India’s data protection law takes its next step today, Friday, November 13, 2026. Rule 4 of the Digital Personal Data Protection Rules, 2025 comes into force, opening the door for a brand new kind of company: the Consent Manager. If you use apps, shop online or sign up for services with your phone number, this is the rule that will one day let you control who uses your data.
But today is not the day your apps suddenly change. The rule creates the registration route, yet the regulator that must approve those registrations has no member appointed yet, and no application form has been published. So what actually changes today, and what is still months away?
What is a Consent Manager?
A Consent Manager is an independent company that acts as a single window for your data permissions. Instead of giving consent separately inside every app and website, you manage it in one place: see which companies hold your data, give or refuse permission, and withdraw it later.
Under Rule 4, any company that wants this role must register with the Data Protection Board of India. The applicant must be incorporated in India, with a minimum net worth of Rs 2 crore, and meet technical, operational and financial conditions in the Rules. Once registered, the Board will publish its particulars and supervise it.
What changes from today?
From November 13, 2026, the legal route to register as a Consent Manager exists. That is the second stage of India’s phased data protection rollout. The DPDP Act was passed in 2023, and the Rules were notified on November 13, 2025. Rule 4 was written to start exactly one year later, which is today.
For companies eyeing this new business, today is the starting gun. For everyone else, the change is quieter. No app must ask you anything new today, and no registered Consent Manager service is guaranteed to be available on day one. Registration becoming possible is not the same as a service going live.
What does not change today?
Quite a lot. A year after the government fixed the Board’s size at four members, none of those seats has been filled, according to legal trackers. Until the Board has a chairperson and members, nobody can approve a Consent Manager application. As of November 12, no application particulars had been published, and no Consent Manager had been registered. A Kerala court expects the Board to be working within eight weeks of its October 7, 2026 hearing.
The bigger duties are further away. The main obligations on companies, including clear notices, consent rules, security safeguards, breach reporting and your rights, start on May 13, 2027, eighteen months after the Rules were notified. The government once proposed bringing that date forward, but no amendment has been notified, so May 13, 2027 stands.
The penalties at stake
When the full framework kicks in, the stakes will be high. Companies can face penalties of up to Rs 250 crore for failing to keep reasonable security safeguards, and up to Rs 200 crore for failing to notify a breach. Breaches must be reported to the Board within 72 hours.
A breach is wider than many businesses realise. K7 CyberSecurity flagged this week that a ransomware attack can count as a breach under the Indian rules, even if no data is stolen, because locking a company out of personal data may itself be enough. Data leaks keep surfacing too: SBI said this month that 3,897 customer records were found on the dark web.
What it means for you
For ordinary users, very little changes on screen today. The milestone matters because it starts the clock on a system that, once running, should make consent something you can see and control, rather than a checkbox you tap without reading. For businesses, the message is to prepare now, because the May 2027 duties will carry real penalties.
Using a Consent Manager will not be compulsory. Companies can keep taking consent directly, as they do now. But once registered Consent Managers exist, they will offer a cleaner way to manage permissions across many services.
FAQs
Do I need to do anything today?
No. Nothing is required of you on November 13. The rule opens registration for Consent Managers. Your apps and accounts work exactly as before.
What is a Consent Manager?
A registered, independent company that lets you give, review, manage and withdraw consent for your personal data across many apps and services from one place.
When do the main data protection duties start?
May 13, 2027, when most obligations on companies, including notice, consent, security safeguards and breach reporting, come into force.
What are the penalties under the DPDP framework?
Up to Rs 250 crore for failing to keep reasonable security safeguards, and up to Rs 200 crore for failing to notify a breach. Breaches must be reported within 72 hours.
Is using a Consent Manager compulsory?
No. A business does not have to use one, and registration becoming possible does not guarantee a service will be available immediately, because the Board has not yet appointed its members or published the application process.
India’s data protection journey is now in its second year, and today marks the first provision that turns the law’s ideas into a working system. The framework is real, the dates are set, and the penalties are serious. What is missing is the regulator itself.
