What is the DPDP consent manager deadline?

It is the date Rule 4 of India's DPDP Rules, 2025 comes into force, one year after the Rules were published in the Gazette. That is about November 13, 2026, though some law firms count it as November 12. From then, Indian companies that meet the First Schedule conditions can apply to the Data Protection Board to register as Consent Managers.

When do the main DPDP obligations apply?

Rules 3, 5 to 16, 22 and 23 apply 18 months after publication, around May 13, 2027. They cover notices, security safeguards, breach reporting, retention and erasure, children's data, Significant Data Fiduciary duties, rights requests and cross-border transfers. MeitY proposed shortening this for some large companies in early 2026, but no amendment had been notified as of September 2026.

What is a Consent Manager under the DPDP Act?

A Consent Manager is a company registered with the Data Protection Board that gives people a single platform to give, manage, review and withdraw consent across many brands. It must be incorporated in India, have at least ₹2 crore net worth, act for the customer, keep records for seven years and be unable to read the data it routes.

Do brands have to use a Consent Manager?

No. The Act says a person may give or withdraw consent through a Consent Manager, which makes it an option for the customer. Brands still need their own notices and consent capture. If a customer does use a Consent Manager, the brand must act on consents and withdrawals that arrive through that platform.

Is a Consent Manager the same as a consent management platform?

No. A consent management platform is software a brand runs, such as a cookie banner and preference center. A Consent Manager is a regulated third party registered with the Data Protection Board that acts on behalf of the individual. MeitY's non-binding Business Requirement Document gives guidance for consent management software, not for Consent Manager registration.

Can marketers rely on legitimate interests under the DPDP Act?

No general legitimate-interests ground exists. Personal data can be processed with consent or for the specific legitimate uses listed in section 7, such as data a person voluntarily provides for a specific purpose, legal obligations or employment. Promotional marketing is not on that list, so plan on clear, separate consent for marketing communications.

What languages must DPDP notices be available in?

Sections 5(3) and 6(3) require brands to give people the option to access the notice and consent request in English or any language listed in the Eighth Schedule to the Constitution. Rule 3 adds that the notice must be in clear and plain language, stand on its own and itemize the data and purpose.

How does the DPDP Act treat children's data?

A child is anyone under 18. Brands need verifiable consent from a parent before processing a child's personal data, and must not track, behaviorally monitor or target advertising at children. Rule 10 requires checking that the parent is an identifiable adult. Some exemptions apply, for example to healthcare providers and educational institutions.

How fast must a data breach be reported under the DPDP Rules?

Rule 7 requires a brand to inform each affected person without delay and to inform the Data Protection Board without delay. A detailed report to the Board, covering facts, causes, mitigation and notifications sent, is due within 72 hours of becoming aware of the breach, unless the Board allows longer on a written request.

Does the DPDP Act apply to companies outside India?

Yes, in part. Section 3(b) applies the Act to processing outside India when it is connected to offering goods or services to people in India. A global brand selling to Indian customers through its website or app must meet the same notice, consent, security and breach obligations for those customers' data.

Are martech vendors responsible under the DPDP Act?

Martech vendors that process data on a brand's behalf are Data Processors, but the brand remains responsible for their processing regardless of contract terms. Brands may use processors only under a valid contract, should include security safeguards in it, and must make processors erase data when consent is withdrawn or the purpose ends.

DPDP Consent Manager Deadline for Marketers

Q: What are the penalties under the DPDP Act?

The Schedule to the Act sets maximum penalties of ₹250 crore for failing to take reasonable security safeguards, ₹200 crore each for failing to notify a breach and for breaching children's data obligations, ₹150 crore for Significant Data Fiduciary failures and ₹50 crore for any other breach of the Act or Rules.

The DPDP consent manager deadline is the date Rule 4 of India's Digital Personal Data Protection (DPDP) Rules, 2025 takes effect: about November 13, 2026, one year after the Rules were published. From then, companies can register as Consent Managers. The bigger date for marketers is about May 13, 2027, when notice, consent, security and breach duties apply.

