DPDP Consent Manager Registration Opens: Data Protection Board Status and May 2027 Compliance

DPDP Consent Manager Registration Begins: Is India’s Data Protection Board Ready?

India’s DPDP regime entered its second implementation phase on 13 November 2026. Rule 4 of the Digital Personal Data Protection Rules, 2025, has commenced, but questions remain about the operational readiness of the Data Protection Board of India.

India’s Digital Personal Data Protection (DPDP) framework has reached another implementation milestone. On 13 November 2026, one year after the Digital Personal Data Protection Rules, 2025 were notified, Rule 4 came into force.

Rule 4 deals with the registration and obligations of Consent Managers. It is an important development, but it is not the principal compliance deadline for most businesses acting as Data Fiduciaries.

The more immediate institutional concern is the operational readiness of the Data Protection Board of India (DPBI), the statutory body responsible for administering important parts of the framework.

The Board has been legally established. However, the latest judicial record located for this update indicates that it had not yet become functional as of 7 October 2026.

For businesses, the distinction matters. The Consent Manager provisions have commenced, but the principal obligations affecting most Data Fiduciaries are scheduled to commence on 13 May 2027.

1. What changed on 13 November 2026?

Rule 4 of the DPDP Rules, 2025 came into force one year after publication of the Rules.

It establishes the registration framework for Consent Managers. A Consent Manager is a registered intermediary through which an individual, known under the Act as a Data Principal, can give, manage, review and withdraw consent through an interoperable platform.

Under the First Schedule to the Rules, an applicant must satisfy several conditions, including:

• It must be a company incorporated in India.
• It must have sufficient technical, operational and financial capacity.
• Its net worth must be at least ₹2 crore.
• Its financial condition and management must be sound.
• Its directors and senior management must have a record of fairness and integrity.
• Its platform must be independently certified against the relevant data protection standards and assurance framework published by the Board.
• It must have appropriate technical and organisational measures to fulfil its obligations.

This is not a requirement for every business to become a Consent Manager.

Most businesses will continue to act as Data Fiduciaries. They should nevertheless understand how the Consent Manager framework may interact with their consent collection and management systems.

An important practical qualification: Rule 4 has commenced, but the commencement of a rule should not be confused with a fully operational registration process. The Board’s functionality and publication of the required certification standards are relevant to whether applicants can complete registration in practice.

2. The Data Protection Board: Established in law, but not yet confirmed as operational

The Data Protection Board of India was established by MeitY notification G.S.R. 844(E), dated 13 November 2025, under Section 18 of the DPDP Act, 2023.

A separate notification, G.S.R. 845(E), dated the same day, specified that the Board would consist of four members.

However, establishment of the Board and appointment of its Chairperson and Members are separate steps.

On 6 May 2026, MeitY issued a recruitment circular inviting applications for:

• One Chairperson.
• Four Members.

The recruitment advertisement was subsequently published in the Employment News on 6 June 2026.

The Government’s response to Lok Sabha Unstarred Question No. 3960, answered on 12 August 2026, confirmed the recruitment advertisement and described the Board’s appointment process through a Search-cum-Selection Committee.

The answer did not identify appointed officeholders.

What did the Kerala High Court say?

The issue of the Board’s functionality subsequently came before the Kerala High Court in C.R. Neelakandan v. Union of India and Others, WP(PIL) No. 15 of 2026.

The public interest litigation concerned the handling of passengers’ personal information at airports, including through the Digi Yatra system.

In its judgment dated 7 October 2026, the Court recorded the Central Government counsel’s submission that the Board had been constituted but had yet to be made functional.

The Court then observed:

“Considering the purpose for which the Act of 2023 has been enacted, we expect that the Board will be made functional within a period of eight weeks from date.”

The petition was disposed of.

The eight-week period runs to approximately 2 December 2026.

It is important to understand the legal significance of this observation. The Court expressed an expectation that the Board would become functional within eight weeks. It did not issue a mandamus appointing the Chairperson and Members by a specified date.

The judgment is nevertheless significant because it records the Government’s own position on the Board’s operational status.

As at 14 November 2026, I have not located a subsequent official appointment notification confirming that the Chairperson and Members have taken office. This should be checked again against MeitY and Gazette publications before relying on the position as a later-date update.

3. Why does the Board’s operational readiness matter?

The Board is not merely an administrative body. It is central to the enforcement architecture of the DPDP Act.

Its statutory functions include dealing with personal data breach matters, inquiring into complaints and non-compliance, issuing appropriate directions and imposing monetary penalties in accordance with the Act.

The Board also has an important role in the Consent Manager registration framework.

The absence of a functioning institution can therefore create practical uncertainty around:

1. The processing of Consent Manager registration applications.
2. Publication of the technical standards and assurance framework required for independent certification.
3. The administration of complaints and breach-related proceedings when the relevant statutory provisions commence.
4. The development of regulatory procedures and enforcement practices.
5. The practical availability of an effective grievance and adjudication mechanism for Data Principals.

This does not mean that the commencement of the DPDP Act or Rules has been suspended.

The implementation timetable remains separate from the Board’s staffing and operational readiness.

4. The deadline most businesses should focus on: 13 May 2027

For most Data Fiduciaries, the principal compliance work remains ahead.

