India's Consent Manager Rule Takes Effect Nov 13. Here's What Changes for You, and What Doesn't
Time-sensitive:
Details may change; check current announcements before relying on dates or figures.
On November 13, Rule 4 of India's Digital Personal Data Protection (DPDP) Rules, 2025 comes into force. It establishes the legal route to register a new intermediary, the Consent Manager, with the Data Protection Board. The commencement date does not mean a registered service will be operating that day. The date is being widely described as a data-protection deadline, but for most people and most businesses it is not one.
The rules were notified on November 13, 2025 and are being phased in. Rule 4 starts at the one-year mark. Most of the other obligations start 18 months after notification, on May 13, 2027.
What a Consent Manager is
A Consent Manager is an entity that lets a person give, review and withdraw consent across different services through a single interface. It sits between the individual, called the Data Principal in the law, and the business that holds their data, called the Data Fiduciary.
Under Rule 4, a Consent Manager must register with the Data Protection Board of India. Legal commentary on the rules says applicants must be Indian companies with a minimum net worth of ₹2 crore.
What does not change on November 13
Compliance advisers have been blunt about this. The November milestone relates to Consent Manager provisions, and it is not the general compliance date for businesses. The wider operational obligations begin on May 13, 2027, with different penalties depending on the provision and circumstances.
A business does not have to use a Consent Manager. Registration becoming possible does not guarantee that a registered service will be available on the first day.
Our analysis
The idea is sound. A single dashboard where you can see who holds your data and pull your consent back is closer to what privacy law promises than a separate pop-up for every app. India already runs a consent-based data-sharing layer in finance through account aggregators, so the concept is not new to the country.
The test will be what happens after you click "withdraw". A Consent Manager is only as useful as the willingness of every downstream business to honour the withdrawal. If a business can keep processing your data under another legal basis, the dashboard becomes a comfort rather than a control. Watch the Board's enforcement from May 2027, not the registration headlines.
What readers should do now
- Nothing is required of you on November 13.
- Be sceptical of any app or website that claims to be a "registered Consent Manager" before the Board has registered anyone. Check the Board's own listings once they exist.
- Treat requests to hand over broad access to your accounts "for consent management" with the same caution you would any other data-sharing request.
Sources:
Official DPDP Rules, 2025, G.S.R. 846(E). The status of the Board’s registration process has not been independently confirmed.