10 November 2026
Mono Team
Do You Need a DPDP Consent Manager? A Decision Guide for 13 November 2026
Data protection
13 November 2026 is when the rules for registering as a Consent Manager start. Here is who that affects, how to tell which of three paths is yours, and what to build either way.
Short answer: for most companies, no. 13 November 2026 is the day Rule 4 of the DPDP Rules, 2025 starts. Rule 4 lets a company apply to the Data Protection Board to be registered as a Consent Manager. It does not tell your company to register as one, or to use one.
Your main deadline is 13 May 2027. That is when the duties on notices, consent, rights requests, security, breach reporting and retention start.
What Rule 4 switches on from 13 November 2026
From 13 November 2026, a company that meets the conditions in the First Schedule to the Rules can apply to the Board for registration as a Consent Manager. The Board can register it or refuse it, and can later suspend or cancel the registration. Rule 4 is about applicants and registered Consent Managers. It places no duty on a business that simply collects personal data from its own customers or staff. Section 6(9) of the Act, which requires every Consent Manager to be registered with the Board, starts on the same date.
The DPDP Rules, 2025 were notified on 13 November 2025. Some advisers count from 14 November 2025, which moves each later date by one day. Rule 1 starts the Rules in three stages:
- 13 November 2025: Rules 1, 2 and 17 to 21. Definitions and the Data Protection Board.
- 13 November 2026: Rule 4. Registration and obligations of Consent Managers.
- 13 May 2027: Rules 3, 5 to 16, 22 and 23. Notices, security safeguards, breach reporting, retention, children's data and the other core duties.
Consent Manager vs consent management platform
The two names sound alike and mean different things.
A Consent Manager is a legal role. Section 2(g) of the Act defines it as a person registered with the Board who acts as a single point of contact, so that a Data Principal (the person the data is about) can give, manage, review and withdraw consent through an accessible, transparent and interoperable platform. It works for the individual, not for you. The Rules require it to act in a fiduciary capacity towards the Data Principal and to avoid conflicts of interest with Data Fiduciaries.
A consent management platform (CMP) is software. It is the banner, preference centre, SDK and consent log that a company buys or builds to capture and record consent in its own products. The Act does not define it, and nobody registers it.
We have found nothing in the Act or the Rules that requires a company to use a registered Consent Manager. Most companies will capture and record consent with a CMP, or with consent capture built into their own apps.
Who can register: the Indian company and ₹2 crore net-worth test
Part A of the First Schedule sets the conditions. The applicant must be a company incorporated in India, with a net worth of not less than ₹2 crore. Among other conditions, it must also show sound finances and management, enough technical and operational capacity, and independent certification that its platform meets the standards the Board publishes.
Being a Consent Manager is a regulated business in its own right. Part B of the same Schedule sets the obligations. A Consent Manager:
- must not be able to read the personal data that passes through its platform
- must keep records of consents given, denied and withdrawn, the notices that went with them, and data sharing, for at least seven years
- cannot sub-contract or assign its obligations
- must act in a fiduciary capacity towards the Data Principal and avoid conflicts of interest with Data Fiduciaries
- needs the Board's approval before a sale, merger or other change of control
Decision tree for data fiduciaries
Ask three questions, in order. Stop at the first yes.
1. Do you want to run a consent platform for other companies' customers?
If yes: register. You need an Indian company with a net worth of at least ₹2 crore. Rule 4 allows applications to the Board from 13 November 2026. Expect to build a platform that cannot read the data it carries, consent records kept for seven years, and audits that report to the Board. This is rare. It is a decision to enter a new business, not a compliance step.
2. Will your customers want to manage consent for many companies in one place?
If yes: plan to integrate. Once registered Consent Managers exist, you can connect to them. This is optional. Section 6(7) says a person may give, manage, review or withdraw consent through a Consent Manager. We read that as a choice for the individual, not a duty on every company to offer that route.