Key Takeaways

Rule 4 on Consent Manager registration starts one year after Gazette publication, around November 13, 2026. Some law firms date it November 12.
Most marketing obligations start 18 months after publication, around May 13, 2027: notices, consent, security, breach reporting, children's data, retention and rights.
Consent Managers are optional for your customers and regulated by the Data Protection Board. They do not replace your own consent capture or your cookie banner.
Every martech vendor that touches personal data is your Data Processor. You stay liable for what it does, so contracts and erasure flows matter.
Penalties reach ₹250 crore for security failures and ₹200 crore for breach notification or children's data failures.

This analysis is for CMOs, growth leads and marketing operations teams in India, and for global brands with Indian customers. Cyberdunes builds websites and the Apex^® platform used by Indian businesses, so consent flows, tag management and data retention are part of our daily delivery work. We read the Act, the Rules and the Press Information Bureau (PIB) release in full. This is not legal advice. Confirm your obligations with qualified counsel.

What Changes on November 13, 2026?

Rule 4 comes into force, so the Data Protection Board can register Consent Managers. Nothing changes yet in what your marketing team must do; the consent and notice duties start in May 2027.

The DPDP Rules, 2025 (G.S.R. 846(E)) are dated November 13, 2025. Rule 1 says Rule 4 "shall come into force one year after the date of publication." AZB & Partners notes that sections 6(9) and 27(1)(d) of the Act, which cover Consent Manager registration and the Board's power over breaches of it, start on the same one-year date.

To register, a Consent Manager must meet the First Schedule conditions. The ones that matter for vendor selection:

It is a company incorporated in India, with a net worth of at least ₹2 crore.
Its platform is independently certified against standards the Board will publish.
Its directors and managers must avoid conflicts of interest with the Data Fiduciaries (brands) on its platform.
It cannot sub-contract its obligations, and control cannot change hands without the Board's approval.

One practical gap: the Board itself. As of August 2026, LiveLaw reported that the Board had no appointed Chairperson or Members. MirvoLegal, stating the law as at September 20, 2026, says the Ministry of Electronics and Information Technology (MeitY) invited applications on May 6, 2026, and no appointments had been reported. Registration may open on paper before anyone can process applications.

What Is the Full DPDP Compliance Timeline?

The Act was enacted on August 11, 2023. The Rules were notified in November 2025 and phase in over 18 months, with core duties from around May 13, 2027.

Five-step timeline from the DPDP Act in August 2023 to Rules notified in November 2025, the 2026 shortening proposal, Consent Manager registration in November 2026 and core duties in May 2027. — Consent Managers come first, in November 2026; the duties that change marketing arrive six months later.

Phase	Date	What comes into force
On publication	November 13, 2025	Rules 1, 2 and 17 to 21: definitions, Board appointments, meetings and its digital office
One year	About November 13, 2026	Rule 4: Consent Manager registration and obligations
Eighteen months	About May 13, 2027	Rules 3 and 5 to 16, 22 and 23: notice, security, breach reporting, retention, children's data, Significant Data Fiduciaries, rights, transfers, appeals

Why "about"? The Gazette notification is dated November 13, 2025, and PIB's explainer says the Rules were notified on November 14. AZB counts to November 12, 2026 and May 12, 2027; MirvoLegal uses November 13 and May 13. Plan for the earliest reading.

The deadline could also move earlier for some companies. S.S. Rana & Co. reported in April 2026 that MeitY proposed cutting the window from 18 to 12 months for Significant Data Fiduciaries, with comments due February 4, 2026. MirvoLegal found no amending notification as at September 2026. Large consumer brands should prepare as if November 2026 could apply to them.

A Consent Manager is a registered platform where a person gives, reviews and withdraws consent across many brands in one place. It acts for the customer, not for you.

