DPDP Rules 2026: What India's November 13 Consent Manager Deadline Actually Means for You

On November 13, 2026, a part of India's data protection law changes for the first time since it was notified a year ago — but if you are an ordinary app user or a small business owner, almost nothing changes for you on that date. What actually comes into force is Rule 4 of the Digital Personal Data Protection (DPDP) Rules, 2025, which opens the registration window for a new category of regulated entity called a "Consent Manager." It is a narrow, technical milestone, not the start of new privacy obligations for most companies or new consent pop-ups for most users — and several compliance firms have been overstating it as a hard deadline for everyone.

What actually happens on November 13, 2026

The DPDP Rules were notified by the Ministry of Electronics and Information Technology (MeitY) through Gazette notification G.S.R. 846(E), with the government's own press note dated November 2025 confirming the rules had been finalised. The Rules commence in three separate phases rather than all at once, according to law firms King Stubb & Kasiva and Mondaq, which both cite the same gazette text:

• November 13, 2025: Rules 1, 2 and 17 to 21 took effect immediately — these set up the Data Protection Board of India (DPBI), the body that will eventually hear complaints and levy fines.
• November 13, 2026 (this deadline): Rule 4 takes effect, opening registration for Consent Managers under the law's First Schedule.
• May 13, 2027: Rules 3, 5 to 16, 22 and 23 take effect — this is when the substantive obligations most people associate with a privacy law actually begin, covering notice, consent, data retention, children's data, security safeguards and data principal rights.

What a Consent Manager actually is

A Consent Manager is a registered intermediary that gives a person a single dashboard to see, grant, modify or withdraw the consent they have given to different companies for use of their personal data, instead of managing separate permissions inside every app. To qualify, an entity must be an Indian-incorporated company with a minimum net worth of ₹2 crore under the First Schedule, legal commentary from King Stubb & Kasiva notes. It is a model borrowed loosely from the Reserve Bank of India's Account Aggregator framework for financial data, but with an important difference: Account Aggregators are designed to be "data-blind" conduits for financial information, while Consent Managers are meant to be visible, user-facing control panels for all kinds of personal data, not just financial records.

Crucially, the November 13, 2026 date does not force every company to register as a Consent Manager or to plug into one. Law firm King Stubb & Kasiva explicitly cautions against reading it as "a blanket requirement for every business." It simply means the Data Protection Board can start accepting and approving applications from firms that want to operate as Consent Managers — a specialised business line, not a universal compliance task.

Why the Data Protection Board itself is still catching up

One reason the November milestone is lower-stakes than it sounds: the body meant to administer it is still being staffed. The DPBI was legally constituted in November 2025, but compliance tracking from Ampcus Cyber shows MeitY only invited applications for the Board's Chairperson and four Member posts in May 2026. A regulator still filling its own leadership seats is unlikely to process a flood of Consent Manager registrations overnight.

What's actually at stake by May 2027

The bigger changes, and the ones that will be visible to ordinary users, are scheduled for May 13, 2027. Law firm SS Rana & Co. lays out specifics from the Rules: companies must report a data breach to the Board within 72 hours describing its nature, extent, timing and likely impact; must respond to a user's request to access, correct or erase their data within 90 days under Rule 14(3); and must retain personal data and processing logs for at least a year after a stated purpose is fulfilled before erasing it, unless another law requires longer. Processing a child's data will require verifiable parental or guardian consent under Section 9, and behavioural tracking or targeted advertising aimed at children will be barred outright, with a narrow carve-out allowing real-time location tracking only for a child's own safety.

Penalties under the parent DPDP Act, 2023 itself — summarised in a Press Information Bureau-sourced explainer republished by Drishti IAS — are tiered: up to ₹250 crore for failing to maintain reasonable security safeguards, up to ₹200 crore for not reporting a breach or for violating child-data rules, and up to ₹50 crore for other violations. These are the figures companies are actually bracing for, and they apply from the May 2027 date, not November 2026.

What it means for you

If you use apps, banking services or e-commerce platforms in India, you will not see a new consent screen on November 13, 2026 because of this law. What you can expect, gradually and starting from around mid-2027, is companies rolling out clearer, plain-language notices explaining exactly what data they collect and why; a formal 90-day window in which a company must act if you ask it to access, correct or delete your data; stricter rules around any service aimed at children, including parental consent checks; and, eventually, the option to manage consent for multiple services through a single approved Consent Manager dashboard rather than hunting through each app's settings separately.

If you run a business that collects personal data, the practical task right now is not registering as a Consent Manager — that only matters if you specifically want to operate one. The more useful step is auditing what personal data you hold and mapping it against the notice and consent requirements due by May 2027, while watching the Data Protection Board's website as its leadership is appointed. Significant Data Fiduciaries — large platforms designated by the government based on data volume and sensitivity — face extra obligations, including an India-based Data Protection Officer, an independent data auditor, and closer scrutiny of any algorithmic tools they use to process personal data.

In short: November 13, 2026 opens a door for a small category of specialised companies to register as Consent Managers. It is not the date India's privacy law starts affecting your everyday apps — that is May 13, 2027.

Sources: Press Information Bureau, Government of India; King Stubb & Kasiva; Mondaq; SS Rana & Co.; Ampcus Cyber; Drishti IAS.