DPDP Act
The DPDP Consent Manager Deadline: What 13 November 2026 Actually Starts
It starts the registration of Consent Managers with the Data Protection Board. It does not make Consent Manager integration mandatory, and for most organisations reading about it, nothing becomes due on that date at all. The date that should be driving your programme is 13 May 2027 — and that one is eighteen months of work, not a filing.
Why this page corrects the date rather than selling against it
SecureRoot is not a Consent Manager and does not register anyone as one. A Consent Manager registers itself with the Board, which is not something a consultancy can do on another party’s behalf.
The sequence
Three dates, and only one of them is probably yours
The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025 and commence in tranches rather than at once. Read them as a sequence; reading them as one distant deadline is the mistake that puts a budget a year early against the wrong obligation.
13 November 2025
- What commences
- The Rules were notified and the provisions establishing the Data Protection Board came into force.
- Who it binds
- Nobody operationally. This is the machinery of the regulator, not a duty on a business.
13 November 2026
- What commences
- Rule 4 commences: Consent Managers may register with the Data Protection Board, and the obligations attaching to that role begin.
- Who it binds
- Organisations that intend to operate AS a Consent Manager. If that is not your business model, nothing on this date is a duty for you.
13 May 2027
- What commences
- The substantive duties commence: notice, consent, security safeguards, breach intimation, retention and data-principal rights.
- Who it binds
- Essentially every Data Fiduciary. This is the date that should be driving your programme, and it is eighteen months of work for most estates, not a filing.
What you have probably been told
Four claims about this date, and what the instrument says
Each of these is in circulation, and each one points a buyer at the wrong purchase or the wrong month.
“Consent Manager integration becomes mandatory on 13 November 2026.”
- What is actually true
- Registration of Consent Managers opens. The Act contemplates a Data Principal being able to give, manage and withdraw consent through a registered Consent Manager — it does not require every Data Fiduciary to plug one in, and no date makes that integration compulsory.
“We need to appoint a Consent Manager before the deadline.”
- What is actually true
- A Consent Manager is a registered entity offering a service to Data Principals, not an officer you appoint. The role you may be thinking of is the Data Protection Officer, which is a separate requirement and applies to Significant Data Fiduciaries.
“Nothing applies until 13 May 2027, so there is time.”
- What is actually true
- The duties commence then; the work does not fit between now and then if it starts then. Data discovery across systems, partners and backups takes weeks, consent redesign ships at your release cadence, and processor contracts move at your counterparties' legal speed.
“Our consent banner already covers this.”
- What is actually true
- A cookie banner answers a different question from DPDP consent. The Act is about personal data processing across your estate — onboarding, support, marketing, vendors, backups — and a banner governs only what runs in a browser.
The real deadline
What to do with the time before 13 May 2027
In this order, because each step tells you what the next one is about. The first is the one teams skip, and it is the one everything else depends on.
- Find the personal data. Across applications, warehouses, partner integrations, support tooling and backups — the inventory is the thing everything else is sequenced from, and it is the step teams most often skip because it produces no artefact a board can admire.
- Decide, per purpose, what your lawful basis is and what the notice has to say. This is where consent redesign actually starts, and it is a product decision before it is a legal one.
- Fix retention. It is the most common gap in an Indian estate and the one most likely to be visible in a breach: data kept because deleting it was never anyone's job. Retention also interacts with every other step: it decides how far back the inventory has to reach, which purposes a notice has to cover, and how much data is in scope when something goes wrong.
- Get the processor chain in writing. Your contracts move at your counterparties' speed, not yours, which is why this starts early rather than at the end.
- Test the safeguards the security duty will ask about, then fix and retest with runway left — rather than discovering exploitable weaknesses in the month the duty lands.
The operational side of consent — collecting it, recording it, handling withdrawal, and what that means in an app or on a website — is worked through in consent management under the DPDP Act.
Questions
What teams ask about this date
Does my company have to use a Consent Manager from 13 November 2026?