Section 6(7) of the Act says a Data Principal "may give, manage, review or withdraw her consent to the Data Fiduciary through a Consent Manager." The First Schedule, Part B, sets the operating rules:

It must keep a record of consents given, denied or withdrawn, the notices behind them and any data sharing, for at least seven years.
It must make data available "such that the contents thereof are not readable by it." It routes; it does not read.
It must act "in a fiduciary capacity in relation to the Data Principal."
It must publish its promoters, directors and any shareholder above 2%.

A Consent Manager is a regulated channel your customers may use, not software you buy to replace your own consent flow.

Do not confuse a Consent Manager with a consent management platform (CMP). Your cookie banner and preference center are your software. MeitY's Business Requirement Document (BRD) for consent management systems, which AZB described in June 2025 as "non-binding and not a part of the DPDP Act", is guidance for that software. It covers cookie consent and tamper-proof logs with a timestamp, user ID, purpose ID, session ID and consent method for each consent.

For marketers, the effect is simple. If a customer withdraws consent through a Consent Manager, your customer relationship management (CRM) system, email platform and ad audiences must reflect it, just as if she had clicked unsubscribe on your site.

What Must Marketing Teams Change by May 2027?

Seven things: how you ask for consent, how you write notices, how you treat children, how long you keep data, how you contract vendors, how you report breaches and how you answer requests.

Consent must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action" and limited to data needed for the stated purpose (section 6(1)). Withdrawal must be as easy as giving consent (section 6(4)). In practice: a separate, unticked opt-in for marketing, not bundled with terms of service, and a one-click unsubscribe that reaches every system. When you review tools, check how each handles consent and unsubscribes; our comparison of email marketing tools is a starting point. The Act has no general "legitimate interests" ground like Europe's General Data Protection Regulation (GDPR); section 7 lists specific legitimate uses, such as data a person voluntarily provides for a stated purpose, and none of them is a general marketing ground.

Notices in Plain Language and Indian Languages

Rule 3 requires a notice that stands on its own, gives an "itemised description" of the data and the specific purpose, and links to withdrawal, rights and complaints. Sections 5(3) and 6(3) require you to give the option to read the notice and consent request in English or any language in the Eighth Schedule to the Constitution. For a pan-India brand, that means translated notices, not just a translated homepage. Section 5(2) also requires a notice to customers whose consent you collected before the Act, "as soon as it is reasonably practicable."

Children's Data and Verifiable Parental Consent

A child is anyone under 18. Section 9 requires verifiable parental consent before processing a child's data and bans "tracking or behavioural monitoring of children or targeted advertising directed at children." Rule 10 says you must check the parent is an identifiable adult, using details you already hold or a virtual token from an authorized entity such as a Digital Locker service provider. If your audience includes students, gamers or young shoppers, audit every pixel and lookalike audience.

Retention and Erasure

Erase personal data when consent is withdrawn or the purpose is served, and make your processors erase it too (section 8(7)). Rule 8(3) also requires you to keep processing logs for at least one year. Ecommerce entities with at least two crore registered users in India must erase data three years after a user's last contact, with 48 hours' notice before erasure (Rule 8 and Third Schedule).

Processors: Your Martech Vendors

Your email platform, CRM, customer data platform, ad pixels and chatbot vendor are Data Processors. You remain responsible for their processing "irrespective of any agreement to the contrary" (section 8(1)) and can only use them "under a valid contract" (section 8(2)). Rule 6(1)(f) asks for security terms in those contracts. A martech stack audit is the fastest way to find every vendor that touches personal data.

Breach Reporting Timelines

Under Rule 7, you must inform each affected person "without delay" in plain language, and inform the Board without delay, followed by a detailed report within 72 hours of becoming aware. A leaked newsletter list or a misconfigured form counts. Our website security checklist covers the basics that prevent most of these.

Rights Requests and Records

Publish a contact for data questions (Rule 9) and a way to request access, correction or erasure. Rule 14 sets a response period of no more than 90 days. Keep consent records you can produce: section 6(10) puts the burden on you to prove notice and consent if it is questioned.

