The Consent Manager registration and enforcement provisions under the Digital Personal Data Protection Rules, 2025 come into force in mid-November 2026 — one year after the Rules were notified on 13 November 2025. For Indian AI teams that process end-user personal data (a chat assistant, a recommender, an agent handling user documents — most consumer products running on rented GPU compute), the short version is: a new category of licensed consent intermediary is about to exist on paper, but the regulator meant to license it — the Data Protection Board of India — still had no appointed Chairperson or Members as of the government's own recruitment notice in May 2026. What changes this year is less about a working consent-manager marketplace and more about how you structure consent internally, ahead of the Act's substantive obligations becoming fully enforceable on 13 May 2027.
What a Consent Manager is supposed to do
A Consent Manager is a registered, India-incorporated intermediary that gives an individual one place to give, review, and withdraw consent across multiple organisations, instead of a separate consent relationship with each data fiduciary — broadly similar in spirit to the "account aggregator" model already used in Indian financial services.
Who can actually register as one
The bar is high by design: applicants must be incorporated in India, show a minimum net worth of ₹2 crore verified through audited financials, meet a "fit and proper" standard for directors and key personnel, and demonstrate the technical capacity to route consent at scale without being able to read the personal data passing through. A foreign platform can't register directly. In practice this rules out most early-stage companies, leaving the role to a handful of well-capitalised, India-incorporated entities.
The gap: a framework with no regulator staffed to run it
The Data Protection Board of India is the body that registers Consent Managers, sets their technical standards, and hears grievances under the Act. As of a MeitY recruitment notice dated May 2026, the government was still advertising for a Chairperson and four Member positions — meaning the institution due to start registering Consent Managers within months had, at the time, nobody in the chair to do it. Reporting on the Board's status through mid-2026 describes the same gap: obligations live on paper while the enforcing body remains without appointed leadership. The November 2026 date marks when registration and enforcement provisions formally commence, not necessarily when a functioning market of registered Consent Managers exists for you to plug into.
What this means if you're running an AI product on rented GPU compute
GPU cloud providers aren't the ones registering as Consent Managers — they're infrastructure, not the entity collecting consent from your end users. If you're the data fiduciary (you collect and use the personal data, and rent GPU capacity to run the model), getting consent right is your obligation, and it doesn't wait for a Consent Manager ecosystem to exist. The Rules already require itemised, purpose-specific consent notices rather than a single omnibus policy checkbox — that requirement isn't contingent on the Consent Manager provisions being operational. See our earlier DPDP compliance checklist for choosing a GPU cloud provider for what to ask a provider about data handling and breach visibility; that guidance is unaffected by this timeline and remains the more immediate checklist.
What to actually do before May 2027
- Fix consent flows now — itemised, purpose-specific notices are a near-term obligation independent of the Consent Manager rollout.
- If a vendor claims to be a "DPDP-registered Consent Manager" before the Board is staffed and issuing registrations, ask for the certificate — the claim isn't yet backed by an operating registrar.
Frequently asked questions
Do GPU cloud providers need to register as Consent Managers?
No. Consent Manager is a specific licensed role for handling individuals' consent across organisations — GPU infrastructure providers don't fall into it. If your product collects personal data from end users, the consent obligation sits with you as the data fiduciary, not with the GPU provider you rent compute from.
What's the deadline that matters most for most AI teams?
13 May 2027 — when the DPDP Act's substantive obligations (notice requirements, security safeguards, breach reporting) become fully enforceable. Consent Manager registration is one piece of the broader Act; itemised consent notices and provider due diligence are worth acting on well before that date, not after.
This is general information based on the Digital Personal Data Protection Rules, 2025, government recruitment notices for the Data Protection Board of India, and published legal/industry commentary as of September 2026, not legal advice. Confirm the Board's current staffing status and the exact Consent Manager rollout date against current MeitY notifications, and consult counsel for your specific obligations as a data fiduciary.