Consent Manager Window Opens November 13: Technical Architecture & Compliance Checklist

On 13 November 2026, Phase II of India's Digital Personal Data Protection framework comes into active effect under Rule 4 of the DPDP Rules, 2025. This milestone officially operationalises the registration portal for Consent Managers with the Data Protection Board of India (DPBI).

1. Who Can Register as a Consent Manager?

Under Section 2(g) of the DPDP Act and Rule 4, an applicant must:

• Be an entity incorporated in India under the Companies Act, 2013.
• Maintain a minimum net worth of ₹2 crore verified by an independent chartered accountant.
• Demonstrate an audited, interoperable technical architecture capable of delivering an accessible electronic dashboard for Data Principals.
• Satisfy conflict-of-interest firewalls: A Consent Manager cannot act as a Data Fiduciary or Data Processor for the data whose consent it manages, nor monetise, profile, or sell personal data.

2. Action Required by Data Fiduciaries

Even if an enterprise is not applying to become a Consent Manager, all Data Fiduciaries must prepare their backend systems:

• Interoperable Consent APIs: Ensure your systems can accept, log, and reconcile machine-readable consent notices and withdrawal signals transmitted by Board-registered Consent Managers.
• Audit Trails: Replace simple website cookie banners with cryptographically verifiable consent lifecycles recording timestamp, language, and specific purpose.
• Substantive Enforcement Countdown: Full substantive compliance across Sections 3–17 (including breach penalties up to ₹250 crore) becomes enforceable on 13 May 2027.