What Do Global Brands With Indian Users Need to Know?

The Act applies to processing outside India "if such processing is in connection with any activity related to offering of goods or services to Data Principals within the territory of India" (section 3(b)). If you sell to Indian customers, it applies to you.

Three differences from GDPR trip up global teams:

No general legitimate-interests basis for marketing. Plan on consent for promotional use.
Under-18 is a child. The DPDP Act defines a child as anyone under 18 (section 2(f)) and bans targeted advertising directed at children, so youth audiences need a separate plan.
Language rights. Notices must be available in English or any Eighth Schedule language on request, which a single English privacy policy does not meet.

Cross-border transfers are allowed, subject to requirements the central government may set by order on making data available to a foreign state or its agencies (Rule 15). Significant Data Fiduciaries may face localization of specified data (Rule 13(4)).

What Are the Penalties Under the DPDP Act?

Penalties are set in the Schedule to the Act and go up to ₹250 crore per breach type. The Board decides the amount after an inquiry.

Breach	Maximum penalty
Failure to take reasonable security safeguards (section 8(5))	₹250 crore
Failure to notify the Board or affected people of a breach (section 8(6))	₹200 crore
Breach of children's data obligations (section 9)	₹200 crore
Breach of Significant Data Fiduciary obligations (section 10)	₹150 crore
Any other breach of the Act or Rules	₹50 crore
Breach of a Data Principal's duties (section 15)	₹10,000

For a marketing team, most consent and notice failures would likely fall under the ₹50 crore "any other" line. The ₹200 crore lines are the ones a careless pixel on a teen-focused campaign or a slow breach response can trigger.

Marketing Stack Readiness Checklist

Assign each check to one owner now, so May 2027 is a test date rather than a start date. The effort ratings are our estimate for a mid-size brand.

Two checks carry high effort: consent-gated tags and children's data, so start them first.

Now, if you are a large company: brief leadership on the shortening proposal and decide whether to accelerate.
October to December 2026: Map. List every form, pixel, software development kit (SDK) and vendor that collects or receives personal data, including the lead forms behind your lead generation programs. Tag each with purpose and legal basis.
January to February 2027: Rewrite. Draft itemized notices and separate marketing consents. Translate them into the languages your customers use.
February to March 2027: Rewire. Gate analytics and ad tags behind consent, route withdrawals to every system and set retention rules. Recheck your Google Analytics 4 (GA4) setup and AI referral tracking once tags wait for consent.
March to April 2027: Contract. Update processor agreements with security and erasure terms.
April 2027: Rehearse. Run a breach drill against the 72-hour clock and a rights-request drill against the 90-day limit.

If you collect data through an ecommerce site, the same clean-data discipline helps elsewhere. Our analysis of Google agentic checkout and Universal Cart shows why consistent product and policy data now decides AI shopping visibility, and our guide to preparing a store for AI shopping agents covers the store side.

How Apex^® Helps With DPDP Readiness

Apex^®, the AI-native digital experience platform (DXP), includes controls that support GDPR, CCPA and India's Digital Personal Data Protection (DPDP) Act compliance. It runs on AWS with TLS encryption (AES-256), distributed denial-of-service (DDoS) protection and routine backups, as set out on our security support page. Its API integrations connect your site to customer relationship management (CRM) and marketing automation tools, which is where consent and withdrawal records need to land.

Compliance is your organization's responsibility, and no platform makes you compliant on its own. Our web development team can map your forms and tags, implement consent-gated tracking and build notices in the languages your customers read. You can see how we handle data ourselves in our privacy policy.

Talk to us about DPDP readiness

Sources

#Marketing Data #Marketing Strategy #Brand Trust #Marketing Trends

DPDP Consent Manager Deadline: What Marketers Must Change

Key Takeaways

What Changes on November 13, 2026?

What Is the Full DPDP Compliance Timeline?

What Must Marketing Teams Change by May 2027?

Notices in Plain Language and Indian Languages