The Digital Personal Data Protection Rules were notified in November 2025 with a staggered start. The first real milestone after that falls in November 2026: the rules on consent managers come into force, one year after notification. Most commentators put the date at 13 November 2026 (SCC Online counts it as 14 November). The bigger set of duties for businesses follows in May 2027.
If you run a clinic, a coaching centre, a shop or an agency, you will hear the phrase a lot this month, often from someone selling software. Here is what it actually means for you. This is a practical summary, not legal advice.
What a consent manager is
A consent manager is a company registered with the Data Protection Board that lets people give, review and withdraw their consent to many businesses from one place, a bit like a dashboard for your own data permissions. The Act created the role; the Rules set the registration conditions, including minimum net worth, technical standards and independence from the businesses it serves (KPMG’s guide to the Rules).
From November 2026, firms that want to be consent managers can apply to register. Nothing in the Rules forces a small business to use one.
Do you need one?
Almost certainly not, today. Under the Act, consent can be collected by you directly, through a clear notice and a clear yes. A consent manager is an option for collecting and managing that consent, not a requirement. Large platforms with millions of users may find one useful; a clinic with a booking form does not need to integrate anything this year.
So if someone tells you that you must “register with a consent manager by November”, ask them to show you the rule that says so.
What does matter for you
The duties that do apply to ordinary businesses start in May 2027, about 18 months after notification (PIB explainer). November is a good time to prepare, because the work is small if you start early. Three things:
1. Fix your consent notice. Every form, WhatsApp opt-in and lead ad that collects personal data should say, in plain words, what you collect, why, and how someone can withdraw. Our guide to DPDP rules and your website enquiry form has the checklist.
2. Know where your data is. List every place enquiries and customer details end up: website form, Meta lead forms, portals such as IndiaMART or 99acres, WhatsApp, Excel sheets, your CRM, your staff’s phones. You can’t answer a deletion request for data you can’t find.
3. Check your vendors. Anyone who handles your customers’ data for you, such as a CRM, a WhatsApp provider, a call-recording tool or an AI employee, is a processor. Get their data processing terms in writing, and know where recordings and transcripts are stored and for how long.
What about calls and WhatsApp?
Consent under DPDP sits alongside TRAI’s rules on calls and messages, not instead of them. If you call people who enquired, keep a record of the enquiry, since TRAI’s 2026 amendment allows inquiry-based calls for a limited window. Our explainers on TRAI’s new rules for AI and automated calls and whether AI cold calling is legal cover that side.
A simple test
Pick one recent enquiry at random. Can you say where it came from, what the person agreed to, where their details are stored today, and how you would delete them if asked? If yes, you are in better shape than most. If not, run our free lead leak audit, which also shows where enquiries slip through the cracks, and fix the gaps before May.
If you’d like help setting up forms and follow-up that respect consent from the first click, ask for a callback.
