Follow us on Google News
India has reached a significant milestone in implementing its Digital Personal Data Protection (DPDP) Act, 2023, as the regulatory framework governing the registration of Consent Managers enters its next phase. The development brings the country closer to a system in which individuals can exercise greater control over their personal information and businesses can be held accountable for its misuse.
The Data Protection Board of India (DPBI), established under the legislation, is central to this transition. Reports that its website, dpbi.gov.in, has become operational have emerged as the statutory framework for Consent Manager registration reaches its November 2026 commencement milestone.
However, the development does not mean that all provisions of India’s privacy law are immediately enforceable. Most obligations concerning data security, individual rights, breach reporting and financial penalties are scheduled to take effect in May 2027.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
Consent Managers To Change How Indians Control Their Personal Data
The November milestone marks the beginning of a new regulatory framework for organisations seeking to operate as Consent Managers.
Under the DPDP Act, a Consent Manager acts as an intermediary through which individuals can give, review, manage and withdraw permission for businesses to process their personal information.
For example, a customer who has authorised several digital platforms to use personal information could eventually manage those permissions through a registered Consent Manager instead of navigating separate privacy settings on each platform.
Section 6(9) of the Act requires Consent Managers to register with the Data Protection Board. Rule 4 of the DPDP Rules, 2025, sets out the registration process and the conditions that applicants must satisfy.
Applicants must be companies incorporated in India, possess sufficient technical and financial capabilities, and have a minimum net worth of ₹2 crore. Their platforms must also meet prescribed requirements concerning interoperability, transparency and security.
Consent Managers must maintain consent-related records for at least seven years, avoid conflicts of interest and ensure that personal information shared through their platforms remains unreadable to them.
The Board can examine applications, reject those that fail to satisfy the prescribed conditions and, where necessary, suspend or cancel registrations after providing an opportunity for a hearing.
However, businesses are not universally required to appoint or use a Consent Manager. Individuals will have the option of managing consent through such intermediaries once the wider framework becomes operational.
Data Protection Board To Oversee Compliance And Impose Penalties
The establishment of the Data Protection Board represents a major institutional change in India’s approach to privacy regulation.
Designed as a digital-first adjudicatory body, the Board will examine complaints, investigate specified violations, issue remedial directions and impose financial penalties in accordance with the Act.
The law provides for penalties of up to ₹250 crore when an organisation fails to implement reasonable security safeguards to prevent a personal data breach.
Failure to notify the Board or affected individuals about a breach can attract penalties of up to ₹200 crore. Violations of obligations concerning children’s personal data can also attract penalties of up to ₹200 crore.
These amounts represent statutory maximums rather than automatic penalties for every violation. The Board must consider the nature, seriousness, duration and consequences of a breach before determining an appropriate penalty.
An important concern, however, is the regulator’s operational readiness.
The Ministry of Electronics and Information Technology invited applications for the Board’s chairperson and four members in May 2026. In an August parliamentary response, the Government confirmed that recruitment advertisements had been issued.
The latest publicly available information does not independently establish that all appointments have been completed or that the Board has begun approving Consent Manager applications.
The functioning of a regulatory website alone would not establish that the Board is fully equipped to adjudicate complaints.
May 2027 Deadline Puts Businesses Under Pressure To Prepare
The Government’s phased implementation schedule provides organisations with an 18-month transition period from the November 2025 notification of the DPDP framework.
The next major deadline falls in May 2027, when most substantive responsibilities of Data Fiduciaries, individual privacy rights and the general penalty provisions are scheduled to commence.
A Data Fiduciary is an organisation or person that determines why and how personal information is processed. This can include banks, hospitals, online retailers, social media platforms, educational institutions and employers.
Organisations will need to identify what personal information they collect, establish lawful reasons for processing it and provide appropriate privacy notices.
They must also strengthen security safeguards, review access to sensitive information, establish procedures for responding to breaches and ensure that external service providers protect the data entrusted to them.
The DPDP Rules require affected individuals to be informed of personal data breaches without delay. Detailed information must ordinarily be submitted to the Board within 72 hours, unless an extension is permitted.
For businesses, the challenge extends beyond updating privacy policies. Compliance will require changes to existing software systems, contractual arrangements, employee training and internal accountability mechanisms.
Privacy Rights And Regulatory Independence Remain Under Scrutiny
Once the relevant provisions commence, individuals will have statutory rights to seek information about the processing of their personal data, request corrections or erasure in specified circumstances, and pursue grievance redressal.
The framework follows the Supreme Court’s landmark 2017 judgment in Justice K.S. Puttaswamy v. Union of India, which recognised privacy as a fundamental right.
However, important questions concerning the design of India’s privacy regulator remain unresolved.
In October 2026, the Supreme Court sought the Centre’s response to a petition by the Digital News Publishers Association challenging several provisions of the DPDP framework, including aspects of the Board’s constitution and powers.
The petition raises concerns about institutional independence, press freedom and the absence of a specific exemption for journalistic activities. The Court has not yet ruled on the constitutional validity of the challenged provisions.
As India approaches the next implementation deadline, the effectiveness of its privacy framework will depend not only on statutory protections but also on the regulator’s capacity to administer them fairly and effectively.
What This Means For You:
Businesses should begin mapping personal data, reviewing consent mechanisms and strengthening cybersecurity and breach-response procedures before May 2027. Individuals should continue using existing grievance mechanisms and verify the Board’s official procedures before submitting sensitive personal information to any platform claiming to provide DPDP-related services.
