Technology

DPDP Consent Managers From 13 November 2026: What India’s Data Protection Rules Mean for You

From 13 November 2026, companies can register as consent managers under India’s data protection rules. Here is what changes for your personal data.

Every app you install asks for permissions, and almost every website wants you to tick “I agree” before you can go further. Most of us tap yes without reading, and then forget which company has which piece of our information. India’s personal data protection rules are now starting to change that, and the first visible step arrives on 13 November 2026, when companies can begin registering as consent managers.

A consent manager is meant to be one place where you can see, give and take back the permissions you have handed to different companies. Here is what is changing, what is still some months away, and what you can do today.

What Is Changing in November 2026?

India passed its Digital Personal Data Protection law, often called the DPDP law, in August 2023. The detailed rules that explain how it works came out in November 2025, and they are coming into force in stages rather than all at once.

The first stage set up the Data Protection Board, the body that will hear complaints. The second stage begins on 13 November 2026. From that date, companies that want to work as consent managers can apply to the Board for registration. Only companies based in India can do this job.

The third and biggest stage starts on 13 May 2027. That is when most of the duties on companies that collect your data, and most of your own rights, take full effect.

What Does a Consent Manager Do for You?

Think of it as a single dashboard for your permissions. Instead of hunting through the settings of a bank app, a shopping site and a health app one by one, you could use one platform to give consent, check what you have agreed to, and withdraw it when you change your mind.

The important point is whose side it is on. A registered consent manager works on your behalf and answers to you, not to the companies that want your data. It must also work across different services, so one platform can handle permissions for many companies.

Registration opening does not mean such platforms will be ready on day one. Companies first need to apply and be approved, so it may take some time before you see a registered consent manager you can actually use. Using one will be your choice.

Your Data Rights Under the New Rules

Once the main stage begins in May 2027, you will be able to:

ask a company what personal data it holds about you;
get wrong or incomplete details corrected, and update them when your address or phone number changes;
ask for your data to be erased in certain situations;
withdraw your consent at any time, as easily as you gave it;
name another person to use these rights for you;
raise a complaint with the company first, and then with the Data Protection Board.

Companies will have at most 90 days to deal with a request to see, correct, update or erase your data. Each company must also give you a contact point for questions about your data.

What Happens If Your Data Leaks?

Data leaks are one of the biggest worries for ordinary users. Under the rules, if a company suffers a breach, it must tell the affected people without delay. The message must be in plain language and explain what happened, how it could affect you, what the company has done about it, and whom to contact for help.

The penalties are large. A company that fails to keep reasonable security safeguards can be fined up to ₹250 crore. Failing to report a breach, or breaking the rules on children’s data, can cost up to ₹200 crore. Other violations can attract a penalty of up to ₹50 crore.

What About Children’s Data?

For children, a company will need verifiable consent from a parent or lawful guardian before handling their data. There are limited exceptions for essential services such as healthcare, education and real-time safety. For parents, this means apps and games aimed at children should start asking for proper parental permission instead of a simple tick box.

Benefits and Limits to Keep in Mind

The benefit is clear: more control and fewer surprises. You should know why your data is being collected, be able to say no later, and be told quickly when something goes wrong.

The limits matter too. Most rights only start in May 2027, so do not expect every app to change overnight. A consent manager can only manage permissions that run through it. And no rule can fully stop a leak; it can only push companies to protect data better and to be honest when they fail.

What You Can Do Right Now

Open your phone’s settings and check which apps can see your contacts, location, photos and microphone. Switch off what an app does not need.
Delete apps you no longer use, and close old accounts on shopping or loan sites you have stopped using.
Read the short summary on a consent screen before tapping “I agree”, especially for loan, health and finance apps.
Be careful with anyone who calls or messages claiming to be a “consent manager” and asks for an OTP, PIN or password. A genuine service will not ask for these.
Keep a note of the companies that hold sensitive data about you, such as your bank, insurer and telecom provider, so you know where to go once the new rights begin.

Frequently Asked Questions

What is a consent manager under India’s data protection rules?

A consent manager is a registered platform that lets you give, check and withdraw the permissions you have given to different companies, all in one place. It works on your behalf and answers to you, not to the companies that want your data.

From when can consent managers start working in India?

Companies can apply to the Data Protection Board for registration as consent managers from 13 November 2026. They need approval first, so it may take some time before a registered consent manager is available for you to use.

Do I have to use a consent manager?

No. Using a consent manager will be your choice. You can still give or withdraw consent directly with each app or company.

When do my new data rights start?

Most of your rights, such as asking what data a company holds, getting it corrected or erased, and withdrawing consent, take full effect from 13 May 2027. Companies will then have at most 90 days to deal with such requests.

Will I be told if a company leaks my personal data?

Yes. Once the main rules apply, a company must tell affected people without delay, in plain language, explaining what happened, how it may affect them, what it has done and whom to contact.