In this story11 sections
- What the DPDP consent manager rules switch on from 13 November 2026
- A consent manager in plain words, and why your cookie tool is not one
- Do small businesses need a consent manager under DPDP?
- Who qualifies, and how to register as consent manager with Data Protection Board
- Mark the DPDP full compliance deadline 13 May 2027 on every calendar
- A DPDP consent notice format for website forms
- Is there a DPDP cookie consent banner requirement for Indian websites?
- How to do a personal data audit for business website and CRM records
- Security, breaches and the penalty for not complying with DPDP Act India
- Six months, six moves: a DPDP Act compliance checklist for small business India
- Frequently asked questions
On Friday, 13 November 2026, the DPDP consent manager rules come into force across India. From that date, companies that want to run licensed consent dashboards for citizens can seek registration with the Data Protection Board of India. For a bakery in Bhopal or a SaaS startup in Pune, the binding deadline sits later, on 13 May 2027. The groundwork on forms, cookies and stored customer data is what should begin this month.
| Item | Details |
|---|---|
| What changes | Section 6(9), Section 27(1)(d) and Rule 4 start: consent managers must register with the Data Protection Board of India |
| Who it affects now | Companies that want to operate as consent managers; ordinary businesses are not yet bound by the main duties |
| Key dates | Rules notified 13 November 2025 (Gazette 14 November 2025); consent manager provisions 13 November 2026; full compliance 13 May 2027 |
| Official source | MeitY data protection framework page |
| What to do | Audit stored data, rewrite form notices, fix the cookie banner, plan breach response |
What the DPDP consent manager rules switch on from 13 November 2026
From 13 November 2026, three pieces of India's privacy law go live together: Section 6(9) of the DPDP Act 2023, Section 27(1)(d) of the same Act, and Rule 4 of the DPDP Rules 2025. Section 6(9) says every consent manager must be registered with the Board. Section 27(1)(d) lets the Board act when a registered consent manager breaks its conditions. Rule 4 sets out the registration process: apply, face an inquiry, get registered or rejected with reasons, and stay under watch afterwards, with suspension or cancellation possible after a hearing.
The timetable comes from notifications MeitY issued on 13 November 2025, the day the Rules were made, with the Gazette notification published on 14 November 2025. That created a phased implementation: some parts started at once, the consent manager framework got 12 months, and almost everything else got 18. MeitY keeps the official texts on its data protection framework page.
Think of the DPDP consent manager rules as toll booths built before the expressway opens. The booths can go up from November; the traffic rules for ordinary businesses arrive in May 2027.
One wrinkle: MeitY invited applications for a Chairperson and Members in May 2026, yet LiveLaw reported on 1 August 2026 that the Board still had no appointed Chairperson or Members, and our checks on 4 November found no announcement since. Until the Board is staffed, registrations may move slowly.
A consent manager in plain words, and why your cookie tool is not one
A consent manager is a registered Indian company that lets a person give, manage, review and withdraw consent through one accessible, transparent and interoperable platform. Under the DPDP Act 2023 it works on behalf of the Data Principal, the individual the data belongs to, and not for the business collecting that data.
Picture Meera, whose details sit with a bank, a hospital chain and three shopping apps. Instead of five settings pages, she uses one dashboard. The consent manager records every consent given, denied or withdrawn, keeps those records for at least seven years, and must be unable to read the personal data that passes through it. It is a post office that logs every envelope but never opens one.
Consent manager vs consent management platform difference
The words sound alike; the jobs do not. A consent management platform, or CMP, is software a website owner buys or installs: the cookie banner, the preference centre, the log of who clicked what. It serves the Data Fiduciary, the business that decides why and how data is processed. A registered consent manager serves the user, answers to the Board, must avoid conflicts of interest and cannot sub-contract its duties. A CMP vendor does not become one by changing its brochure, and you need no Board registration to run your own cookie banner.
Do small businesses need a consent manager under DPDP?
No provision we found forces a small business to route consent through a registered consent manager. The Act lets a Data Principal give consent either directly to the business or through a consent manager, so the choice rests with the user, not the shop. The 13 November 2026 date licenses consent manager companies; it does not switch on the duties of ordinary Data Fiduciaries.
That distinction matters because a wave of sales pitches is likely. Some will hint that your website turns illegal on 13 November without a "DPDP-certified consent manager". Treat that like a phone call claiming your electricity will be cut tonight: verify before you pay.
Where a consent manager does touch you is integration. If customers start using a consent manager app and give or withdraw consent through it, you must honour those signals once the main obligations apply. Banks and large consumer brands will feel this first. A tuition centre with a few hundred enquiries a year will mostly handle consent through its own forms.
Two things follow. You need not sign up with anyone this month. You do need your own notice and consent process ready before May 2027, and the DPDP consent manager rules are a timely nudge to start.
