India DPDP Rules 13 November 2026 Explained: Consent Manager Registration Opens Today and What It Means for You

on

India DPDP Rules 13 November 2026 explained — New Parliament Building, New Delhi

Illustrative image: the new Parliament Building in New Delhi, where the DPDP Act was passed in 2023. Image: Ministry of Parliamentary Affairs, Government of India, via Wikimedia Commons (GODL-India).

TL;DR: India DPDP Rules 13 November 2026 explained: from today, companies can register as consent managers with the Data Protection Board of India under Rule 4 of the DPDP Rules 2025. For most people and businesses, nothing changes yet — the main duties, including breach reporting, start on 13 May 2027. But ransomware attacks could still count as reportable breaches.

Key Highlights

  • Rule 4 of the DPDP Rules 2025 takes effect on 13 November 2026, opening consent-manager registration with the Data Protection Board of India. Most readings date it 13 November; a few count 14 November because the Gazette copy was uploaded a day later.
  • A consent manager is a Board-registered, India-incorporated intermediary — minimum net worth ₹2 crore — giving people one dashboard to give, review and withdraw consent across companies.
  • The duties that touch most businesses — consent notices, security safeguards, breach reporting — start on 13 May 2027, with penalties of up to ₹250 crore.
  • K7 CyberSecurity warns that a ransomware attack which locks a business out of personal data can count as a reportable breach even if nothing is stolen.
  • The legal door opens today, but the practical route is still being built: as of late October 2026, the Board had not published application particulars for registration.

What changes today — Rule 4 takes effect

India's Digital Personal Data Protection Rules, 2025 were notified in the Gazette as G.S.R. 846(E), dated 13 November 2025, after a public consultation that drew 6,915 inputs on the draft rules. Rule 1 of the Rules staggers their start across three dates, and the second date falls today: Rule 4, which sets up the registration and obligations of consent managers, comes into force one year after publication. Section 6(9) of the DPDP Act, 2023 — the provision that requires a consent manager to be registered with the Board — starts on the same date.

The Data Protection Board of India itself was set up when the Rules were notified, as a fully digital office. The government's backgrounder says citizens will be able to file and track complaints online and through a mobile app, and that appeals against the Board's decisions go to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT). One honest caveat: the exact day is disputed by a day. The Gazette is dated 13 November 2025, but the Press Information Bureau's release describes the Rules as notified on 14 November 2025, and some legal commentators therefore count 14 November 2026 for Rule 4. Most readings use 13 November 2026, which is the date this post uses.

India DPDP Rules 13 November 2026 explained: what is a consent manager?

Section 2(g) of the DPDP Act defines a consent manager as a person registered with the Board who acts as a single point of contact to enable an individual — a "data principal" in the Act's language — to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform. In plain terms, it is one dashboard where you can see every company you have given consent to, and switch any of them off, instead of hunting through each app's settings separately. The idea builds on India's Account Aggregator framework in financial services, where a regulated intermediary moves data without reading it.

The bar for running one is deliberately high. Under Rule 4 and the First Schedule, an applicant must be a company incorporated in India with a minimum net worth of ₹2 crore, and must run an interoperable platform that relays consent requests, records the consent and the privacy notice that came with it, and routes consent — and, where applicable, the requested personal data — to the right company. Crucially, the transport must be "data-blind": the consent manager cannot read the personal data passing through its platform. It must keep auditable records of every consent decision for seven years, cannot act as a data fiduciary or a data processor itself, cannot subcontract its obligations, and needs the Board's approval before any transfer of control, such as a sale or merger.

Two things the consent manager is not: it is not a consent tool a business buys and installs for itself, and it is not something every business must use. Giving consent through a consent manager is the individual's choice, and nothing in the Act or Rules requires a data fiduciary to route consent through one.

PhaseDateWhat startsWho it affects
113 November 2025Rules 1, 2 and 17–21: definitions and the Data Protection Board of IndiaThe framework itself
213 November 2026Rule 4 and Act section 6(9): consent-manager registration and supervisionCompanies that want to be consent managers
313 May 2027Rules 3, 5–16, 22 and 23: notices, consent, security safeguards, breach reporting, retention, children's data, data principal rights, penaltiesEvery business handling personal data in India

India DPDP Rules 13 November 2026 explained — laptop with a padlock and key, a computer security illustration

Illustrative image: a laptop secured with a padlock — under the DPDP framework, losing access to personal data can count as a breach, not just losing it to a thief. Image: Wikimedia Commons / Marcela (after Aka), CC BY-SA 3.0.