The engineering work is an integration. You accept consent and withdrawal events from the Consent Manager, match each one to the right person, and record it in the same consent log as everything else.
3. Neither? Build consent into your own systems.
This is most companies. You collect consent in your own app or website, so the work is your own consent capture and records, whether you buy a CMP or build it. On our reading, 13 November 2026 changes nothing for you. 13 May 2027 does.
What to build in your app now, whichever path you choose
All three paths need the same foundation. Once the consent duties start on 13 May 2027, Section 6(10) puts the burden on the Data Fiduciary: if consent is questioned in a proceeding, you have to prove that a notice was given and consent was obtained. We have found nothing that moves that burden to a Consent Manager.
Build these five things:
- Versioned notices. Keep every version of the notice text, so you can show what a person saw.
- A consent log. Who agreed, to which purpose, under which notice version, and when.
- Withdrawal that works. About as easy as giving consent, and passed on to every system and vendor that uses the data, so processing stops unless a law requires it to continue.
- One identity across systems. So a withdrawal in the app also stops the CRM and the data warehouse.
- Consent events you can extend. If you connect to a Consent Manager later, its consents land in the same log.
Where to start
If you don't yet know which systems hold personal data, start with a DPDP gap assessment. If you do, DPDP implementation covers the consent log, rights requests and retention jobs. Not sure where you stand? Take the free 2-minute DPDP self-check.
This guide covers the engineering side and is not legal advice. Our partner law firm gives the written legal opinion on how the Act applies to you.
Sources: Digital Personal Data Protection Act, 2023, Sections 2(g) and 6. Digital Personal Data Protection Rules, 2025, Rules 1 and 4 and the First Schedule. Last reviewed 10 November 2026.
Short answer: for most companies, no. 13 November 2026 is the day Rule 4 of the DPDP Rules, 2025 starts. Rule 4 lets a company apply to the Data Protection Board to be registered as a Consent Manager. It does not tell your company to register as one, or to use one.
Your main deadline is 13 May 2027. That is when the duties on notices, consent, rights requests, security, breach reporting and retention start.
What Rule 4 switches on from 13 November 2026
From 13 November 2026, a company that meets the conditions in the First Schedule to the Rules can apply to the Board for registration as a Consent Manager. The Board can register it or refuse it, and can later suspend or cancel the registration. Rule 4 is about applicants and registered Consent Managers. It places no duty on a business that simply collects personal data from its own customers or staff. Section 6(9) of the Act, which requires every Consent Manager to be registered with the Board, starts on the same date.
The DPDP Rules, 2025 were notified on 13 November 2025. Some advisers count from 14 November 2025, which moves each later date by one day. Rule 1 starts the Rules in three stages:
- 13 November 2025: Rules 1, 2 and 17 to 21. Definitions and the Data Protection Board.
- 13 November 2026: Rule 4. Registration and obligations of Consent Managers.
- 13 May 2027: Rules 3, 5 to 16, 22 and 23. Notices, security safeguards, breach reporting, retention, children's data and the other core duties.
Consent Manager vs consent management platform
The two names sound alike and mean different things.
A Consent Manager is a legal role. Section 2(g) of the Act defines it as a person registered with the Board who acts as a single point of contact, so that a Data Principal (the person the data is about) can give, manage, review and withdraw consent through an accessible, transparent and interoperable platform. It works for the individual, not for you. The Rules require it to act in a fiduciary capacity towards the Data Principal and to avoid conflicts of interest with Data Fiduciaries.
A consent management platform (CMP) is software. It is the banner, preference centre, SDK and consent log that a company buys or builds to capture and record consent in its own products. The Act does not define it, and nobody registers it.
We have found nothing in the Act or the Rules that requires a company to use a registered Consent Manager. Most companies will capture and record consent with a CMP, or with consent capture built into their own apps.
Who can register: the Indian company and ₹2 crore net-worth test
Part A of the First Schedule sets the conditions. The applicant must be a company incorporated in India, with a net worth of not less than ₹2 crore. Among other conditions, it must also show sound finances and management, enough technical and operational capacity, and independent certification that its platform meets the standards the Board publishes.