Under the commencement provision in the DPDP Rules, Rules 3, 5 to 16, 22 and 23 are scheduled to come into force eighteen months after publication of the Rules.

That takes the principal compliance date to 13 May 2027.

The obligations include:

The 72-hour point needs careful drafting. Rule 7 requires notification without delay and provides for detailed information to be furnished to the Board within 72 hours of becoming aware of the breach, or within such further time as the Board may allow.

Businesses should not interpret this as permission to delay the initial notification for 72 hours.

5. A practical six-month action plan for businesses

The next six months should be treated as an implementation period, not as a waiting period for the Board to become functional.

Step 1: Map all personal data collection points

Identify every place where the organisation collects or receives personal data.

This should include:

• Website registration and contact forms.
• Mobile applications.
• Customer onboarding and KYC processes.
• Employee and recruitment records.
• Marketing and lead-generation forms.
• Payment and subscription systems.
• Customer support channels.
• CRM platforms and analytics tools.
• Third-party integrations and outsourced service providers.

Do not limit this exercise to systems maintained by the legal or IT teams. Marketing, sales, HR and operations often introduce additional collection points.

Deliverable: Personal Data Inventory and Data Flow Map.

Step 2: Rework privacy notices

Existing privacy policies should be reviewed against Rule 3.

The notice must be understandable independently of other information and use clear, plain language.

At a minimum, it must provide:

• An itemised description of personal data being processed.
• The specified purpose or purposes of processing.
• A specific description of the goods, services or uses enabled by that processing.
• A communication link and information about how individuals can withdraw consent, exercise their rights and raise grievances.

A generic privacy policy containing broad statements about data use may not satisfy these requirements.

Deliverable: Revised Privacy Notice, Consent Notices and Website/App Privacy Disclosures.

Step 3: Review consent architecture

Review how consent is obtained, recorded, changed and withdrawn.

Businesses should assess:

• Whether consent is collected separately for distinct purposes.
• Whether pre-ticked boxes or bundled consent are being used.
• Whether the system records the consent given and the relevant notice version.
• Whether withdrawal is as easy as giving consent.
• Whether consent can be managed through a Consent Manager where applicable.
• Whether the underlying technology can integrate with an interoperable Consent Manager platform.

Deliverable: Consent Management SOP, Consent Register and Technical Requirements Document.

Step 4: Re-paper vendors and processors

A business does not eliminate its compliance exposure by outsourcing data processing.

Review agreements with:

• Cloud hosting providers.
• CRM and marketing platforms.
• Payment gateways.
• Customer support providers.
• Analytics providers.
• HR and payroll service providers.
• AI and software vendors.
• Other third parties processing personal data on the organisation’s behalf.

Contracts should clearly address processing instructions, security safeguards, confidentiality, incident reporting, assistance with Data Principal requests, deletion or return of data, subcontracting and audit or compliance assistance.

Deliverable: Revised Data Processing Agreements, Vendor Data Protection Clauses and Vendor Due Diligence Questionnaire.

Step 5: Build a personal data breach response plan

The organisation should have a documented process for identifying, escalating, investigating and reporting personal data breaches.

The playbook should identify:

• Who receives the initial incident report.
• Who determines whether personal data has been affected.
• Who coordinates technical containment and investigation.
• Who approves notifications.
• How affected Data Principals will be informed.
• How the organisation will prepare the detailed report for the Board within the prescribed period.
• How evidence and incident records will be retained.

The process should be tested through a tabletop exercise before the substantive rules commence.

Deliverable: Data Breach Response Policy, Incident Reporting Form and Breach Notification Templates.

Step 6: Prepare for children’s data and parental consent

This area deserves early technical attention.

If children can use the organisation’s products or services, the business should identify how it will establish verifiable parental consent and implement the applicable restrictions.

It should also assess whether age-related restrictions, consent verification, parental access and data minimisation need changes to the product.

Deliverable: Children’s Data Policy, Parental Consent Workflow and Age Verification Assessment.

Step 7: Establish accountability and governance

Assign responsibility for DPDP compliance across legal, IT, security, HR, marketing and operations.

The organisation should maintain a record of decisions, approvals, vendor reviews, security assessments and remediation activities.

Where the business may qualify as a Significant Data Fiduciary, it should separately assess the additional requirements applicable to that classification.

Deliverable: DPDP Governance Policy, Responsibility Matrix and Compliance Tracker.

Official legal sources

1. Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), dated 13 November 2025.
2. Notification G.S.R. 844(E), dated 13 November 2025, establishing the Data Protection Board of India.
3. Notification G.S.R. 845(E), dated 13 November 2025, specifying the number of Board members.
4. MeitY circular F. No. 2(1)/2026-Pers.I, dated 6 May 2026, inviting applications for the Chairperson and Members.
5. Lok Sabha Unstarred Question No. 3960, answered 12 August 2026, concerning appointments to the Data Protection Board.
6. C.R. Neelakandan v. Union of India and Others, WP(PIL) No. 15 of 2026, Kerala High Court, judgment dated 7 October 2026.

Editorial and legal status note: The Kerala High Court judgment records the Government counsel’s submission that the Board had been constituted but was not yet functional. The Court expressed an expectation that it would become functional within eight weeks. This article does not treat that expectation as a binding appointment deadline. The latest official appointment position should be rechecked before publication.