--- title: "DPDP’s consent manager rule starts 13 November; the Board wasn’t functional in October" summary: "What the DPDP Rules 2025 ask of a consent manager, why the date is 13 November (some say 14), and what we could not find by 9 November: a form, a standard, a Board at work." url: https://www.thetechbag.com/blog/dpdp-consent-managers-13-november-board format: Note desk: "Data & privacy" region: India published: 2026-11-09 facts_checked: 2026-11-09 author: TechBag (The TechBag Journal) tags: ["DPDP Act","DPDP Rules 2025","consent manager","Rule 4","First Schedule","Data Protection Board of India","MeitY","Kerala High Court","Digi Yatra","G.S.R. 846(E)","G.S.R. 843(E)","section 6(9)","net worth","independent certification"] cover: https://www.thetechbag.com/blog/covers/dpdp-consent-managers-13-november-board.png --- # DPDP’s consent manager rule starts 13 November; the Board wasn’t functional in October *What the DPDP Rules 2025 ask of a consent manager, why the date is 13 November (some say 14), and what we could not find by 9 November: a form, a standard, a Board at work.* Note · Data & privacy · By TechBag · Published 2026-11-09 · Facts checked 2026-11-09 · Canonical: https://www.thetechbag.com/blog/dpdp-consent-managers-13-november-board Rule 4 of India’s Digital Personal Data Protection Rules, under which a company may apply to become a registered consent manager, takes effect on Friday 13 November.[1] The application goes to the Data Protection Board of India. In October, in a public interest case about passenger data on Digi Yatra, the Centre’s counsel told the Kerala High Court, on instructions, that the Board “has been constituted but has not made functional”, LiveLaw reported.[4] We could find no form, fee, standard or portal. How registration will work is not known, and we do not guess. ## What a consent manager is The Act defines it as a person registered with the Board who acts as “a single point of contact” for an individual to “give, manage, review and withdraw her consent” through an interoperable platform.[3] The Rules’ own example: a woman uses a platform to let one bank obtain her statement from another. The second bank sends it; the platform must ensure the contents “are not readable by it”.[1] It carries the permission, not the data. It must act “in a fiduciary capacity” for the individual and cannot sub-contract the job.[1] ## What the text fixes, and what it leaves open Not in the Rules, or not found by us - The application itself: Rule 4 asks for what “the Board may publish in this behalf on its website”. We found nothing published. - The standards a platform is certified against, also to be “published by the Board”. None found. - Who may certify, any fee, and how long the Board has to decide. The Rules name none. - What happens to an application sent before the Board can act. In the Rules - An Indian company with net worth of at least ₹2 crore.[1] - Independent certification of the platform.[1] - Records kept at least seven years, and every shareholder above 2% published.[1] - Conflict-of-interest clauses in the company’s charter, changeable only with the Board’s approval; no sale of control without it.[1] ReportedWhy 13 November, when some say 14 Rule 4 starts “one year after the date of publication of this Gazette”. The Gazette’s masthead reads Thursday 13 November 2025, but its serial number, CG-DL-E-14112025, carries the 14th.[1] The government’s explainer says notified on 14 November,[6] and SCC Online gives 14 November 2026.[7] We use the masthead. The Act’s registration duty, section 6(9), runs on the same clock.[2] Neither date changes what is missing. ## The Board, as far as the record shows The Act’s Board provisions and Rules 17 to 21 have been in force since publication.[1][2] LiveLaw’s report quotes the bench: “we expect that the Board will be made functional within a period of eight weeks from date”.[4] Whether anyone sits on it rests on secondary sources: a LiveLaw article of 1 August said no chairperson or member had been appointed on the public record, and that nominations were sought on 6 May.