Who qualifies, and how to register as consent manager with Data Protection Board
Only a company incorporated in India can apply, and it must show a net worth of at least ₹2 crore. That net worth requirement sits in Part A of the First Schedule to the DPDP Rules 2025, alongside a longer list of conditions:
- enough technical, operational and financial capacity to do the job;
- sound finances and management, with directors and senior staff of good reputation for fairness and integrity;
- company charter documents that lock in the conflict-of-interest duties, changeable only with Board approval;
- an independent certifier's confirmation that its interoperable platform meets the standards the Board publishes.
Rule 4 sets the route. The applicant files with the particulars and documents the Board lists on its website. The Board may inquire, then either registers the company and publishes its details or rejects the application with written reasons.
Registration is a leash, not a trophy. A registered consent manager must maintain audit mechanisms and report outcomes to the Board, publish details of its promoters, directors and any shareholder holding more than 2%, and seek Board approval before any change of control through sale or merger.
For founders, the ₹2 crore bar and certification make this a regulated business, closer to a payments company than a plugin.
Mark the DPDP full compliance deadline 13 May 2027 on every calendar
What binds ordinary businesses, from a two-person agency to a hospital chain, is the 13 May 2027 full compliance date, not the DPDP consent manager rules. On that day Sections 3 to 17 and 27 to 34 of the Act, along with Rules 3, 5 to 16, 22 and 23, come into force, according to the commencement schedule tracked by India Data Law.
That switches on consent notices, reasonable security safeguards, breach reporting, user rights, extra care for children's data, duties for any Significant Data Fiduciary, and penalties. Section 44(2), which amends the IT Act, also lands then, so the older IT Act regime runs until May 2027.
Will DPDP rules deadline be extended by government?
The signals so far point the other way. India Data Law reports that a Lok Sabha written answer on 12 August 2026 confirmed both the November 2026 and May 2027 dates, and that the MeitY Secretary said in August 2026 that no extension was under consideration. We could not trace the answer on the Parliament website, so read that as reported.
The only change MeitY has floated is tighter, not looser: an early 2026 consultation on cutting the window to 12 months for Significant Data Fiduciaries. Nothing has been notified. Planning around a reprieve is packing for a train you hope runs late. We will track any change in our cybersecurity news coverage.
A DPDP consent notice format for website forms
A workable notice is short, separate from your terms, and says exactly what you collect and why. Rule 3 of the DPDP Rules 2025 asks for a consent notice that stands on its own, uses clear and plain language, and gives an itemised description of the personal data along with the specified purpose and the goods or services it enables.
For a typical contact or lead form, that means:
- a two-line notice beside the submit button, such as "We collect your name, phone number and email to reply to your enquiry and send a quote";
- an unticked checkbox for anything extra, such as offers on WhatsApp or email, because a pre-ticked box is not a clear yes;
- a link to withdraw consent, use your rights and complain to the Board.
Consent under the Act must be free, specific, informed, unconditional and unambiguous. Bundle five purposes behind one tick and you fail.
People must be able to withdraw consent as easily as they gave it. If agreeing took one click, withdrawing cannot demand a signed letter; an unsubscribe link and a reply-STOP option cover most cases. Keep a readable privacy policy too, but a policy page alone is a signboard, not a gate.
Is there a DPDP cookie consent banner requirement for Indian websites?
Neither the Act nor the Rules mention cookies by name, so any cookie banner duty arises indirectly. The trigger is personal data, not the cookie itself. If a cookie, pixel or tag collects data that identifies a person, such as an advertising ID linked to a login, and you rely on consent to process it, the notice and consent duties apply from 13 May 2027.
Strictly necessary cookies that keep a cart or login alive are a separate case, which many lawyers treat as covered by the user's own request. Analytics and ad pixels carry the exposure. A sensible cookie banner offers Accept and Reject with equal weight and loads marketing tags only after a yes.
Leads from WhatsApp, Google Forms and plugins still count
Data does not stop being your responsibility because it lives in someone else's app. If you gather leads through a Google Form, a WhatsApp Business chat, a chatbot or a form plugin, you remain the Data Fiduciary, and the tool provider usually acts as your Data Processor. The Act expects a valid contract with each processor. Third-party scripts deserve a hard look, since a heatmap tool can quietly copy names to servers you have never seen. Every script on your page is a guest you invited, and you answer for its manners.
How to do a personal data audit for business website and CRM records
Start with one spreadsheet and one honest afternoon. The audit itself comes down to four questions of every place data enters, rests or leaves: what do we collect, why, where does it go, and when do we delete it.
A quick data mapping pass looks like this:
- List every entry point: contact forms, checkout, newsletter pop-ups, live chat, WhatsApp, call logs and walk-in registers.
- Follow each record into storage: CRM, inbox, Google Sheets, billing software, a sales rep's phone.
- Note every outside tool that touches it, and who in the team can see it.
- Write down the purpose and a deletion date.
How long customer data can stay on file
Data retention under the Act follows purpose. Once the purpose is served, or consent is withdrawn, you should erase the data unless another law, such as tax or accounting rules, requires you to keep it. Rule 8 separately asks Data Fiduciaries to keep the related personal data, traffic data and logs for at least one year. For most small firms the lesson is plain: a stale 2019 lead list is a liability sitting in a drawer.
