Introduction
India’s data protection framework has continued to evolve since the enactment of the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the subsequent introduction of the Digital Personal Data Protection Rules (the “Rules”) (together, the “DPDP regime”). The broader framework, including the applicability and commencement timeline, processing of personal data based on consent, recognition of consent managers and obligations of data fiduciaries, has already been discussed in our earlier article, which may be accessed here.
The position has since moved beyond the stage of anticipating the road ahead. With the scheduled commencement of the provisions relating to consent managers in November 2026, the regulatory framework is moving towards a more operational phase, including the ability for eligible entities to seek registration as consent managers in accordance with the applicable requirements.
This development gives rise to a new set of practical and legal considerations for organisations, particularly in relation to how data fiduciaries may engage with consent managers within the emerging framework. Against this backdrop, this article examines the current status of the consent manager framework, its legal and operational implications and the key steps that organisations should consider as they prepare for the next stage of implementation of the DPDP regime.
The November 2026 Commencement
The implementation of the DPDP framework has been structured in three stages, with different provisions taking effect at different points in time. The first phase has already commenced, while the second phase is scheduled to take effect in November 2026 and the remaining provisions in May 2027. For consent managers, November 2026 marks an important stage in this transition, as the provisions governing their registration, eligibility, operational requirements and regulatory oversight will become effective. These provisions together establish the statutory framework within which consent managers will operate under the DPDP regime.
(i) Establishing the Registration Requirement: The November 2026 commencement will make registration with the Data Protection Board (“Board”) a prerequisite for an entity seeking to operate as a consent manager. This requirement under Section 6(9) of the DPDP Act places consent managers within a formal regulatory structure, with their ability to undertake the role linked to compliance with prescribed technical, operational, financial and other requirements. The significance of this provision is therefore not limited to registration as a procedural step; it establishes that the role of a consent manager can be undertaken only by an entity that has satisfied the regulatory conditions applicable to it.
(ii) Registration and Operational Requirements: The eligibility framework for consent managers is set out in Rule 4, read with the first schedule to the DPDP Rules, which will also become operational in November 2026. The framework requires an applicant to meet prescribed standards relating to its corporate constitution, financial standing, management, operational capability and technological infrastructure. In particular, the applicant must be a company incorporated in India, maintain a minimum net worth of INR 20 million and demonstrate adequate financial and operational capacity to undertake the role. It must also have an interoperable platform capable of enabling data principals to give, manage, review and withdraw consent. The platform is required to undergo independent certification and incorporate appropriate technical and organisational measures to ensure its reliability and security. Collectively, these conditions establish that registration is intended for entities with the financial capacity, governance framework and technological infrastructure necessary to perform the consent manager function on a continuing basis.
The obligations applicable to a registered consent manager are continuing in nature. Its responsibilities include maintaining records of consents, notices and data sharing for at least seven years and providing data principals access to the relevant records, including in machine-readable form where required. It must maintain appropriate security safeguards and ensure that personal data shared through its platform remains unreadable to the consent manager. The DPDP regime also prescribes safeguards concerning conflicts of interest, management and shareholding disclosures, audit mechanisms, subcontracting and changes in control. These requirements are intended to ensure that entities performing this function maintain appropriate standards of independence, transparency, security and accountability throughout their operation.
(iii) Regulatory Oversight and Enforcement: The November 2026 regime also places registered consent managers under continuing oversight of the Board. The framework enables the Board to require corrective measures where a consent manager does not comply with the applicable requirements and, after providing an opportunity of being heard, suspend or cancel its registration where warranted. In addition, Section 27(1)(d) of the DPDP Act enables the Board to inquire into a breach of a condition of registration upon receiving an intimation of such breach and to impose the prescribed penalty where the breach is established.
Taken together, these provisions establish the regulatory framework for consent managers from November 2026, ahead of the wider commencement of the substantive consent provisions in May 2027. This commencement does not, by itself, require data fiduciaries to appoint or integrate with a Consent Manager.
When Should Organisations Consider a Consent Manager?
Companies that collect personal data from their customers, employees or users for their own purposes operate as data fiduciaries and do not become consent managers merely by obtaining consent. The DPDP regime does not require every data fiduciary to appoint a consent manager, as registration is relevant only to entities intending to operate in that capacity. Data fiduciaries may nevertheless integrate with a registered consent manager where appropriate and should assess whether such integration is required based on the nature of their processing activities and the manner in which consent is obtained, managed and withdrawn.
Preparing for May 2027
The November 2026 milestone should consequently be treated as an opportunity to test the organisation’s readiness for the more substantive phase of implementation. From May 2027, provisions concerning notice, consent, legitimate uses, data fiduciary obligations, data security, breach notification, erasure and data principal rights are scheduled to become operational. Organisations should use the intervening period to undertake a structured review of their existing data practices, including the personal data being processed, the purposes for which it is used, the systems in which it is stored, applicable retention requirements and the third parties with whom it is shared. This should also extend to reviewing existing consent notices, consent-capturing mechanisms and withdrawal processes, and whether these can be effectively implemented across the organisation’s systems.
The exercise should not, however, be limited to policy documentation. Organisations should test whether the legal position reflected in their privacy notices is supported by their systems and operational processes. A withdrawal mechanism that exists on paper but does not effectively update downstream processing systems may create a material compliance gap. Similar attention should be given to data flows, internal ownership of consent-related processes and the ability to maintain appropriate records. At the same time, organisations should consider retention requirements arising under other applicable laws and avoid treating erasure obligations in isolation. A balanced approach will therefore be necessary to ensure that legal requirements are reflected in day-to-day data practices while remaining aligned with the organisation’s operational needs.
Conclusion
The consent management framework marks a significant development in India’s evolving data protection landscape by introducing a regulated mechanism for managing consent between data principals and data fiduciaries. The November 2026 commencement establishes the regulatory foundation for this ecosystem, including the standards applicable to entities seeking to perform the consent manager role and the Board’s continuing oversight of such entities.
The broader significance of the complete DPDP regime framework will become clearer as the substantive provisions of the DPDP regime take effect in May 2027. Its effectiveness will depend on how the regulatory framework, consent managers and data fiduciaries operate together in practice, and whether consent management can provide greater transparency and control to data principals while remaining workable for organisations. For organisations, the preparation required for this transition will necessarily vary depending on their business, the nature and volume of personal data handled and the complexity of their data practices. While preparation should begin in advance, organisations that have not yet commenced the exercise still have an opportunity to complete the necessary preparations for implementation before May 2027.
The coming transition will therefore be an important stage in the development of India’s data protection framework, with May 2027 bringing the wider obligations into operation and providing greater clarity on how the consent management ecosystem functions within the broader DPDP regime. Ultimately, effective implementation will depend not merely on the existence of policies and regulatory mechanisms, but on their integration into day-to-day business processes.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