[5] We found no report of an appointment up to 9 November. That is a search, not an official list. **Figure: Rule 4 begins about three weeks before the High Court's eight weeks run out** *DPDP commencement dates and the Board's reported status, November 2025 to May 2027* | Date | Event | Detail | | --- | --- | --- | | 13 Nov 2025 | Rules published | Board provisions in force at once | | 6 May 2026 | Nominations sought | For chairperson and members, per LiveLaw | | 7 Oct 2026 | Kerala High Court | Expects a functional Board in eight weeks | | 13 Nov 2026 | Rule 4 begins | Consent manager registration | | 2 Dec 2026 | Eight weeks end | Our arithmetic | | 13 May 2027 | The rest begins | Notice, consent, and the right to use a consent manager | Source: Gazette of India (G.S.R. 843(E), 846(E)); LiveLaw · as of 9 November 2026 · 2 December is TechBag arithmetic, reading LiveLaw's 'Wednesday' as 7 October Registration comes before the rest. The section letting an individual act through a consent manager, 6(7), starts with the other consent duties eighteen months after publication.[2] Our pieces on [Rule 6](https://www.thetechbag.com/blog/building-impregnable-enterprise-compliance-dlp-backup) and [Rule 7](https://www.thetechbag.com/blog/sbi-leak-three-clocks-six-hours-72-hours) cover two of those duties. A company preparing now can settle what the text fixes: net worth, charter clauses, disclosures. What to watch: whether the Board is working by early December, and anything it publishes. How we did this Figures as of 9 November 2026, 7pm IST We read both Gazette notifications and the Act. We read LiveLaw’s report, not the court’s order. We could not check two places: dpb.gov.in did not resolve, and we do not know that it is the Board’s address; MeitY’s web pages gave our tools no readable text, though its PDFs opened. Something may be published there that we cannot see. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [MeitY, Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), Gazette No. 760 (Rules 1, 4; First Schedule)](https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf) — 13 November 2025 2. [MeitY, commencement notification, G.S.R. 843(E), Gazette No. 757 (copy on MediaNama)](https://www.medianama.com/wp-content/uploads/2025/11/Date-of-applicability-of-Rules.pdf) — 13 November 2025 3. [Digital Personal Data Protection Act, 2023, sections 2(g), 6(7)-(9)](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf) — 11 August 2023 4. [LiveLaw, Make Data Protection Board Functional In 8 Weeks: Kerala High Court, WP(PIL) 15/2026](https://www.livelaw.in/high-court/kerala-high-court/kerala-high-court-digi-yatra-data-protection-board-553994) — 10 October 2026 5. [LiveLaw, India's Data Protection Board: Established In Law, Absent In Fact](https://www.livelaw.in/articles/india-data-protection-board-established-law-543751) — 1 August 2026 6. [Press Information Bureau, DPDP Rules, 2025 Notified](https://static.pib.gov.in/WriteReadData/specificdocs/documents/2025/nov/doc20251117695301.pdf) — 17 November 2025 7. [SCC Online, consent managers and phase two of the DPDP Act](https://www.scconline.com/blog/post/2026/10/15/architecture-of-consent-consent-manager-dpdp-act-phase-two-implementation/) — 15 October 2026 **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. **Read this next:** [3,897 SBI records leaked. Three clocks now run: 6 hours, 6 hours and 72 hours](https://www.thetechbag.com/blog/sbi-leak-three-clocks-six-hours-72-hours) — The later DPDP deadlines in practice: SBI’s leak set a 72-hour Rule 7 window beside six-hour reports to CERT-In and the RBI. Go deeper on TechBag - [Data security and privacy guides](https://www.thetechbag.com/browse/data-security-privacy) — the tools that find and control personal data, ahead of the DPDP duties that start in May 2027 - [Data security posture management guide](https://www.thetechbag.com/browse/data-security-privacy/dspm) — finding where personal data sits, which a consent record alone does not tell you - [BFSI obligations: RBI, SEBI and CERT-In duties, dated](https://www.thetechbag.com/industries/bfsi/obligations) — the rules already in force for lenders while the DPDP dates arrive