Security, breaches and the penalty for not complying with DPDP Act India
The fine depends on what went wrong, and the ceilings are steep. Under the Schedule to the Act, as summarised in MeitY's November 2025 explainer, failing to keep reasonable security safeguards can draw up to ₹250 crore. Failing to report a breach, or breaking the rules on children's data, can cost up to ₹200 crore. Other breaches of the Act or Rules can reach ₹50 crore. These are ceilings; the Board weighs the gravity and duration of each breach.
What does "reasonable" mean for a small firm? Rule 6 points to encryption or masking, access control, logs to spot misuse, backups, and processor contracts demanding the same care. In everyday terms: HTTPS everywhere, two-step login on admin panels and email, updated plugins, and no customer sheets on shared laptops.
What to do when a breach happens
After a personal data breach, you must tell affected users without delay, in plain words: what happened, the likely impact, what you have done and whom to contact. Under Rule 7, the Board must also be informed without delay, with a detailed report within 72 hours unless it allows longer. Write that playbook now, while things are calm.
Treat this section as a plain-language summary rather than legal advice, and check MeitY's official texts or a qualified lawyer for your own case.
Six months, six moves: a DPDP Act compliance checklist for small business India
Six months is enough if you begin in November rather than April. Here is a month-by-month plan an owner can work through before 13 May 2027:
- November and December 2026: run the data audit above and delete what you no longer need.
- December: rewrite form notices, add unticked marketing checkboxes and test the withdrawal link.
- January 2027: fix the cookie banner so analytics and ad tags fire only after consent, and strip out third-party scripts nobody uses.
- February: sign or update processor contracts with hosting, email and CRM vendors.
- March: set up grievance redressal with a named contact, a published email and a promise to answer requests within 90 days, the outer limit in the Rules.
- April: draft a one-page breach playbook and rehearse it once with the team.
Also ask whether you handle children's data. A coaching class or a kids' activity site needs verifiable parental consent, which means confirming that the adult agreeing is a real, identifiable parent or guardian.
Form and banner changes usually belong with whoever handles your website development; notices, contracts and the playbook are desk work. None of it needs a registered consent manager, and none of it gets cheaper by waiting.
Frequently asked questions
Is the DPDP Act applicable to small businesses and startups?
Yes. The DPDP Act 2023 applies to anyone processing digital personal data in India, including data collected offline and later digitised, whatever the size of the business. There is no turnover exemption. The government may exempt classes such as startups from some duties, so check what has actually been notified.
When exactly were the DPDP Rules 2025 notified?
MeitY notified the DPDP Rules 2025 on 13 November 2025, and they appeared in the Gazette on 14 November 2025. Board provisions started at once; the DPDP consent manager rules follow after 12 months and most business duties after 18.
Does every website have to use a consent manager?
No. A consent manager is an option the law gives to users, not a mandatory tool for every website. A business can collect consent directly through its own forms, but must respect consent given or withdrawn through a registered consent manager once the main duties apply in May 2027.
What is the final date for full DPDP compliance?
The main obligations start on 13 May 2027, eighteen months after the Rules were notified. That covers notices, consent, security, breach reporting, user rights and penalties. Reported statements in August 2026 said no extension was planned; watch MeitY for changes.
Who counts as a Data Fiduciary under DPDP?
A Data Fiduciary is any person or organisation that, alone or with others, decides why and how personal data is processed. A shop owner collecting customer phone numbers, a school running admissions online and an app developer storing user accounts are all Data Fiduciaries for the data they control.
Will a privacy policy alone make my site DPDP compliant?
No. A privacy policy helps, but the law expects a clear, standalone consent notice at the point of collection, genuine opt-in choices, an easy way to withdraw consent, reasonable security, breach reporting and a working grievance contact. That is paperwork plus practice.
Are business email IDs from B2B leads covered by DPDP?
Often, yes. An email such as a named person's work address identifies an individual, so it counts as personal data even in a B2B context. A generic company inbox is less likely to qualify, but treat named CRM contacts like consumer data.
What extra rules apply to children's personal data?
Anyone under 18 is a child under the Act. Businesses must obtain verifiable consent from a parent or lawful guardian before processing a child's data, and must not track, behaviourally monitor or target advertising at children. The Rules allow limited exceptions for areas such as healthcare, education and safety.
Who enforces the DPDP Act in India?
The Data Protection Board of India enforces the Act. It works as a digital body that takes complaints online and can impose penalties once those provisions start. Appeals against its orders go to the Telecom Disputes Settlement and Appellate Tribunal.
Can a business be fined for not being compliant in November 2026?
Under the DPDP Act, the penalty provisions for ordinary business duties start on 13 May 2027, so the main fines cannot be imposed in November 2026. Other laws, such as the IT Act, still apply meanwhile. Use the gap to prepare, and take professional advice for your case.
Planning a website, web app or SEO upgrade?
Tell us what you need. We reply within one working day with a clear plan and price.