No. That date opens registration of Consent Managers with the Data Protection Board under Rule 4; it does not oblige a Data Fiduciary to integrate one. The Act contemplates a Data Principal being able to give, manage and withdraw consent through a registered Consent Manager, which is a facility for the individual rather than a mandate on every business. If you are not planning to operate as a Consent Manager yourself, nothing becomes due for you on that date. The date that should be driving your programme is 13 May 2027, when notice, consent, security safeguards, breach intimation, retention and data-principal rights commence. Vendor copy describing 13 November 2026 as a mandatory integration deadline is selling against a duty that does not exist yet.
What actually is a Consent Manager under the DPDP Act?
It is an entity registered with the Data Protection Board that gives a Data Principal a single place to give, manage, review and withdraw consent across the organisations holding their data. The role exists for the individual's benefit, which is why it is the Consent Manager that registers rather than the businesses around it. It is not an officer you appoint, and it is not the same as a Data Protection Officer, which is a separate requirement falling on Significant Data Fiduciaries. SecureRoot is not a Consent Manager and does not register anyone as one: registration is something the entity does itself with the Board, and no consultancy can do it on another party's behalf. If a vendor offers to “register you as a Consent Manager”, ask whether they mean registering themselves and selling you access, which is a different commercial arrangement from the one that sentence describes.
If the real deadline is 13 May 2027, why start now?
Because the duties commence then and the work does not fit between now and then if it starts then. Finding personal data across applications, warehouses, partner integrations, support tooling and backups takes weeks in a mid-sized estate, and it is the step everything else is sequenced from. Consent redesign ships at your release cadence rather than on a compliance calendar. Processor contracts move at your counterparties' legal speed, not yours. And the security-safeguards duty is one that bites at the last date, so testing needs enough runway to fix what the test finds and retest it. Teams that begin in the final quarter generally discover the inventory problem first and the remediation problem too late. The sequence matters more than the start date: the inventory tells you what the rest of the programme is even about, so beginning anywhere else usually means doing that part twice.
Does our cookie banner already handle DPDP consent?
Not on its own. A cookie banner governs what runs in a browser; the DPDP Act governs personal data processing across your whole estate, including onboarding, support, marketing, analytics, vendors and backups. The two overlap at the point where a website collects data, and diverge everywhere else. A banner also cannot answer the questions the Act asks about purpose, retention and withdrawal for data your systems already hold. Treating banner consent as DPDP compliance is one of the more common misreadings we see, and it usually surfaces during a data-discovery exercise when somebody asks which purpose a five-year-old customer record is being kept under. The banner is worth having and is not the programme; if yours is the only consent mechanism you have, the gap is the estate behind it rather than the banner itself.
What did the 2025 Rules actually change, and when?
The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025, and they commence in three tranches rather than at once. The provisions establishing the Data Protection Board took effect immediately, which is regulatory machinery rather than a duty on a business. Rule 4, covering Consent Manager registration, commences twelve months later on 13 November 2026. The substantive obligations — notice, consent, security safeguards, breach intimation, retention and data-principal rights — commence eighteen months after notification, on 13 May 2027. Reading the dates as one distant deadline is the mistake: they are a sequence, and only the last one describes what most organisations have to do. Confirm which of the three reaches your entity before planning against any of them, because buying for the wrong tranche is how a compliance budget gets spent a year early on the wrong thing.
How does SecureRoot help, and what will it not do?
We run the work in front of 13 May 2027: data discovery across your systems and partners, purpose and notice mapping, retention design, processor-contract review, and testing of the safeguards the security duty will ask about, with remediation and a retest inside the same engagement. We will tell you on the scoping call whether you are a Data Fiduciary or a processor and which obligations genuinely reach you, because that answer changes the scope and sometimes shrinks it. What we will not do is register anyone as a Consent Manager, sell an integration that no date requires, or describe 13 November 2026 as your deadline when it is not. Where a consent platform genuinely suits your estate we will say so, and we do not resell one, so that recommendation costs us nothing either way.
Find out which date is actually yours
Tell us what you process and who you process it for. You get a straight answer on whether you are a Data Fiduciary or a processor, which obligations genuinely reach you, and a written scope and fixed price for the work in front of 13 May 2027 — which is sometimes smaller than the one you came in expecting.