Dark console-style card reading Consent managers open on 13 November. Who registers them?

India’s Consent Managers Open on 13 November. The Office That Registers Them Is Not Staffed

by
Reading Time: 5 minutes

Seedhi baat: a rule says you can apply from 13 November. But apply to whom?

A DPDP consent manager is a registered company that lets you give, manage, review and withdraw your consent across many apps from one place, and is accountable to you, not to the app. India’s rules for registering one start on about 13 November 2026.

🧭 What a Consent Manager Actually Is

Today, consent in India is scattered. Every bank, app and website asks separately, and you withdraw separately, if you can find the button.

The Digital Personal Data Protection Act, 2023 creates a middleman for this. It defines a consent manager as a person registered with the Board who acts as a single point of contact to enable you to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform. The Act also says the consent manager is accountable to you and acts on your behalf.

Think of it as a remote control for your consent, not a gatekeeper for the company.

🏦 The Bank Example From the Rules

The Rules explain this with a small story in the Gazette itself.

📌 Real-world case: X is a registered user on a consent manager’s platform, and two banks, B1 and B2, are onboarded onto it. B1 asks X, through the platform, for consent to process her bank statement. In one case X gives consent directly to B1. In the other, X keeps her account with B2, so she routes her consent through B2 and tells B2 to send the statement to B1. (DPDP Rules, 2025)

That is what “interoperable” means in practice. Consent travels across companies, and you steer it from one screen.

🔀 An Option, Not a Mandate

Here is a misunderstanding worth clearing early.

The Act says a person may give, manage, review or withdraw consent through a consent manager. It does not say they must. So most companies will not become consent managers, and individuals can still deal with companies directly. For many businesses, a consent manager will be something that shows up on the other side of a consent request, not something they register as.

That is also why the role is narrow and heavily screened.

🚧 Who Can Actually Become One

The Rules set a high bar, in Part A of the First Schedule. An applicant must be a company incorporated in India, with sufficient technical, operational and financial capacity, and a net worth of not less than ₹2 crore. Its directors and senior managers must be people of good reputation and integrity.

Two conditions stand out:

  • Conflict-of-interest clauses are written into the company’s own constitution. Its memorandum and articles must contain the conflict-of-interest provisions, and they can be changed only with the Board’s prior approval.
  • Independent certification is required. The applicant must show that its platform meets the data protection standards and assurance framework that the Board publishes, and that technical and organisational measures are in place.

This is not a weekend side project.

⚖️ What a Consent Manager Must (and Must Not) Do

Part B of the same Schedule sets the duties. In plain terms:

  • It must act in a fiduciary capacity toward you.
  • It must not be able to read the personal data that passes through it.
  • It must keep a record of consents given, denied and withdrawn, the notices behind them, and any data sharing, and keep that record for at least seven years.
  • It must give you access to that record, and a machine-readable copy on request.
  • It cannot sub-contract its obligations.
  • It must avoid conflicts of interest with the companies it works with, including their promoters and senior managers, and publish who owns more than two percent of it.

Seen together, my reading is that the design is a neutral, audited intermediary that is deliberately kept blind to your data.

It is also not a one-time licence. Rule 4 lets the Board direct a consent manager to fix lapses, and, after giving it a hearing, suspend or cancel its registration in the interests of users. A consent manager that cuts corners can lose the right to operate.

🧾 Why Companies May Still Care

If consent managers are optional, why should an ordinary business pay attention?

Because of a line in the Act that has nothing to do with intermediaries. Where consent is the basis for processing and a dispute arises, the company, not you, must prove that it gave notice and that you consented. That is a heavy burden when consent is collected across many screens and many systems.

A consent manager keeps a record of exactly that: the consent, the notice that came with it, and any sharing that followed. For a company, a clean record held by a regulated third party could be easier to defend than a patchwork of its own logs. That is my inference, not something the Rules say, and it depends on consent managers actually being registered, which brings us back to the registrar.

🪑 The Twist: The Registrar

Now to the question in the title.

Rule 4 comes into force one year after the Rules were published, which is about 13 November 2026. Under it, applicants apply to the Board, the Data Protection Board of India. The Board decides whether to register them and publishes the particulars of those it registers. The Rule even says applicants must furnish the information and documents that the Board publishes on its website, and the standards for that independent certification are also ones the Board is to publish.

So the starting gun depends on a body that has to exist and act.

Here is what reporting says about that body. LiveLaw wrote on 1 August 2026 that no Chairperson or Members had been appointed, after the government sought nominations in May and June. On 10 October 2026, it reported that the Kerala High Court was told, in a public-interest case, that the Board has been constituted but “has not made functional”, and the court expected it to be made functional within eight weeks. (LiveLaw)

The hearing was reported on 10 October, so eight weeks runs to roughly early December, after 13 November. I found no notice of appointments, though a few websites claim a chairperson already exists, and I could not find an official source for that. Check MeitY’s site before you rely on any claim either way.

🪙 Token Truth

A date in a rulebook is not a working system.

Rules switch on by the calendar. Registers, portals and standards switch on when people are hired, forms are published and standards are written. The gap between the two is where most real-world compliance trouble lives. (If you want that thread, start with Episode 1 of The Token Diaries.)

📅 Dates That Are Easy to Mix Up

A short cheat sheet, because articles online blur these:

  • About 13 November 2026: Rule 4 only, the consent manager registration framework.
  • About 13 May 2027: the remaining operating rules, including Rules 3 and 5 to 16 and 22 and 23.
  • 13 vs 14 November: you will see both. The Rules are dated 13 November 2025, and some sources count from the day after, so treat this as a one-day difference.
  • A shorter timeline? MeitY consulted in January 2026 on shortening some deadlines. I found no notified change, so plan on the dates above and watch the Gazette.

✅ What to Do Now

Sach batao, the right move depends on who you are:

  1. A company that collects consent: do not rush to register as anything. Map where your consent flows and make sure withdrawal works, because many of the main duties arrive in May 2027.
  2. Thinking of becoming a consent manager: check the ₹2 crore net worth and the independent certification first, then watch for the Board’s application format and standards before spending on a platform.
  3. An ordinary user: nothing changes on 13 November. Consent managers will appear only after the Board registers them.

None of this is legal advice, but it is a fair reading of the text.

If consent managers were live tomorrow, would you trust one company to hold the remote control for all your consent, or would you rather deal with each app yourself?

📚 References

What’s your Reaction?
+1
0
+1
0
+1
0
+1
0
+1
0
+1
0
+1
0