DPDP Consent Manager Framework Starts 13 November 2026 and What Small Websites Must Know

India's data protection law is arriving in stages, and the next stage lands on 13 November 2026. On that date, Phase II of the Digital Personal Data Protection Rules, 2025 takes effect, bringing with it the framework for Consent Managers — a new kind of registered entity meant to help people manage the permissions they give to websites and apps. If you run a small business website, this date is worth knowing — but it is equally worth knowing what it does not change for you. The honest headline is this: Phase II adds almost nothing to the day-to-day obligations of an ordinary small website on 13 November itself. The heavy compliance work still waits until Phase III, on 13 May 2027.

The Short Answer

Phase II of the DPDP Rules, effective 13 November 2026, activates Rule 4 read with Section 6(9) of the DPDP Act, 2023 — the provisions that create and regulate Consent Managers. A Consent Manager must be a company incorporated in India with a net worth of at least 2 crore rupees, and it will be registered and held to conduct standards set under the Rules. For an ordinary small business that collects customer data through its own website — a "data fiduciary" in the Act's language — 13 November 2026 changes very little directly. Your substantive duties around notice, consent, data safeguards, breach notification, retention and children's data arrive with Phase III on 13 May 2027. What you should do now is understand the Consent Manager idea, keep your existing privacy practices tidy, and avoid panic-buying compliance products you do not yet need.

How We Got Here: The Three Phases

The DPDP Rules, 2025 were notified on 13 November 2025 as G.S.R. 846(E), and corrected by G.S.R. 892(E) on 10 December 2025. Rather than switching everything on at once, the government staggered commencement across three phases:

• Phase I — 13 November 2025. The framework provisions: definitions, the Data Protection Board's structure, and adjudication machinery.
• Phase II — 13 November 2026. Rule 4 and Section 6(9): Consent Manager registration, eligibility and conduct standards.
• Phase III — 13 May 2027. All substantive fiduciary obligations: notice to individuals, consent, data safeguards, breach notification, retention limits, children's data rules, and individuals' rights.

That staggered design is deliberate. It gives the ecosystem — the Board, Consent Managers, and businesses — time to build in sequence. But it also creates confusion, because every phase produces a fresh round of alarming headlines. Knowing which phase does what is the simplest defence against that confusion.

What Is a Consent Manager?

A Consent Manager is an intermediary a person can use to give, review, manage and withdraw consent for their personal data, in one place, instead of dealing with every website separately. Think of it as a consent dashboard: instead of remembering which sites you allowed to use your phone number or email, you could see and change those permissions through the Consent Manager.

Under the framework taking effect in Phase II, a Consent Manager must be a company incorporated in India with a net worth of at least 2 crore rupees, and it must meet registration and conduct standards. These requirements exist because a Consent Manager will itself handle sensitive permission records — it cannot be a fly-by-night operation. For small websites, the practical implication is indirect: once Consent Managers exist and people start using them, your website may need to interoperate with them so that a customer's consent given or withdrawn through a Consent Manager is honoured on your systems too. That integration work belongs to the future, not to 13 November itself.

What Does Not Change on 13 November 2026

This is the part most small website owners need to hear clearly. Phase II does not, on its own, impose the substantive duties that most compliance checklists describe. Notice formats, consent wording, breach-notification timelines, data-retention limits and children's-data restrictions are Phase III obligations, effective 13 May 2027. If a vendor tells you that 13 November 2026 is the deadline for full DPDP compliance, that is wrong — and it is worth asking what exactly they are selling.

Two further facts should temper expectations about the timeline. First, the Data Protection Board is not yet operational as of October 2026: posts were advertised in May 2026 (Employment News, 6 June 2026), and Parliament was told on 12 August 2026 that appointments were still pending through a Search-cum-Selection Committee. A framework enforced by a Board that is still being constituted will take time to bite. Second, a proposal floated in January 2026 to compress the whole timeline to 12 months has not been notified as of October 2026. Until it is, the three-phase dates above are the dates to plan around.

