforceable from May 2027.
Is the DPDP Act fully in force now?
No. It is being phased in. Phase II starts on 13 November 2026, and most remaining obligations start on 13 May 2027.
Do I have to use a Consent Manager?
No. It's an option for users. Businesses still have to manage consent properly whether or not a user comes through a Consent Manager.
Can a foreign company be a Consent Manager?
The Rules require a company incorporated in India.
Who enforces the law?
The Data Protection Board of India, which can inquire into complaints and impose penalties.
Does this replace the IT Act rules on data?
The DPDP Act is now the main law for digital personal data. It amended the earlier provisions on sensitive personal data under the IT Act.
13 November 2026 is the day India's consent infrastructure starts to take shape. It doesn't finish the job — May 2027 does — but it is the right moment for businesses to clean up their consent flows, and for users to start paying attention to who they're saying "I agree" to.
