Explore TechBag
The TechBag JournalSubscribe

Data & privacyNote

DPDP’s consent manager rule starts 13 November; the Board wasn’t functional in October

What the DPDP Rules 2025 ask of a consent manager, why the date is 13 November (some say 14), and what we could not find by 9 November: a form, a standard, a Board at work.

By TechBag

· 3 min read · Facts checked November 2026

Illustration: The TechBag Journal

Rule 4 of India’s Digital Personal Data Protection Rules, under which a company may apply to become a registered consent manager, takes effect on Friday 13 November.1 The application goes to the Data Protection Board of India. In October, in a public interest case about passenger data on Digi Yatra, the Centre’s counsel told the Kerala High Court, on instructions, that the Board “has been constituted but has not made functional”, LiveLaw reported.4 We could find no form, fee, standard or portal. How registration will work is not known, and we do not guess.

01What a consent manager is

The Act defines it as a person registered with the Board who acts as “a single point of contact” for an individual to “give, manage, review and withdraw her consent” through an interoperable platform.3 The Rules’ own example: a woman uses a platform to let one bank obtain her statement from another. The second bank sends it; the platform must ensure the contents “are not readable by it”.1 It carries the permission, not the data. It must act “in a fiduciary capacity” for the individual and cannot sub-contract the job.1

02What the text fixes, and what it leaves open

Not in the Rules, or not found by us

  • The application itself: Rule 4 asks for what “the Board may publish in this behalf on its website”. We found nothing published.
  • The standards a platform is certified against, also to be “published by the Board”. None found.
  • Who may certify, any fee, and how long the Board has to decide. The Rules name none.
  • What happens to an application sent before the Board can act.

In the Rules

  • An Indian company with net worth of at least ₹2 crore.1
  • Independent certification of the platform.1
  • Records kept at least seven years, and every shareholder above 2% published.1
  • Conflict-of-interest clauses in the company’s charter, changeable only with the Board’s approval; no sale of control without it.1

03The Board, as far as the record shows

The Act’s Board provisions and Rules 17 to 21 have been in force since publication.12 LiveLaw’s report quotes the bench: “we expect that the Board will be made functional within a period of eight weeks from date”.4 Whether anyone sits on it rests on secondary sources: a LiveLaw article of 1 August said no chairperson or member had been appointed on the public record, and that nominations were sought on 6 May.5 We found no report of an appointment up to 9 November. That is a search, not an official list.

Rule 4 begins about three weeks before the High Court's eight weeks run out

DPDP commencement dates and the Board's reported status, November 2025 to May 2027

13 Nov 2025Rules published
6 May 2026Nominations sought
7 Oct 2026Kerala High Court
13 Nov 2026Rule 4 begins
2 Dec 2026Eight weeks end
13 May 2027The rest begins
Show tableHide table
DateEventDetail
13 Nov 2025Rules publishedBoard provisions in force at once
6 May 2026Nominations soughtFor chairperson and members, per LiveLaw
7 Oct 2026Kerala High CourtExpects a functional Board in eight weeks
13 Nov 2026Rule 4 beginsConsent manager registration
2 Dec 2026Eight weeks endOur arithmetic
13 May 2027The rest beginsNotice, consent, and the right to use a consent manager

Source: Gazette of India (G.S.R. 843(E), 846(E)); LiveLaw · as of 9 November 2026 · 2 December is TechBag arithmetic, reading LiveLaw's 'Wednesday' as 7 October

Registration comes before the rest. The section letting an individual act through a consent manager, 6(7), starts with the other consent duties eighteen months after publication.2 Our pieces on Rule 6 and Rule 7 cover two of those duties. A company preparing now can settle what the text fixes: net worth, charter clauses, disclosures. What to watch: whether the Board is working by early December, and anything it publishes.

Sources

  1. MeitY, Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), Gazette No. 760 (Rules 1, 4; First Schedule) — 13 November 2025
  2. MeitY, commencement notification, G.S.R. 843(E), Gazette No. 757 (copy on MediaNama) — 13 November 2025
  3. Digital Personal Data Protection Act, 2023, sections 2(g), 6(7)-(9) — 11 August 2023
  4. LiveLaw, Make Data Protection Board Functional In 8 Weeks: Kerala High Court, WP(PIL) 15/2026 — 10 October 2026
  5. LiveLaw, India's Data Protection Board: Established In Law, Absent In Fact — 1 August 2026
  6. Press Information Bureau, DPDP Rules, 2025 Notified — 17 November 2025
  7. SCC Online, consent managers and phase two of the DPDP Act — 15 October 2026

Disclosure. TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.

Keep reading

Data & privacyPerry Johnson’s US$10m breach settlement: US$300,000 due, about 2 cents a patient7 November 2026 · 3 min
Data & privacyApple will check iCloud items shared by public link, from iOS 27.36 November 2026 · 3 min
Data & privacyChennai transcribers heard audio from 93 Australian court cases; no action follows5 November 2026 · 3 min