Being a Consent Manager is a regulated business in its own right. Part B of the same Schedule sets the obligations. A Consent Manager:
- must not be able to read the personal data that passes through its platform
- must keep records of consents given, denied and withdrawn, the notices that went with them, and data sharing, for at least seven years
- cannot sub-contract or assign its obligations
- must act in a fiduciary capacity towards the Data Principal and avoid conflicts of interest with Data Fiduciaries
- needs the Board's approval before a sale, merger or other change of control
Decision tree for data fiduciaries
Ask three questions, in order. Stop at the first yes.
1. Do you want to run a consent platform for other companies' customers?
If yes: register. You need an Indian company with a net worth of at least ₹2 crore. Rule 4 allows applications to the Board from 13 November 2026. Expect to build a platform that cannot read the data it carries, consent records kept for seven years, and audits that report to the Board. This is rare. It is a decision to enter a new business, not a compliance step.
2. Will your customers want to manage consent for many companies in one place?
If yes: plan to integrate. Once registered Consent Managers exist, you can connect to them. This is optional. Section 6(7) says a person may give, manage, review or withdraw consent through a Consent Manager. We read that as a choice for the individual, not a duty on every company to offer that route.
The engineering work is an integration. You accept consent and withdrawal events from the Consent Manager, match each one to the right person, and record it in the same consent log as everything else.
3. Neither? Build consent into your own systems.
This is most companies. You collect consent in your own app or website, so the work is your own consent capture and records, whether you buy a CMP or build it. On our reading, 13 November 2026 changes nothing for you. 13 May 2027 does.
What to build in your app now, whichever path you choose
All three paths need the same foundation. Once the consent duties start on 13 May 2027, Section 6(10) puts the burden on the Data Fiduciary: if consent is questioned in a proceeding, you have to prove that a notice was given and consent was obtained. We have found nothing that moves that burden to a Consent Manager.
Build these five things:
- Versioned notices. Keep every version of the notice text, so you can show what a person saw.
- A consent log. Who agreed, to which purpose, under which notice version, and when.
- Withdrawal that works. About as easy as giving consent, and passed on to every system and vendor that uses the data, so processing stops unless a law requires it to continue.
- One identity across systems. So a withdrawal in the app also stops the CRM and the data warehouse.
- Consent events you can extend. If you connect to a Consent Manager later, its consents land in the same log.
Where to start
If you don't yet know which systems hold personal data, start with a DPDP gap assessment. If you do, DPDP implementation covers the consent log, rights requests and retention jobs. Not sure where you stand? Take the free 2-minute DPDP self-check.
This guide covers the engineering side and is not legal advice. Our partner law firm gives the written legal opinion on how the Act applies to you.
Sources: Digital Personal Data Protection Act, 2023, Sections 2(g) and 6. Digital Personal Data Protection Rules, 2025, Rules 1 and 4 and the First Schedule. Last reviewed 10 November 2026.
FAQ
Questions and answers
For most companies, no. It is when the rules for registering as a Consent Manager start. Registration is for companies that want to run a consent platform for others: an Indian company with a net worth of at least ₹2 crore. Your main deadline is 13 May 2027.
Not on our reading. The Act says a person may give, manage, review or withdraw consent through a Consent Manager. We have found nothing in the Act or the Rules that requires a company to register as one or to use one.
A consent management platform is software a company uses to capture and record consent in its own products. A Consent Manager is a company registered with the Data Protection Board that lets people manage their consents across many companies. It acts on behalf of the individual.
Not directly. The applicant must be a company incorporated in India with a net worth of not less than ₹2 crore, so a foreign business would need an Indian company that meets every condition in the First Schedule.
Not always. You need consent records you can prove. Some companies buy a platform; many build consent capture and logging into their own apps. We help you choose, then build or integrate it.