Overview: The Digital Personal Data Protection (DPDP) framework is entering its next implementation phase, with the Consent Manager provisions taking effect on November 13, 2026. The framework creates a regulated role for eligible companies that manage consent on behalf of individuals. For other businesses, the more significant compliance milestone is May 13, 2027, when the wider set of operational provisions begins to apply. Early preparation can help businesses organise their data, contracts and privacy processes before these requirements take effect.
The Digital Personal Data Protection framework is moving from legislation towards practical implementation. From November 13, 2026, Rule 4 of the DPDP Rules, 2025, will take effect and provide the framework for Consent Manager registration.
This creates a specific business opportunity for companies offering privacy and data-management services. At the same time, businesses that collect or process personal data need to understand that becoming a Consent Manager is not a general compliance requirement.
The wider compliance work for Data Fiduciaries will become relevant from May 13, 2027. This gives businesses a limited period to review their data practices and put the required systems and documentation in place.
Consent Manager Registration
A Consent Manager is designed to provide individuals with a platform through which they can give, manage, review and withdraw consent for the processing of their personal data.
The notified Rules set specific conditions for registration. The applicant must be a company incorporated in India, have adequate technical, operational and financial capacity, maintain a sound financial condition and have a minimum net worth of ₹2 crore. Its platform must also meet prescribed data protection and technical standards.
The role carries continuing obligations. These include maintaining records of consent and data sharing, protecting personal data, managing conflicts of interest and meeting the requirements prescribed by the Data Protection Board.
A business using consent-management software for its own operations does not become a Consent Manager merely by using that technology.
What Privacy-Tech Businesses Need to Assess
For a startup considering this regulated business, registration is only one part of the exercise.
The company should assess:
- Whether its existing corporate structure is suitable for the regulated activity.
- Whether it meets the ₹2 crore net-worth and other eligibility conditions.
- Whether its technology platform can meet the required standards.
- How consent records and data-sharing records will be maintained.
- How conflicts of interest and independence will be managed.
- Whether its contracts, privacy policies and internal governance processes support the new role.
The Rules also give the Board powers relating to the oversight of Consent Managers, including audit, corrective directions and suspension or cancellation of registration in specified circumstances.
What Other Businesses Should Do Before May 2027
For most startups, MSMEs and other businesses, November 2026 is not the general DPDP compliance deadline.
The wider implementation phase begins on May 13, 2027 – 18 months after the Rules were notified. Businesses should use the available time to identify the personal data they collect, understand why they process it and review how that data moves through their systems and vendors.
They should also review consent mechanisms, privacy notices, contracts with data processors, data-retention practices and internal responsibility for privacy compliance.
The Data Protection Board of India was formally established on November 13, 2025. The Ministry of Electronics and Information Technology (MeitY) has subsequently initiated the process for appointing its Chairperson and four Members. This distinction matters because the Board’s legal establishment and its continuing operationalisation are separate aspects of the implementation process.
Why DPDP Preparation Needs Business Planning
DPDP compliance should not be treated as a software purchase alone. Data mapping, consent records, vendor arrangements, contracts and internal accountability need to work together.
For privacy-tech companies, the November milestone requires a decision on whether to enter a regulated business and whether their existing structure and systems are ready for it.
For other businesses, the priority is to prepare their data-governance framework before the wider obligations take effect.
FAQs
No. The November 2026 milestone relates primarily to the Consent Manager provisions. The wider operational provisions begin from May 13, 2027.
No. Registration is relevant to companies intending to operate as Consent Managers. Other businesses can manage consent as part of their own DPDP compliance framework.
Businesses should review personal-data flows, consent processes, privacy notices, data-processing contracts, vendors, retention practices and internal governance responsibilities.
SetIndiaBiz Support
SetIndiaBiz supports startups, MSMEs and other businesses in preparing for DPDP compliance through practical corporate, contractual and documentation support. Our services can include DPDP readiness assessments, personal-data and consent-process reviews, third-party data-processing checks, privacy documentation, contractual responsibility reviews and data-governance frameworks.
Privacy-tech companies considering Consent Manager registration, can seek SetIndiaBiz support for corporate structuring, eligibility review, regulatory documentation and compliance planning before entering this specialised business.
Early preparation can help businesses address their data-governance gaps and build a documented compliance framework before the wider DPDP requirements take effect.
The November 13, 2026 Consent Manager milestone is an important step in the DPDP implementation process. It creates a specialised regulated opportunity for eligible privacy-tech companies while giving other businesses a clear signal to begin their wider compliance preparation.
Businesses should start with their data, contracts, vendors and governance structure, rather than waiting for the May 2027 deadline.
