Every app you use asks for your data, and today you manage that consent one app at a time. From mid-November 2026, India’s data protection rules open the door to a new kind of company, called a consent manager, that is meant to let you handle those choices from one place.
What is a consent manager?
The Digital Personal Data Protection (DPDP) Act defines a consent manager as a person registered with the Data Protection Board who acts as a single point of contact. Its job is to help you give, manage, review and withdraw your consent through an accessible, transparent and interoperable platform.
Think of it like a key-holder for your permissions. Today, your bank, a shopping app and a fitness app each keep their own record of what you agreed to. With a consent manager, you could open one dashboard, see which companies you have allowed to use which data, and switch one of them off without hunting through three different apps.
Importantly, the consent manager is not meant to be a data warehouse. A law-firm explainer that read the rules says the platform must not be able to read the content of the personal data passing through it, keeping only routing details. It must also keep consent records that are tamper-proof, auditable and available to you in machine-readable form, and it must act in a fiduciary capacity towards you, meaning in your interest.
Nov 2026 versus May 2027: the timeline
The DPDP Rules, 2025 were notified in the second week of November 2025 and are being switched on in phases. Sources give 13 or 14 November for the notification, so treat the exact day as something to check in the Gazette.
| When | What starts | Reported by |
|---|---|---|
| 13 November 2025 | Rules 1, 2 and 17 to 21: definitions and the setting up and working of the Data Protection Board | SCC Online |
| 13 or 14 November 2026 | Rule 4 and the First Schedule: registration and obligations of consent managers | SCC Online and Maheshwari and Co. say 13 Nov; a second SCC Online article says 14 Nov |
| 13 May 2027 | Rules 3 and 5 to 16 and 22 to 23: notices, safeguards, breach reporting, children’s data, grievance handling and more | SCC Online |
The 13 versus 14 November puzzle
The sources we reviewed do not agree. One SCC Online summary lists Rule 4 as effective from 13 November 2026, and a law-firm note from Maheshwari and Co. also says 13 November. A separate SCC Online article says Rule 4 comes into force on 14 November 2026, exactly one year after publication in the Gazette. Companies and readers should confirm the exact day against the official Gazette text on the MeitY website rather than rely on any single explainer.
What happens in November 2026
Rule 4 is about companies, not about you directly. From that date, a firm that meets the conditions in Part A of the First Schedule can apply to the Data Protection Board. The Board will either register it or reject it with reasons. After registration, the firm must follow Part B obligations, and the Board can order corrections or, after a hearing, suspend or cancel the registration.
According to the Maheshwari and Co. explainer, the entry bar includes:
- A net worth of at least Rs 2 crore.
- Sound finances, and directors and senior managers of good reputation and integrity.
- Technical, operational and financial capacity to run the platform.
- Platform certification by an independent certifier against the Board’s assurance framework, which the same article says was not yet published.
The same explainer lists other duties: avoiding conflicts of interest, disclosing promoters and anyone holding more than 2 percent, and keeping consent records for seven years. An SCC Online article adds that, until Rule 4 starts, no company can hold a valid consent manager registration. So do not expect consent manager apps on day one. Registration, certification and onboarding of other companies will take time.
What changes for users in May 2027
Most of the duties that touch you directly are scheduled for 13 May 2027. Based on the SCC Online summary, they include:
- Clear notices that say what data is collected, why, and how to withdraw consent or complain (Rule 3).
- Verifiable parental consent before a company processes a child’s data (Rule 10), with some exemptions for areas such as education and healthcare.
- A guardian check for people with disabilities, using legally valid guardianship (Rule 11).
- Grievance systems that must respond within 90 days.
- The option to nominate someone to act for you, and published contact details for the company’s data protection officer or responsible person (Rule 9).
- Breach alerts to affected people, and to the Board, with a detailed report within 72 hours.
What to do now
You do not need to wait for 2027 to tidy up your digital footprint. Practical steps:
- Open your phone’s privacy settings and review which apps can see your location, contacts, camera, microphone and photos. Remove access that an app does not need.
- Delete apps you no longer use, and ask the company to delete your account data where the app allows it.
- Read the permission screen before tapping Accept, especially in finance, health and children’s apps.
- Note where each app lets you withdraw consent. From May 2027, notices are meant to explain this plainly.
- If you are a parent, check which apps your child uses and what they collect.
- When consent managers launch, check that a provider is actually registered with the Data Protection Board before linking your accounts.
What it means for businesses
Companies that collect personal data have until May 2027 to get their notices, safeguards and grievance handling in order. Firms thinking of becoming consent managers should check the net worth and conflict-of-interest conditions early. The Maheshwari and Co. article suggests a sister company of a firm it serves would struggle to act as an independent consent manager.
The bottom line
Consent managers could make privacy choices much easier, but November 2026 only opens registration; it does not hand you a ready-made dashboard. The changes you will feel as a user, such as clearer notices, children’s protections and complaint handling, are scheduled for May 2027. Until then, a regular review of app permissions is the most useful step you can take. Confirm the exact start dates on the official Gazette or MeitY site.
This article is for information only and is not legal advice. Dates and rules may be updated, so check official sources before acting.
Leave a Reply