Privacy & data protection
DPDP Rules: Consent Manager Provisions Commence in November 2026
One year after India notified the DPDP Rules 2025, Rule 4 on Consent Managers comes into force. Core Data Fiduciary obligations follow eighteen months after publication, in May 2027.
What is happening?
Rule 1 of the Digital Personal Data Protection Rules, 2025 brings the Rules into force in stages, measured from their publication in the Official Gazette on 13 November 2025:
| Phase | Commencement | Rules |
|---|---|---|
| 1 | On publication | Rules 1, 2 and 17–21: the Data Protection Board and appeals |
| 2 | One year after publication (November 2026) | Rule 4: Consent Managers |
| 3 | Eighteen months after publication (May 2027) | Rules 3, 5–16, 22 and 23: Data Fiduciary obligations |
Why does it matter?
Consent Managers are registered intermediaries through which individuals can give, manage, review and withdraw consent across services. Their commencement is the first operational step beyond the Board, and a signal that the main compliance date is now about seven months away.
What should you do?
Organisations should be well into data mapping, notice and consent redesign, security safeguards (including one-year log retention), breach playbooks with 72-hour Board reporting, and processor contract updates. See our DPDP Act guide and the breach notification comparison.
What to watch
- Data Protection Board processes for registering Consent Managers.
- Notifications designating Significant Data Fiduciaries, or restricting cross-border transfers.
- Sector regulator guidance aligning RBI, SEBI and IRDAI requirements with the DPDP regime.
Sources and official references
- Digital Personal Data Protection Rules, 2025 — official text — MeitY (official source)
- Gazette of India (Extraordinary) — DPDP Rules, 2025 — Government of India eGazette (official source)
- DPDP Rules, 2025 notified — explanatory note — Press Information Bureau (official source)
Links go to the publisher's own site. Where a standard is sold or copyrighted, MajorCyber™ summarises it in original words and links to the official listing instead of reproducing its text.
Listen to this page
Read aloud in UK English by your own device. Nothing is sent anywhere, and the voice is whichever one your browser provides.
General educational information, not legal or professional advice. Check the official sources and take qualified advice before acting.
