DPDP consent manager rules: what apps must build before 2027

The DPDP consent manager date everyone is circling, November 2026, does not require your app to change anything. Under the Digital Personal Data Protection Rules, 2025, rule 4 lets companies register with the Data Protection Board as consent managers one year after publication. The obligations your product team has to ship (consent notices, security logs, breach alerts, rights requests) arrive six months later, in May 2027. This post sets out both dates as the Gazette states them, what a consent manager actually is, and the build list that has to be finished before the second one.

We build apps for Indian businesses, and this is the reading we are using to plan that work as of September 2026. It is an engineering reading, not legal advice: confirm every date and obligation that applies to you with counsel.

When do the DPDP rules apply? The Gazette says 13 November, PIB says 14

The rules phase in over three dates, and the commencement clause ties all three to the date of publication. Rule 1 of the notified text reads: rules 1, 2 and 17 to 21 come into force on publication; rule 4 "one year after the date of publication"; and rules 3, 5 to 16, 22 and 23 "eighteen months after the date of publication" (G.S.R. 846(E), rule 1).

Here is where secondary coverage splits by a day. The Gazette of India Extraordinary carrying the rules is headed "No. 760, New Delhi, Thursday, November 13, 2025", and the notification itself is dated "the 13th November, 2025". The Press Information Bureau backgrounder says the rules were "notified on 14 November 2025", and the e-Gazette identifier printed on the same document ends 14112025, which looks like an upload date. We plan to the earlier date, because missing a deadline by a day costs more than meeting it a day early.

What switches on	Rules	From (Gazette date)	From (PIB date)
Definitions, Data Protection Board set-up, Board as a digital office	1, 2, 17–21	13 Nov 2025	14 Nov 2025
Consent manager registration and obligations	4	13 Nov 2026	14 Nov 2026
Notice, security safeguards, breach intimation, retention, children's consent, data principal rights, appeals, information calls	3, 5–16, 22, 23	13 May 2027	14 May 2027

The PIB note describes this as "an eighteen-month period for phased compliance". That is accurate, but it hides the useful part: almost every rule that touches a consumer app sits in the last row.

What is a DPDP consent manager?

A consent manager under DPDP is a registered company that runs a single, interoperable platform through which a person can give, manage, review or withdraw consent to data fiduciaries. That is the definition PIB uses, and it tracks section 6(7) of the Digital Personal Data Protection Act, 2023: "The Data Principal may give, manage, review or withdraw her consent to the Data Fiduciary through a Consent Manager."

Note the verb. The Act says the person may use a consent manager. Nothing we read in the Act or the rules requires your app to onboard onto one. What changes in November 2026 is that the Board can start registering them.

DPDP consent manager registration from November 2026: who qualifies

Part A of the First Schedule sets the registration conditions. As stated in the rules, the applicant must be a company incorporated in India, with net worth of not less than two crore rupees, sound finances and management, directors and senior management "with a general reputation and record of fairness and integrity", and an interoperable platform that is independently certified against standards the Board will publish on its website (First Schedule, Part A). PIB summarises this as consent managers having to "be companies based in India"; the rule text says incorporated in India, which is the wording to rely on.

Part B sets the obligations, and three of them matter to anyone deciding whether to integrate:

• The consent manager must share data so "the contents thereof are not readable by it". It routes consent and data; it does not get to read them.
• It must keep a record of consents given, denied or withdrawn, the notices that accompanied each request, and each data share, and keep that record "for at least seven years".
• It cannot sub-contract any of its obligations, must avoid conflicts of interest with data fiduciaries, and needs the Board's prior approval before a change of control.

When we checked in September 2026, we could not find the Board's certification standards published. Until they are, and until the Board lists registered consent managers on its website as rule 4(2) requires, there is nothing to integrate with.

What must an app change for DPDP by May 2027?

The May 2027 rules turn into six pieces of product work. Each maps to a specific rule, which makes it easier to scope and to test.

1. A consent notice that stands on its own

Rule 3 requires the notice to be "understandable independently of any other information", to give "an itemised description" of the personal data, the specified purpose, and a description of the goods, services or uses it enables. It must also link to where the person can withdraw consent, exercise rights and complain to the Board. A link to your privacy policy does not meet "independently". Budget for a purpose-by-purpose notice screen, and for the language option: section 6(3) of the Act lets the person read a consent request in English or any language in the Eighth Schedule to the Constitution.

2. Withdrawal as easy as consent

The notice must describe how to withdraw consent "with the ease of doing so being comparable to that with which such consent was given". If consent was one tap at sign-up, withdrawal buried in an email-support flow is the gap. Section 6(6) then requires you to stop processing, and to make your data processors stop, within a reasonable time. That means the withdrawal event has to propagate to every downstream system and vendor that holds the data, not only flip a flag in your own database.

3. A consent log you can produce in a dispute

Section 6(10) of the Act puts the burden on you: where consent is the basis of processing and it is questioned, the data fiduciary "shall be obliged to prove that a notice was given" and that consent was given. That is the engineering case for an append-only consent ledger recording which notice version was shown, which purposes were accepted, when, through which channel, and every later withdrawal. It is the same record a consent manager has to keep for seven years under Part B; if you build in-house, you are building that record yourself.

