Rule 4 of the DPDP Rules comes into force tomorrow, 13 November 2026. Here’s what it switches on, what it leaves for later, and why the six months in between matter.
In short: Consent managers can register with the Data Protection Board from 13 November 2026. Their statutory duty to users under Section 6(8) of the Act starts only on 13 May 2027. And the board that registers them has no members yet. This week marks one year since India notified the Digital Personal Data Protection Rules, 2025. Under Rule 1(3), Rule 4 comes into force one year after publication, on 13 November 2026.
It opens registration for consent managers, a new kind of regulated intermediary that the DPDP Act created in 2023 but left inactive until now. Some guides treat this date as a compliance deadline. For most companies, it isn’t. The sequencing is the more interesting part. Consent Managers become eligible to seek registration from 13 November 2026, although the application process depends on particulars and certification standards that the Board must first publish. The Act’s statutory accountability obligation under Section 6(8) does not commence until May 2027
What a Consent Manager Is
Today you give consent separately to your bank, your food delivery app, and your insurer, each through its own form and settings page. Withdrawing consent means finding each of those pages again. The Act’s answer is the Consent Manager. Section 2(g) defines it as a person registered with the Data Protection Board who acts as a single point of contact, enabling a user to give, manage, review, and withdraw consent through an accessible, transparent, and interoperable platform. RBI-regulated Account Aggregators already do something similar for financial data. The difference is scope. Account Aggregators move information within the financial sector, while Consent Managers are meant to manage consent across all sectors covered by the DPDP Act.
What starts this week?
The commencement notification, G.S.R. 843(E), brings the Act into force in three phases. The second, one year after publication, switches on only two provisions. Section 6(9) requires every consent manager to be registered with the Board. Section 27(1)(d) lets the Board inquire into a breach of a consent manager’s registration conditions once the breach is intimated to it. Rule 4 and the First Schedule of the Rules (G.S.R. 846(E)) start at the same time.
The First Schedule has two parts. Part A sets the conditions for registration. The applicant must be a company incorporated in India with a net worth of at least ₹2 crore. Its platform must be independently certified against data protection standards and an assurance framework that the Board is to publish. Its memorandum and articles must also build in the conflict-of-interest rules from Part B. Part B sets the duties that apply once a company is registered. The Consent Manager must act in a fiduciary capacity towards the user. It must avoid conflicts of interest with the data fiduciaries it serves and have measures in place to ensure that no conflicts arise from its own directors, key managerial personnel, or senior management. It must publish on its website or app details of anyone holding more than 2% of its shares. It must keep effective audit mechanisms and report the outcomes to the Board. And it needs the board’s prior approval for any change of control.
Two things follow. The conflict-of-interest duties make it very hard for a large platform to run a captive consent manager that steers users’ consent towards itself. The rules contain no express ownership ban, so the Board will have to judge such structures case by case. A foreign consent-management company must act through a company incorporated in India, though the rules set no cap on foreign ownership.
The split inside Section 6
Commencement tables have shown this split since November 2025, but few have asked what it means. G.S.R. 843(E) doesn’t bring Section 6 into force as a whole. Only subsection (9), the registration requirement, starts now. Sub-sections (1) to (8) and (10) start on 13 May 2027, eighteen months after publication. Look at what those subsections contain. Section 6(7) is an enabling provision: it says a user may give, manage, review, or withdraw consent through a Consent Manager. Section 6(8) makes the Consent Manager accountable to the user and requires it to act on the user’s behalf.
So the statutory route to a consent manager and the consent manager’s statutory duty to that user both arrive in May 2027. The gap is narrower than it first looks. From November, Part B of the First Schedule already requires a registered Consent Manager to act in a fiduciary capacity towards users. What waits until May 2027 is the duty in the Act itself, the provision that defines the relationship the whole framework exists for. There is a reasonable case for this order. If registration opened on the same day as the duties, there would be no registered consent managers on day one. Starting registration first gives the market six months to build.
Whether that plan works depends on the next problem.
A regulator on paper
Under Rule 4, the Board must register each applicant or reject it with reasons. The Board was established in November 2025 and is to have a chairperson and four members. No one has been appointed to it. MeitY invited applications on 6 May 2026 and advertised the posts in Employment News on 6 June 2026. At the time of writing, no appointment has been notified. In October, the Kerala High Court said it expected the Board to be functional within eight weeks, though it set no binding deadline.
A registration window that depends on a board with no members is open only in a formal sense. The Part A certification also depends on standards the Board must first publish. Until it does, no applicant can get certified, so a complete application can’t be made at all. Nobody can say yet when the first registration will happen.
Penalties that wait
Sections 28 to 34, including the penalty provision in Section 33, also start in May 2027. The Schedule to the Act has no separate entry for consent managers. A breach by one would fall under the residuary item 7, “breach of any other provision of this Act or the rules made thereunder,” which allows a penalty of up to ₹50 crore. That item can’t be applied before May 2027.
Section 27(1)(d) mentions penalties, but that machinery isn’t in force yet, and neither is the Board’s general power to issue binding directions under Section 27(2). Until May 2027, an inquiry can lead only to the actions in Rule 4(4) to (6): directions to comply, suspension or cancellation of registration, and calls for information. Those are real powers, but none of them can be used until the Board has members. Even then, the Board can supervise a consent manager but cannot fine it.
What this means for businesses
For most data fiduciaries, there is no new legal duty this week. Notice, consent, security safeguards, breach reporting, and data principal rights all start on 13 May 2027. Using a Consent Manager is also optional. A company can keep collecting and honouring consent directly, as long as it meets the Act’s notice and consent standards.
Onboarding doesn’t move liability either. If consent is ever disputed, Section 6(10) puts the burden on the data fiduciary to prove that it gave notice and obtained valid consent. A consent manager is one more channel for consent; the legal responsibility stays with the company.
Still, a quiet week on paper leaves real work to do. In May 2027, companies will have to prove consent using the records they are building now. A useful test for the next six months is whether your systems can show, for any user, what they consented to, when, under which notice, and when they withdrew.