From 13 November 2026, companies can register as consent managers under India's DPDP Rules, but brands are not required to use one. The deadline that matters for marketers is 13 May 2027.
01Rule 4 of India’s DPDP Rules, 2025 comes into force on 13 November 2026 and only opens registration for companies that want to operate as consent managers.
02The DPDP Rules do not require brands or other data fiduciaries to use a registered consent manager.
03A consent manager must be an Indian company with a net worth of at least ₹2 crore and must keep consent records for at least seven years.
04The DPDP notice, consent, breach and erasure obligations apply from 13 May 2027, about 188 days after 6 November 2026.
Seven days from now, on 13 November 2026, Rule 4 of India’s DPDP Rules switches on. Your inbox is probably full of vendors calling it the DPDP consent manager deadline. It isn’t your deadline. From that date, companies that want to become consent managers can register with the Data Protection Board. Brands are not required to use one.
The date that should worry marketers is 13 May 2027, when notice, consent, breach and erasure rules bite. That’s about 188 days away. Spend this week starting that work, not shopping for a consent manager.
No. Rule 4 of the Digital Personal Data Protection Rules, 2025 only opens registration for entities that want to operate as consent managers. Nothing in the Rules forces a brand, app or D2C store to route consent through one. You can keep collecting consent yourself, as long as your notices and consent flows meet the standard that applies from May 2027.
MeitY published the Rules in the Gazette on 13 November 2025 and phased them in. Rules 1, 2 and 17 to 21 applied at once. Rule 4 starts one year after publication. Rules 3, 5 to 16, 22 and 23 start 18 months after publication.
Even a vendor-side voice concedes the point. Chintan Shah, founder of compliance tool DPDP Guard.ai, wrote in a Social Samosa guest column on 2 November that the Rules “do not require data fiduciaries to use a Consent Manager.” Sumeet Lall and Nikhil Lal of CSL Chambers reached the same reading in a December 2025 analysis for Clyde & Co.
A consent manager is a registered, Indian-incorporated company that lets people give, review and withdraw consent across many businesses from one dashboard. The First Schedule asks for a net worth of at least ₹2 crore, independent certification of the platform and a design where the manager cannot read the data it routes.
It must also keep consent records for at least seven years and act as a fiduciary for the user, not for brands. A cookie banner vendor or CMP you license is not a consent manager unless the Board registers it.
Watch the pitch: if a vendor says you must “register with a consent manager by 13 November”, ask them to name the rule. There isn’t one. A registered consent manager may still be useful later, especially in lending and insurance, but buy it as a product decision, not a panic purchase.
From 13 May 2027, every brand processing personal data must give a standalone, plain-language notice listing the data it collects and the specific purpose, plus a link to withdraw consent, exercise rights and complain to the Board. Withdrawing must be as easy as consenting. Some lawyers count the date a day later, so treat 13 May as the hard stop. Breaches must be reported to affected people and the Board.
For marketing teams, four rules do the damage:
| Rule | What it says | Where marketing feels it |
|---|---|---|
| Rule 3 (notice) | Itemised data list, specific purpose, withdrawal link | Lead forms, app sign-ups, checkout, WhatsApp opt-ins |
| Rule 7 (breach) | Tell users without delay; detailed report to the Board within 72 hours | CRM exports, agency shared drives, ad-platform uploads |
| Rule 8 (erasure) | Large e-commerce and gaming platforms erase inactive users’ data after three years, with 48 hours’ warning | Dormant-user win-back lists |
| Rule 10 (children) | Verifiable parental consent before processing a child’s data | Edtech, gaming, toys, teen fashion |
Nobody has published an Indian opt-in rate under DPDP-style notices yet, so we won’t pretend to know yours. What you can do now is size the risk. If your first-party list was built through a bundled “I agree to the terms” checkbox, assume part of it won’t re-consent once you ask clearly.
Our maths (illustrative scenario): a D2C skincare brand in Pune has a 1,00,000-contact list it uploads to Meta and Google as a Custom Audience, and it spends ₹2 lakh a month retargeting that list.
| Share that re-consents | Usable audience | Monthly spend per remaining contact |
|---|---|---|
| 80% | 80,000 | ₹2.50 |
| 60% | 60,000 | ₹3.33 |
| 40% | 40,000 | ₹5.00 |
At 40%, the same budget chases less than half the people. Frequency climbs, CPMs on a small audience rise and your lookalike seeds shrink. So run the re-permission campaign before May, during a high-traffic window, not after. Our explainer on how Meta Andromeda scores every ad covers why broad targeting softens the blow.
The 13 November date is a licence for consent managers. The 13 May date is a test for you.
Possibly, which is the strongest argument against relaxing. Business Standard reported on 22 January 2026 that MeitY proposed cutting the 18-month window to 12 months for significant data fiduciaries such as big tech and large banks. IT Minister Ashwini Vaishnaw said in November 2025 the government wanted “to further compress time required for compliance”.
No amendment had been notified as of late October 2026, according to trackers at dpdprules.org and MirvoLegal. A 12-month window would land on 13 November 2026, so watch the Gazette this week. If you are a large platform or bank, assume the earlier date until told otherwise.
The other counterpoint: in BFSI, consent managers may become the norm anyway, the way account aggregators did for financial data. For a ₹5 crore D2C brand, it’s a 2027 question.
Ignore the 13 November scare. Don’t sign a consent manager contract this month unless you’re in lending or insurance and have a product reason. Do start a consent audit this week, because 188 days is barely two quarters and festive and IPL season will eat one of them. Large platforms and banks should plan as if the date moves forward.
Start with the places you collect data at volume. Your WhatsApp Business API opt-in flow and email capture are the usual offenders, because they bundle consent with T&Cs.
Then tag consent status in your analytics setup so your GA4 events and audiences respect withdrawals.
Rule 4 comes into force, so companies that meet the First Schedule conditions can apply to the Data Protection Board to register as consent managers. It does not create a new obligation for brands collecting consent directly.
No. The DPDP Rules do not require advertisers to use a consent manager. You do need valid, specific consent behind the customer data you upload to ad platforms once the core rules apply on 13 May 2027.
No. A consent management platform is software you license. A DPDP consent manager is an Indian company registered with the Data Protection Board that acts on behalf of users, cannot read the data it routes and must meet a ₹2 crore net worth test.
The DPDP Act allows penalties of up to ₹250 crore for failing to take reasonable security safeguards. Breach-notification failures and certain children’s data violations can attract up to ₹200 crore.
Business Standard reported in January 2026 that MeitY proposed a 12-month timeline for significant data fiduciaries such as big tech firms and large banks. No amendment had been notified as of late October 2026, so 13 May 2027 remains the computed date for most businesses.
Digital Evangelist and Entrepreneur at Clickseek Digital. A results-oriented marketing leader with an 18+ year track record driving transformative growth for diverse global businesses. Expert in performance marketing, demand generation, customer acquisition, strategic partnerships, and market expansion within B2B SaaS, Consumer-Tech, Fintech, Travel/Hospitality, and CRM/ITES Solutions sectors. IIM alumnus with a strong analytical background and a string of accolades, including "Top 50 Most Influential E-Commerce Professional of India" and "Top 100 Digital Marketer of India."
What changed in marketing and AI, why it matters and exactly what to do. In your inbox at 11:00 IST.
