Consent Managers under the DPDP Act: Registration, Duties and the 14 November 2026 Deadline

Adv Shalini @AgreyaLegal

Why 14 November 2026 matters

From 14 November 2026, consent managers can register with the Data Protection Board of India (DPBI), and operating without registration after that date may attract monetary penalties. This date marks the end of the gentle, guidance-led phase of the Digital Personal Data Protection Act, 2023 (DPDPA). The Board is expected to move from advice to active supervision and enforcement.

For businesses, the message is simple. Consent is no longer a tick-box formality. It is a legal obligation that must be recorded, proved and honoured in real time. As the old maxim says, ignorantia juris non excusat (ignorance of the law is no excuse).

This article explains, in plain language, who a consent manager is, who can become one, what duties they carry, and what every data fiduciary (a company that decides why and how personal data is used) must do before the final deadline of 13 May 2027.

The DPDP implementation timeline

The DPDP Rules come into force in phases, and the last two dates are the ones businesses must plan around.

Date	What happens	Who must act
14 November 2026	Rules on eligibility, registration and duties of consent managers take effect; registration with the DPBI begins	Consent managers; data fiduciaries that rely on consent
13 May 2027	Last day to complete all compliance procedures	All data fiduciaries
14 May 2027	All substantive processing obligations and data principal rights take effect	Every stakeholder under the DPDPA

In short, the window between November 2026 and May 2027 is a runway, not a holiday. Data fiduciaries should use it to integrate with consent managers and test their systems.

What counts as valid consent

Under Section 6 of the DPDPA, consent is valid only if it is free, specific, informed, unconditional and unambiguous, and given through a clear affirmative action. Once given, the data principal (the individual whose data it is) must be able to withdraw it as easily as she gave it.

This bar is far higher than under the old SPDI Rules of 2011. In practice, it rules out:

• pre-ticked boxes;
• “by continuing to use this app, you agree” banners;
• bundled consent, where a user must accept unrelated data uses to get a service.

The principle is volenti non fit injuria (no wrong is done to one who consents), but only where that consent is genuine and not manufactured (artificially created).

Who is a consent manager, and how the API works

A consent manager is a company registered with the DPBI that gives individuals one transparent platform to give, manage, review and withdraw consent across many businesses. The framework rests on Section 6 of the DPDPA, read with Rule 4 and the First Schedule of the DPDP Rules, 2025.

A simple example. Priya uses platform P, run by a registered consent manager. Banks B1 and B2 are both onboarded onto P. From one dashboard, Priya can allow B1 to use her data for a loan application, refuse B2 permission for marketing, and later withdraw either choice.

Think of the API as a waiter. An API (Application Programming Interface) is a set of rules that lets two software systems talk to each other automatically. Like a waiter, it takes your order (the request) to the kitchen (the server) and brings back the food (the answer).

Here is how the consent check works in practice:

1. Before any app or backend service reads, processes or exports a user’s data, it sends a request to the consent API with the user ID and the intended purpose.
2. The API replies in real time: “allow” if valid consent exists, or “deny/block” if consent is missing, expired or refused.
3. If a user withdraws or changes consent through the consent manager, the API instantly sends a notice to stop live processing and passes the withdrawal on to third-party processors.
4. Every grant, refusal and change is logged with a timestamp (an exact date-and-time record), creating an audit trail that proves compliance during inspections or data-rights requests.

Who can register as a consent manager

Only an Indian company with a net worth of at least ₹2 crore, sound management and independently certified technology can register. Part A of the First Schedule lists the conditions:

1. The applicant is a company incorporated in India.
2. It has enough technical, operational and financial capacity to perform its duties.
3. Its financial condition and the general character of its management are sound.
4. Its net worth is not less than ₹2 crore.
5. Its likely volume of business, capital structure and earning prospects are adequate.
6. Its directors, key managerial personnel and senior management have a reputation for fairness and integrity.
7. Its memorandum and articles of association require compliance with the conflict-of-interest duties (items 9 and 10 of Part B), and these clauses can be amended only with the Board’s prior approval.
8. Its proposed operations serve the interests of data principals.
9. It is independently certified that its interoperable platform meets the Board’s published data protection standards, and that proper technical and organisational measures are in place to follow them.

The 11 obligations of a consent manager

A consent manager acts in a fiduciary capacity (a position of trust, like a trustee) towards the data principal. Part B of the First Schedule sets out its duties:

No.	Obligation	What it means in practice
1	Enable consent	Let users give consent to any onboarded data fiduciary, directly or through another onboarded fiduciary
2	Stay data-blind	Share data in a way that the consent manager itself cannot read its contents
3	Keep records	Record consents given, denied or withdrawn; the notices shown; and data shared with a transferee fiduciary
4	Give access to records	Let users view their record, download it in machine-readable form, and keep it for at least seven years
5	Run a website or app	Make a website, app or both the primary way users reach its services
6	No subcontracting	Not subcontract or assign any of its obligations
7	Secure the data	Take reasonable security safeguards to prevent a personal data breach
8	Act as a fiduciary	Put the user’s interest first
9	Avoid conflicts with fiduciaries	Avoid conflicts of interest with data fiduciaries, their promoters and key managers
10	Guard against internal conflicts	Have measures so its own directors and senior staff create no conflict of interest
11	Publish ownership details	Publicly disclose its promoters, directors and senior management; anyone holding over 2% of its shares; and companies in which its insiders hold over 2%

In practical terms, this also means clear notices in plain language, regular audits of consent logs, easy tools to exercise data rights, and strong encryption and access controls.

