India’s data protection law has hit its first big deadline. The Consent Manager framework under the DPDP Act India rules came into force on 13 November 2026 — the second phase of India’s Digital Personal Data Protection Rules, 2025. But before you worry about your website or your sign-up forms, read the fine print: nothing changes for ordinary users or most websites today. The date that really matters is 13 May 2027.
📑 On This Page
DPDP Act: Quick Facts
- What started: The Consent Manager framework (Section 6(9), Section 27(1)(d) and Rule 4 of the DPDP Rules, 2025) came into force on 13 November 2026
- The law: Digital Personal Data Protection Act, 2023 — passed by Parliament and given assent on 11 August 2023
- The rules: DPDP Rules, 2025, notified on 13 November 2025, with an 18-month phased rollout
- Next big date: 13 May 2027 — when most duties apply: privacy notices, consent, security safeguards, breach notification and data rights
- Maximum penalties: Up to Rs 250 crore for failing to keep reasonable security safeguards, up to Rs 200 crore for not reporting a breach, up to Rs 50 crore for other breaches of a data fiduciary’s duties
- What it is NOT: Not a deadline for every website — using a Consent Manager is optional, and ordinary sign-up forms do not change today
What Is the DPDP Act?
The Digital Personal Data Protection Act, 2023 is India’s first comprehensive data privacy law. It sets the rules for how companies and websites collect, use, store and delete your personal data — your name, phone number, email, location and more. The Act itself became law in August 2023, but the operational detail only arrived with the DPDP Rules, 2025, notified on 13 November 2025. Those rules roll out in three phases over 18 months, and the second phase began on 13 November 2026.
What Started on 13 November 2026: Consent Managers
A Consent Manager is a registered intermediary that acts as a single point of contact for your consent. Instead of giving, reviewing and withdrawing consent separately with every app and website, you would do it in one place through a Consent Manager’s platform. Under Rule 4, a Consent Manager must be a company incorporated in India with a net worth of at least Rs 2 crore, registered with the Data Protection Board of India, running a platform certified by an independent party. Once registered, it must keep records of consents, notices and data sharing for at least seven years, avoid conflicts of interest with the companies whose consent requests it handles, and run audit mechanisms that report to the Board. Crucially, no business is required to use a Consent Manager — companies can keep managing consent themselves, and individuals can keep giving consent directly to each website or app.
The Three Key Dates of the DPDP Rules
- 13 November 2025 (Phase 1): Definitions and the sections establishing the Data Protection Board of India came into force. The Board was set up by Gazette notification, with its head office in the National Capital Region.
- 13 November 2026 (Phase 2): The Consent Manager framework — registration and obligations of Consent Managers under Rule 4 — came into force. Registrations can now, in principle, begin.
- 13 May 2027 (Phase 3): The core duties go live — mandatory privacy notices, affirmative consent, reasonable security safeguards, breach notification, data principal rights (access, correction, erasure, grievance redressal), children’s data protections and most of the Board’s penalty powers.
What Changes for You
For ordinary users, nothing changes on 13 November 2026. Your sign-up forms, app permissions and privacy settings work exactly as before — the Consent Manager framework only opens a new option for how consent can be managed in future. For website and app owners, the same is true: there is no new form to fill and no new registration to make today. The real deadline is 13 May 2027, when privacy notices, consent flows, security safeguards, breach reporting and user rights become enforceable — and that is the date businesses should be preparing for now. If you run a website with a contact form, newsletter signup or analytics, you are already collecting personal data, and the May 2027 duties will apply to you.
What Is Still Missing
The rollout has a visible gap: as of early November 2026, legal trackers reported that the Data Protection Board has no appointed chairperson or members, and no Consent Manager application form or interoperability framework had been found on the Board’s website. That matters because the Board is the sole gatekeeper — only it can register a Consent Manager. These are reports from legal trackers, not confirmed official statements, but if they hold, registrations cannot actually begin until the Board is staffed. The framework is in force on paper; the machinery to use it is still catching up.
Our Take
Honestly, 13 November 2026 is a milestone, not a deadline for most people — the headline date is May 2027. But the direction is clear: India is moving from a world where consent was a checkbox to one where consent is a record you can review and withdraw, with penalties of up to Rs 250 crore behind it. If you run a website or an app, start fixing your privacy notice and consent flow now, while there is still time. And if you are only a user, keep an eye on May 2027 — that is when your data rights actually switch on.
Did you know India now has a data protection law with fines up to Rs 250 crore? Tell us in the comments — do you think these rules will actually change how apps handle your data?
Keep exploring: TRAI New Telecom Complaint Rules 2026: 24×7 Support, 15-Day Appeal and Rs 20 Lakh Fine • TRAI AI Guidelines for Telecom: Draft Rules for Jio, Airtel, Vi, BSNL • Mobile Recharge Price Hike: Airtel Chairman Says Tariffs Should Rise to Rs 350 a Month
Sources: TechTimes (13 November 2026), S.S. Rana & Co. legal analysis, MojoAuth analysis of the DPDP Rules, IT Labs India AI in India 2026 research, Cookiebees knowledge base. Board staffing status is as reported by legal trackers, not confirmed by an official notification. No tariff or product price is involved in this story.