India's Digital Personal Data Protection Rules were notified on 13 November 2025. The rule on consent managers comes into force on 13 November 2026, so companies can start registering as consent managers with the Data Protection Board. Most rules on notices, consent, breaches and your rights to access or erase data start only on 13 May 2027.
Updated 3 November 2026
Quick facts
| Item | Details |
|---|---|
| Official portal | MeitY: DPDP Rules 2025 |
| Helpline | No citizen helpline yet; complaints to the Data Protection Board once it's working |
| Fee | Using a consent manager is expected to be free or low cost for citizens; rules don't fix a fee |
| Deadline | Rule 4 (consent managers) from 13 November 2026; main rules from 13 May 2027 |
| Documents | None needed by citizens right now |
| Law | Digital Personal Data Protection Act, 2023; Rules notified as G.S.R. 846(E) on 13 November 2025 |
| Max penalty on companies | Up to ₹250 crore per breach under the Act |
What is happening on 13 November 2026?
When the government notified the DPDP Rules on 13 November 2025, it didn't switch them all on at once. It picked three phases:
| Phase | Rules | Start date |
|---|---|---|
| Phase 1 | Rules 1, 2 and 17 to 21 (short title, definitions, Data Protection Board set-up and working) | 13 November 2025 |
| Phase 2 | Rule 4 (registration and duties of consent managers) | 13 November 2026 |
| Phase 3 | Rules 3, 5 to 16, 22 and 23 (notices, security, breach reporting, children's data, your rights and more) | 13 May 2027 |
So 13 November 2026 is the date consent managers become possible. It's the one-year mark.
What is a consent manager, in simple words?
Think of it as a single dashboard for all the permissions you give companies to use your data.
Right now, if you say "yes" to a bank, an app or a hospital using your data, that permission sits in that company's system. To take it back, you have to find their settings or write to them. A consent manager is a registered platform where you can give, see, manage and withdraw consents across many companies in one place.
The rules give an example. A person keeps her bank statement in a digital locker. A bank onboarded on the consent manager asks for her statement. She approves the request through the consent manager platform and the statement goes to the bank. She can later see that record and withdraw consent.
If this sounds like the RBI's Account Aggregator system for financial data, it's a similar idea, but for all kinds of personal data.
Who can become a consent manager?
The First Schedule of the rules sets tough conditions:
• It must be a company incorporated in India
• Its net worth must be at least ₹2 crore
• It needs sound finances and management with a record of fairness and integrity
• Its platform must be interoperable and independently certified against the Board's standards
• It must work in the interests of data principals (that's you)
And once registered, it has duties:
1. It must act in a fiduciary capacity towards you, meaning your interest comes first
2. It must not be able to read your data while it passes through
3. It must keep a record of consents given, denied or withdrawn, and share it with you in machine-readable form on request
4. It must keep these records for at least seven years
5. It can't sub-contract its work
6. It must avoid conflicts of interest with the companies (data fiduciaries) on its platform
Can I use a consent manager from 13 November 2026?
Not immediately. 13 November 2026 is when companies can apply to the Data Protection Board for registration. Then the Board has to check and register them, and platforms have to onboard companies. Reports in late 2026 said the Board was still not fully constituted. So expect the first working consent managers to take some months after 13 November 2026.
Which rights do I already have under the DPDP Act?
The Act itself gives you these rights (Sections 11 to 14), but the detailed rules for using them start on 13 May 2027:
• Right to information about what data a company holds and who it shared it with
• Right to correction and erasure of your data
• Right to grievance redressal, first with the company
• Right to nominate someone to use your rights if you die or can't act
Once Phase 3 starts, companies have to answer grievances within a reasonable time, not more than 90 days. Our post on what you can ask under the DPDP Act goes deeper into each right.
What changes on 13 May 2027?
This is the big date for ordinary people:
• Clear notices. Companies must tell you in plain language what data they collect and why, before asking consent
• Breach alerts. If your data leaks, the company must tell you without delay, and report details to the Board within 72 hours
• Children's data. Verifiable parental consent for users under 18
• Data deletion. Some large platforms have to delete data of inactive users after set periods, with a 48-hour warning
• Your rights in action. Forms and timelines to ask for access, correction and erasure
What should I do right now?
You don't need to register anywhere. But a few habits help:
☐ Review app permissions on your phone (contacts, location, photos) ☐ Delete apps you don't use. They still hold your data ☐ Keep screenshots when you withdraw consent or ask a company to delete your data ☐ Read the consent screen before tapping "Agree", especially for loan apps ☐ Note the grievance officer email on apps you use for money or health
What if a company misuses my data right now?
1. Complain to the company first. Use its grievance officer contact.
2. Use sector routes. Banking complaints to the RBI ombudsman, telecom to TRAI-linked routes, and general complaints to the government's CPGRAMS portal.
3. For cyber fraud, call 1930 or report on cybercrime.gov.in.
4. Once the Board is working, file a complaint there after the company route.
Be careful though: the Act also has duties for you. Filing a false or frivolous complaint can attract a penalty of up to ₹10,000.
Want your MP to raise data privacy issues in Parliament? Find them on NetaSampark.
How is this different from the Account Aggregator system?
Account Aggregators are licensed by the RBI and deal only with financial data, like bank statements, mutual fund holdings and insurance. Consent managers under the DPDP Rules are registered with the Data Protection Board and can cover any kind of personal data that companies on their platform hold. Over time, you may see both: an Account Aggregator for loans and a DPDP consent manager for, say, health or shopping data. Both follow the same idea of your consent, your control.
Final reminder
13 November 2026 is about companies, not citizens. It lets consent managers register. The real change in your daily life comes on 13 May 2027, when notices, breach alerts and rights forms become mandatory. Use the time to clean up your app permissions.
Frequently asked questions
What starts on 13 November 2026 under the DPDP Rules?
Rule 4, which covers registration and duties of consent managers, comes into force.
What is a consent manager under the DPDP Act?
A registered platform that lets you give, manage, review and withdraw consent for your data across companies in one place.
When do the DPDP Rules fully come into force?
Most rules, including your rights and breach reporting, start on 13 May 2027.
What is the minimum net worth for a consent manager?
₹2 crore, as per the First Schedule of the rules.
What is the penalty for a data breach under the DPDP Act?
Up to ₹250 crore on the company, decided by the Data Protection Board.
Sources
• MeitY: Digital Personal Data Protection Rules, 2025