The official notifications determine commencement. The implementation checklist is DPCI’s recommended practice, not a separate legal requirement.
India’s Digital Personal Data Protection framework has moved from legislation to implementation. For privacy professionals and legal teams, the immediate question is no longer whether the DPDP framework matters. It is how organisations should translate the framework into workable consent, governance, vendor, and rights-management processes.
This week in DPDP
The key development this week is the next phase of India’s phased DPDP implementation: the Consent Manager framework reaches its scheduled milestone on 13 November 2026.
A Consent Manager is intended to provide an accessible and interoperable way for a Data Principal to give, manage, review, and withdraw consent. The concept is significant because it may shift consent management from a collection of isolated website and application experiences toward a more connected governance model.
The DPDP Rules, 2025 establish the regulatory architecture for Consent Managers, including registration, operational capability, record-keeping, transparency, security, and conflict-of-interest requirements. The Rules were published in the Official Gazette dated 13 November 2025 and listed by the Ministry of Electronics and Information Technology on 14 November 2025 as part of the phased implementation of the DPDP Act, 2023.
The one-year milestone concerns Rule 4 and specified provisions of the Act. It is not a general compliance deadline for every Data Fiduciary. The implementation steps below are recommended practice; they are not themselves statutory duties due on 13 November 2026.
Why this matters to privacy professionals
The Consent Manager milestone should not be treated as a narrow technology deadline. It raises broader legal and operational questions:
- Which processing activities currently rely on consent?
- Can the organisation demonstrate what was disclosed when consent was obtained?
- Can consent be withdrawn as easily as it was given?
- How are consent records linked to downstream processing and deletion workflows?
- Which vendors, processors, and product teams need to change their systems?
The important point is that a consent record is not useful in isolation. It must be connected to purpose, data category, notice language, collection channel, processing system, and withdrawal handling.
Practical compliance takeaway
Privacy teams should use this milestone to test the full consent lifecycle rather than simply reviewing a consent banner.
1. Map consent-dependent processing
Create an inventory of processing activities where consent is the legal basis or where consent is presented as the user choice. Include websites, mobile applications, call-centre journeys, employee-facing systems, marketing platforms, and partner integrations.
2. Test withdrawal in practice
Select representative user journeys and verify that withdrawal is clear, accessible, and operationally effective. A withdrawal mechanism that updates a preference centre but does not stop downstream marketing or data sharing is not a complete control.
3. Reconcile records across systems
Check whether consent records can be matched to the relevant individual, purpose, notice version, timestamp, source, and status. Pay particular attention to data warehouses, customer relationship management systems, analytics tools, and processors.
4. Review vendor dependencies
Ask processors and technology vendors how they support consent signals, withdrawal events, audit trails, and deletion or suppression workflows. Contractual language should be supported by technical evidence.
5. Prepare an escalation path
Define who decides whether a consent issue requires remediation, user communication, regulator engagement, or a temporary pause in processing. Legal, privacy, security, product, and engineering teams should know their roles before an incident occurs.
Issue to watch
The practical challenge will be interoperability. Different organisations may use different identifiers, purposes, taxonomies, and consent models. Privacy professionals should therefore avoid assuming that an integration alone solves governance. The legal and operational meaning of each consent signal still needs to be defined and documented.
The next six months should be treated as a build-and-test period for the wider obligations that follow, including notice, security safeguards, breach reporting, rights handling, children's data, and data-retention processes.
Weekly checklist
- Identify every consent-dependent processing activity.
- Test one complete consent-withdrawal journey from user action to downstream system.
- Ask key processors for evidence of consent and withdrawal support.
- Record unresolved gaps, owners, and target dates.
Closing view
The Consent Manager milestone is best understood as a governance test. Organisations that already maintain purpose-based records, reliable consent evidence, and connected withdrawal workflows will be better placed to adapt. Organisations that treat consent as a front-end pop-up will likely discover that their largest gaps sit in back-end systems and vendor processes.
For privacy professionals, the immediate priority is simple: move from reviewing consent language to testing whether consent actually travels through the organisation.
This article is for general information and does not constitute legal advice. Confirm the current text of the DPDP Act, DPDP Rules, commencement notifications, and applicable guidance before relying on any deadline or compliance conclusion.
Source note
Prepared with reference to G.S.R. 846(E) (DPDP Rules, 2025) and G.S.R. 843(E) (commencement of specified provisions of the DPDP Act), both dated 13 November 2025 in the Official Gazette. Direct links appear below.