A Small Clarification From October 2026

On 7 October 2026, the government issued the DPDP (Removal of Difficulties) Order, 2026. It clarifies two points: consent arrangements for persons with disabilities who have a lawful guardian, and the meaning of "data audit" for Significant Data Fiduciaries. These are textual clarifications, not new obligations, and they do not change what an ordinary small website must do. They are worth noting mainly because they show the framework is still being tidied up — another reason not to treat any single date as a final compliance cliff-edge.

What the Penalties Look Like — and Why They Should Not Panic You

The DPDP Act sets high penalty ceilings, and they are frequently quoted out of context. The ceilings include 250 crore rupees for failures around security safeguards, 200 crore rupees for failures around breach notification and children's data, and 150 crore rupees for Significant Data Fiduciaries. These are maximum ceilings for the largest violators, applied by the Board after adjudication — not fines that automatically land on a small business website. They are a reason to take data protection seriously, not a reason to panic. A small business that collects only what it needs, secures it reasonably, and is honest with its users is in a far better position than the ceiling figures suggest.

Practical Steps for a Small Website Owner Now

Here is a proportionate plan between now and May 2027:

1. Map what you collect. List every form on your site — contact, enquiry, checkout, newsletter — and note what personal data each one asks for. If a field is not needed, remove it. Less data means less risk and less compliance work later.
2. Write a plain-language privacy notice. Even though the Phase III notice format is not yet in force, a clear notice today builds trust and gives you a head start. Say what you collect, why, and how a user can contact you.
3. Secure the basics. HTTPS, updated software, access limited to people who need it, and backups. These are good practice regardless of the DPDP timeline, and they are the foundation of the security-safeguard duties coming in Phase III.
4. Do not buy a Consent Manager product yet. Consent Managers are only now becoming registrable. Wait until registered options exist and it is clear how they integrate with ordinary websites, then evaluate.
5. Watch for the Board. Once the Data Protection Board becomes operational, its guidance will clarify more than any vendor checklist can. Track official announcements rather than marketing emails.

If you want the fuller step-by-step picture, our earlier guide on DPDP Act compliance for small websites — 7 steps before the May 2027 deadline covers the Phase III preparation in detail. Pair it with our article on passkeys replacing passwords — stronger logins are one of the cheapest security upgrades you can make while the law phases in.

Frequently Asked Questions

Do I need to register as a Consent Manager for my small website?

No. Consent Managers are a separate category of entity — India-incorporated companies with a net worth of at least 2 crore rupees that offer consent-management services to the public. An ordinary website that collects its own customers' data is a data fiduciary, not a Consent Manager, and has no Consent Manager registration duty.

What actually happens on 13 November 2026?

Phase II of the DPDP Rules takes effect, activating the Consent Manager registration, eligibility and conduct framework under Rule 4 and Section 6(9) of the Act. For an ordinary small website, this adds almost nothing directly on the day; the substantive fiduciary obligations arrive on 13 May 2027 with Phase III.

Is the Data Protection Board functioning yet?

Not as of October 2026. Posts were advertised in May 2026, and Parliament was told on 12 August 2026 that appointments were pending through a Search-cum-Selection Committee. Enforcement machinery is therefore still being set up.

Could the timeline be shortened?

A proposal in January 2026 to compress the timeline to 12 months was reported, but it had not been notified as of October 2026. Plan around the notified dates — Phase II on 13 November 2026 and Phase III on 13 May 2027 — unless and until an official change is published.

Sources

• vcisodesk — "DPDP Act & Rules 2025 Compliance for Indian SMEs" (published 30 May 2026) — https://vcisodesk.com/dpdp-act-compliance-guide-indian-smes/
• Mondaq (King Stubb & Kasiva) — "DPDP Act, 2023: Government Issues Removal of Difficulties Order, 2026 Clarifying Consent and Data Audit Requirements" (October 2026) — https://www.mondaq.com/india/data-protection/1856080/dpdp-act-2023-government-issues-removal-of-difficulties-order-2026-clarifying-consent-and-data-audit-requirements

Data protection starts with a properly built website. Ready Multi Service helps Indian small businesses get online professionally, with websites designed to collect only what they need and present it clearly to customers.