Why ransomware changes the calculation

The timing matters because of a warning issued the same week. In a media briefing reported on 12 November 2026, K7 CyberSecurity flagged that ransomware attacks could trigger DPDP breach-reporting duties even when no data is stolen. The reasoning is that the framework's definition of a personal data breach covers loss of access to personal data, not only its theft or disclosure — so an attack that encrypts a database and locks a business out of its customers' data can itself be a breach. There is no minimum size exemption once an incident meets the statutory definition.

When the reporting duty starts on 13 May 2027, a business in that position would have to notify the affected individuals and the Data Protection Board without delay, and file a detailed report within 72 hours of becoming aware of the breach. The penalties underline why this is not a footnote: up to ₹250 crore for failing to take reasonable security safeguards, and up to ₹200 crore for breach-notification violations. The same week also showed why patching still comes first — the exploited Barracuda email gateway flaws reached their CISA patch deadline today, and CERT-In's critical Chrome warning told Indian users to update their browsers immediately. A ransomware-proof backup and a patched fleet are the cheapest way to stay on the right side of the May 2027 duties.

What does NOT change today

Today's date is easy to over-read. Your checkout does not suddenly need a new consent flow, and no ordinary business gains a new duty this morning — the notice, consent, security and breach-reporting rules all sit in the May 2027 group. The Act covers digital personal data processed in India, and processing abroad when it is linked to offering goods or services to people in India, but those obligations still start in May 2027.

Two more honest limits. First, in January 2026 MeitY consulted on shortening the eighteen-month window for some duties, but as of November 2026 no amendment had been notified, so 13 May 2027 stands as the working date. Second, the registration route itself is not fully built yet: as of late October 2026, researchers found no published application particulars and no data-protection standards framework from the Board, and a 1 November check could not establish the Board's current appointments. So the legal requirement starts today, but a company that wants to apply may still be waiting on the Board to publish how.

Should you care?

Verdict: ✅ Worth knowing today, worth acting on before May 2027. If you run a business that handles Indian users' data, put 13 May 2027 on your compliance calendar and treat ransomware as a breach-reporting risk, not just an IT problem. If you want to build a consent manager, watch the Board's website for the application particulars. If you are an ordinary user, nothing to do today — but from May 2027 you should start seeing clearer consent notices, a way to withdraw consent easily, and breach alerts when your data is affected.

FAQs

What is a consent manager under the DPDP Act?
A consent manager is a person registered with the Data Protection Board of India who acts as a single point of contact for an individual to give, manage, review and withdraw consent across multiple companies, through one accessible, transparent and interoperable platform. It must be an Indian company with a net worth of at least ₹2 crore, and it cannot read the personal data it routes.

What changes on 13 November 2026 under the DPDP Rules?
Rule 4 of the DPDP Rules 2025 comes into force, opening registration for consent managers with the Data Protection Board of India. Most other duties — consent notices, security safeguards, breach reporting and individual rights — do not start until 13 May 2027.

Does my business need to do anything on 13 November 2026?
No, unless you want to apply to become a consent manager. For most businesses, 13 November 2026 brings no new duty; the main obligations under the DPDP Rules apply from 13 May 2027, including notice, consent, security safeguards and breach notification.

Can a ransomware attack count as a data breach under the DPDP Rules?
Yes, according to K7 CyberSecurity's briefing: because the framework treats loss of access to personal data as a breach, a ransomware attack can trigger reporting even if no data was stolen. Once the duty starts in May 2027, the business must notify the Board and affected individuals without delay and file a detailed report within 72 hours.

Takeaway

Today opens a narrow door — consent-manager registration — not the whole DPDP regime. The date that changes life for every business handling Indian personal data is still 13 May 2027, and ransomware is now firmly part of that deadline's homework.

If you run a website or app used in India, the useful next step is to read the government's own DPDP backgrounder linked below and put 13 May 2027 on your compliance calendar — and check CISA's November 2026 exploited-flaws list to make sure none of the flaws with deadlines this month is still open on your systems.

Sources

Comments

Post a Comment