Who cannot be a consent manager

A company in the same group as a data fiduciary, whether as its parent, subsidiary or sister concern, should not act as its consent manager, because that would create a conflict of interest. This follows from the conflict-of-interest duties in items 9 and 10 of Part B. The maxim nemo judex in causa sua (no one should be a judge in their own cause) captures the logic well.

A consent manager must also remain data-blind. It:

• has no access to the actual personal data a data fiduciary processes;
• uses data only to manage and record consent;
• never uses or shares data for secondary purposes such as profiling or marketing.

What a consent notice must contain

Every request for consent must come with a notice that a person can understand on its own, without reading any other document. Under Rule 3 of the DPDP Rules, the notice must:

• be in clear and plain language;
• be available in English or any language in the Eighth Schedule of the Constitution;
• give a fair account of the details needed for informed and specific consent.

At a minimum, it must include:

1. an itemised (listed item by item) description of the personal data collected;
2. the specific purposes, and the goods, services or uses that the processing will enable;
3. a direct link to the data fiduciary’s website or app, and other ways to withdraw consent, exercise rights or complain to the Board;
4. contact details of the person who answers data principals’ queries, such as the grievance officer, or the Data Protection Officer of a Significant Data Fiduciary.

The law prescribes no fixed template. Businesses are free to design the layout, but the burden of proving a fair and clear notice rests on them.

Children’s data: who is exempt

Section 9(1) and 9(3) of the DPDPA require verifiable parental consent before processing a child’s data and ban tracking, behavioural monitoring and targeted advertising aimed at children. The Fourth Schedule of the DPDP Rules relaxes these rules for certain fiduciaries, but only within strict limits.

Exempt classes of data fiduciaries

Data fiduciary	Permitted processing
Clinical or mental health establishment, or healthcare professional	Only to provide health services to the child, as needed to protect her health
Allied healthcare professional	Only to support a treatment or referral plan, as needed to protect her health
Educational institution	Tracking and monitoring only for its educational activities or the safety of enrolled children
Person running a creche or child day-care centre	Tracking and monitoring only for the safety of children in its care
Transport provider engaged by a school, creche or day-care centre	Location tracking only during travel to and from the institution, for safety

Exempt purposes

1. Exercising a power or duty in the interests of a child under any Indian law.
2. Providing a subsidy, benefit, service, certificate, licence or permit in a child’s interests, under Section 7(b) of the Act.
3. Creating an email account, limited to what is needed for email communication.
4. Ensuring that harmful information does not reach a child.
5. Confirming that a user is not a child, as part of due diligence under Rule 10.

What happens if you fail to comply

Penalties under the DPDPA are monetary and civil, not criminal, but they are steep (very high). The Board can impose penalties under the Schedule to the Act, which reach up to ₹250 crore for failing to take reasonable security safeguards. For a consent manager, the Board may also suspend or cancel registration under Rule 4.

The risks for each stakeholder are:

• Unregistered consent managers: operating after 14 November 2026 without registration may attract monetary penalties.
• Registered consent managers: breach of Part B duties can lead to inquiry, penalty, and suspension or cancellation of registration.
• Data fiduciaries: processing without valid consent, or ignoring a withdrawal, exposes them to penalties and loss of customer trust.

As the maxim goes, vigilantibus non dormientibus jura subveniunt (the law helps the vigilant, not those who sleep on their rights). Early preparation is the best defence.

Compliance checklist for data fiduciaries

Use this checklist to be ready well before 13 May 2027:

• Map every point where your business collects personal data on the basis of consent
• Remove pre-ticked boxes and “continue to agree” language
• Draft stand-alone consent notices that meet Rule 3
• Choose a registered consent manager with no group link to your business
• Build API integration so every data use is checked against live consent
• Make sure withdrawals stop processing instantly and reach third-party processors
• Keep timestamped logs of every consent event
• Review children’s data processing and any Fourth Schedule exemption you rely on
• Name a grievance officer and publish contact details

How Agreya Legal can help

Agreya Legal advises companies on protecting personal data and defending against data protection claims. Our team can help you:

• audit your current consent practices against the DPDPA and DPDP Rules;
• draft compliant consent notices, privacy policies and data processing agreements;
• assess eligibility and prepare applications for consent manager registration;
• review conflict-of-interest structures and disclosure obligations;
• represent you in inquiries and proceedings before the Data Protection Board of India.

Contact Agreya Legal to start your DPDP compliance review today.

Frequently asked questions

What is a consent manager under the DPDP Act? A consent manager is a company registered with the Data Protection Board of India that lets individuals give, manage, review and withdraw consent through one interoperable platform.

When does consent manager registration begin? Registration begins on 14 November 2026, when the rules on eligibility and duties of consent managers take effect.

What is the minimum net worth for a consent manager? The applicant must have a net worth of at least ₹2 crore and must be a company incorporated in India.

Can a consent manager see my personal data? No. A consent manager must be data-blind and share data in a way that it cannot read the contents.

How long must consent records be kept? At least seven years, or longer if the user and consent manager agree or the law requires.

Are pre-ticked boxes allowed under the DPDPA? No. Consent must be given through a clear affirmative action, so pre-ticked boxes and implied consent will not meet the standard.

What is the final DPDP compliance deadline? Data fiduciaries must complete all compliance procedures by 13 May 2027; all substantive obligations apply from 14 May 2027

This note is general information and is not legal advice. The law may have changed since it was written, and how it applies depends on the facts of each case.

All posts