The three phases of DPDP Rules 2025
The DPDP Rules do not apply all at once. They follow a staged timeline counted from notification on 13 November 2025:
- Immediately: the provisions that set up the Data Protection Board of India took effect on notification.
- 13 November 2026 (12 months): the Consent Manager framework begins. Consent Managers must be Indian companies registered with the Data Protection Board.
- 13 May 2027 (18 months): the core obligations apply, including notices, consent, reasonable security safeguards, breach intimation, Data Principal rights, erasure and processing of children's data.
What the DPDP Act expects from consent
Under the Act, consent must be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action, and limited to the purpose it was collected for. Every request for consent has to be backed by a notice that explains what personal data is collected, why, and how the Data Principal can withdraw consent or raise a grievance.
Withdrawal must be as easy as giving consent. When consent is withdrawn, the Data Fiduciary has to stop processing and ensure its Data Processors stop too. That is hard to prove if consent lives in scattered forms, spreadsheets and marketing tools.
Why penalties make this a board-level issue
The Act allows the Data Protection Board to impose penalties of up to ₹250 crore for failing to take reasonable security safeguards to prevent a personal data breach, with other significant penalties for failures such as not notifying breaches or not meeting obligations related to children's data. For most organisations, the practical risk is being unable to prove what consent was given, for which purpose and when.
A consent management checklist for May 2027
- Map every channel where you collect personal data: websites, mobile apps, forms, call centres, branches and partner integrations.
- List each purpose of processing and link it to the data you collect, so consent can be purpose-specific.
- Rewrite notices in plain language, available in English and the languages listed in the Eighth Schedule of the Constitution where needed.
- Capture consent with a clear affirmative action and store a tamper-evident record of who consented, to what, and when.
- Give Data Principals a self-service way to review and withdraw consent, and pass withdrawals to every connected system.
- Set up a process to receive, verify and respond to access, correction, erasure, grievance and nomination requests.
- Review cookies and trackers on your website and block non-essential ones until the visitor consents.
- Update contracts with Data Processors so they follow your consent and erasure instructions.
- Prepare a breach response plan covering intimation to the Board and to affected Data Principals.
Where a consent management platform fits
A consent management platform gives you one place to capture, store and prove consent across channels. Instead of rebuilding consent logic in every application, your systems call a central service through SDKs and APIs, and every change is written to an audit trail you can show the Data Protection Board.
ConvergeDPDP is built around these DPDP requirements: purpose-based consent capture, a preference centre for withdrawals, a cookie consent manager, Data Principal rights handling and audit-ready reporting, hosted in India.
Start now, not in April 2027
Mapping data flows, rewriting notices and integrating consent into existing systems takes months, especially for banks, insurers, hospitals and retailers with many collection points. Organisations that start in 2026 have time to test and fix gaps before the 13 May 2027 deadline.