What changed
Two notifications published on 13 November 2025 set the dates in stages. For Consent Managers the period is one year from that publication, which counts to 13 November 2026. The notifications give the period, not the calendar date.
On that day the Act's requirement that every Consent Manager be registered with the Board begins, and so does the Board's power to inquire into a breach of a registration condition. The Rules on how a Consent Manager registers and what it must do begin the same day.
The Rules say a person who meets the registration conditions may apply to the Board, giving the particulars and documents the Board publishes on its website. The Board may inquire, then either register the applicant or reject the application and give its reasons.
The Act's other duties for businesses do not start that day. The sections on notice, consent, the duties of a Data Fiduciary and the rights of a Data Principal begin on 13 May 2027, eighteen months after 13 November 2025.
Who it affects
- Anyone planning to register as a Consent Manager. The conditions include being a company incorporated in India with a net worth of not less than two crore rupees, and a platform that is independently certified.
- Businesses that collect consent but do not register as a Consent Manager. No duty of a Data Fiduciary starts on 13 November 2026. From 13 May 2027, when that part of the Act applies, the Act says a Data Principal may use a Consent Manager.
What to do
- If you plan to register, see whether the Board has published the application particulars the Rules refer to, read the conditions in full, and take advice before you apply.
- If you are not applying to register, the Data Fiduciary duties in the Act do not start on 13 November 2026. Use the time before 13 May 2027 to list the personal data you handle and where it goes.
Read next
- Consent Managers under the DPDP Rules: what starts on 13 November 2026
- The DPDP Act timeline: 13 Nov 2025, 13 Nov 2026, 13 May 2027
- Check whether the DPDP Act applies to your business
Sources
Every date and statement above was checked against the official text on 3 Nov 2026. Official sources only; no one else’s wording is reproduced.
Official text
- Notification G.S.R. 843(E), 13 November 2025Clause (b): Section 6(9) and Section 27(1)(d) of the Act come into force one year from publication. Clause (c): the Act's other duties, eighteen months from publication.www.meity.gov.in, official PDF · Retrieved
- Digital Personal Data Protection Act, 2023 (No. 22 of 2023)Section 6(7), Section 6(9) and Section 27(1)(d).www.meity.gov.in, official PDF · Retrieved
- DPDP Rules, 2025, G.S.R. 846(E), 13 November 2025Rule 1(3), Rule 1(4), Rule 4 and the First Schedule, Part A (items 1, 4 and 9).Gazette of India, Extraordinary, Part II, Section 3(i), No. 760 · Checked
A drafting aid. Get legal advice for your situation. This update reports the published text of the Act and the Rules.