4. Security logs kept for a year

Rule 6 lists the minimum reasonable security safeguards: encryption, obfuscation, masking or tokenisation; access control; "visibility on the accessing of such personal data, through appropriate logs, monitoring and review"; backups for continued processing; and retention of "such logs and personal data for a period of one year". Rule 8(3) separately requires personal data, traffic data and processing logs to be kept for at least one year from the date of processing. Your processor contracts also have to carry security clauses. If your access logs roll over after 30 days today, this is a storage and pipeline change, not a policy edit.

5. DPDP breach reporting within 72 hours

Rule 7 has two clocks. Affected users must be told "without delay", through their user account or a registered channel, with the nature and timing of the breach, the likely consequences, what you are doing, what they can do, and a contact. The Board gets a description "without delay" and then, "within seventy-two hours of becoming aware of the breach", a detailed report covering causes, mitigation, any findings about who caused it, remedial steps and a report on the user notifications. That second report needs a runbook, an owner and an incident timeline you can reconstruct from your logs.

6. Data principal rights, with a published route and a 90-day ceiling

Rule 14 requires you to publish on your website or app how a person can request access, correction, updating or erasure, and what identifier you need from them. Your grievance redressal period must be published and cannot exceed ninety days, which PIB summarises as a 90-day response requirement. Rule 9 adds that the contact for your Data Protection Officer or an equivalent person must be prominently published and included in every rights response. Rule 10 adds verifiable parental consent for children's data; if your app has users under 18, we covered the design problem of age checks in why "enter your birthday" no longer counts, and the same trap applies here.

Consent management for apps in India: integrate, build, or wait

The choice most product owners are weighing is whether to integrate a registered consent manager or build consent management in-house. The honest answer depends on which problem you are solving.

Path	What it gives you	What it does not
Integrate a registered consent manager	A platform users may already trust; its own seven-year consent record; interoperable consent across fiduciaries on the platform	Nothing to integrate until the Board registers one after 13 November 2026; does not replace your own notice, security, breach or rights duties
Build consent in-house	Full control of notice, logging and withdrawal; no dependency on the Board's registration timeline	You carry the burden of proof under section 6(10) alone, so the ledger has to be right
Wait until May 2027	Time to see which consent managers register and what the Board's standards say	Rules 3 and 5 to 16 apply in full on day one; there is no second grace period in the text

The strongest case for waiting is real: the Board has not yet published the certification standards consent managers must meet, and building against an interface that does not exist is waste. That argument covers the integration, not the obligations. A consent manager handles one channel through which consent can arrive. Your notice screen, your withdrawal propagation, your one-year logs and your 72-hour breach report are yours whichever route consent takes. This is where a lot of early commentary overstates the consent manager's role.

Our working plan is to build the consent ledger in-house with a clean interface for consent events, so a consent manager can later become one more source of those events. It keeps the product compliant in May 2027 regardless of how quickly the consent manager market forms. It is the wrong choice if you run a very small app with a single consent purpose; there, a well-built notice and a withdrawal toggle may be all the in-house part you need, and you should say so to your counsel rather than over-build. For apps that already receive data by consent from a government rail, the AgriStack consent flow for agritech apps shows how a consent artefact can be treated as an event in your system rather than a checkbox.

DPDP rules compliance checklist for apps, with the penalties attached

The penalties explain why security and breach work should start first. PIB's summary of the Act puts the highest penalty, up to ₹250 crore, on failing to maintain reasonable security safeguards; up to ₹200 crore each for failing to notify the Board or affected people of a breach and for breaching obligations relating to children; and up to ₹50 crore for other violations (PIB backgrounder, 17 November 2025).

1. Map every personal data field to a purpose. You cannot write an itemised notice without it.
2. Version your consent notices and store the version shown with each consent event.
3. Make withdrawal a first-class API event that fans out to processors and vendors.
4. Extend access and processing log retention to at least one year, and check your processor contracts.
5. Write the breach runbook with two clocks: users without delay, the Board's detailed report within 72 hours.
6. Publish the rights request route, the identifier you need, the contact person and a grievance period no longer than 90 days.
7. If you process children's data, design verifiable parental consent before you design anything else in onboarding.

Significant Data Fiduciaries, a category the government notifies, have extra duties under rule 13: an annual Data Protection Impact Assessment and audit, due diligence on algorithmic software, and possible restrictions on transferring specified data outside India. Most apps we build will not be in that category, but if you handle large volumes of sensitive data, ask counsel early. The cross-border question also touches AI features; we set out what stays in India in OpenAI data residency in India and the UAE.

The next decision is scope, not vendor

With under eight weeks to the consent manager date and under eight months to the main deadline as of 22 September 2026, the decision to make now is what the in-house part covers, not which consent manager to pick. Start with the data-to-purpose map and the log retention change, because both take longest and both feed every other item on the list. If you want a team to scope the consent ledger, withdrawal propagation and breach tooling into your existing product, that is custom software development work we do; bring your counsel's reading of the rules to the first call, and we will build to it.