DPDP's Consent Manager framework is rolling out now — what it means for Indian businesses

Direct answer: India's DPDP compliance infrastructure is moving from paper rules to active implementation this quarter — the government is operationalizing the Consent Manager framework between June and August 2026, has begun forming the Data Protection Board of India, and is consulting industry on a proposal that would shorten the compliance deadline for large data processors from 18 months to 12.

What happened

After the DPDP Rules 2025 were notified in November 2025, 2026 has become what compliance trackers are calling the "build and test" year — the year the actual enforcement infrastructure gets built, ahead of full regulatory accountability in 2027. Several concrete pieces of that infrastructure are now moving in parallel, according to India Briefing's tracking of the DPDP compliance timeline.

Key facts and numbers

• MeitY invited applications in May 2026 for the Chairperson and four Members of the Data Protection Board of India — the body that will actually enforce DPDP and adjudicate complaints.
• The Consent Manager framework — interoperable platforms letting individuals manage, review, and withdraw consent across multiple digital services in one place — is expected to be operationalized between June and August 2026.
• MeitY is actively consulting industry on a proposal to shorten the compliance window for Significant Data Fiduciaries (large-scale data processors) from 18 months to 12 months, which would move their effective deadline earlier than the originally planned May 2027 date.
• Full regulatory accountability, under the current timeline, still centers on May 2027 as the "hard enforcement" date for the broader DPDP framework.

Why it matters

The Consent Manager framework specifically changes the practical mechanics of compliance for any business collecting Indian user data: instead of every business independently managing consent UI and withdrawal requests, consent becomes portable across an interoperable system the individual controls. Businesses that built ad hoc, one-off consent flows will need to plan for integration with this framework, not just their own internal compliance checklist.

Industry impact

The Data Protection Board's formation is the more consequential long-term development — it's the enforcement body, and its composition and early posture (aggressive vs. cooperative enforcement) will set the tone for how strictly DPDP actually gets enforced once the transition period ends. Businesses currently treating compliance as a low-urgency checkbox should watch this closely.

Risks

The potential compression of the Significant Data Fiduciary deadline from 18 months to 12 is still under consultation, not finalized — but large data processors that assumed they had until May 2027 should not treat that date as fixed. Businesses in this category should plan against the earlier, tighter timeline as the more conservative assumption.

What businesses should do next

Businesses that haven't started DPDP implementation should treat 2026 as the actual working deadline, not 2027 — by the time enforcement infrastructure (the Board, the Consent Manager framework) is fully live, the transition period discount effectively ends. See our complete DPDP implementation guide for a structured starting point.

What happens next

Expect the Data Protection Board's Chairperson and Members to be formally appointed in the coming months, the Consent Manager framework to move from operationalization to mandatory integration, and a final decision on the 12-versus-18-month Significant Data Fiduciary timeline once industry consultation concludes.

Frequently asked questions

What is the DPDP Consent Manager framework? It's an interoperable platform system that lets individuals manage, review, and withdraw consent for their personal data across multiple digital services in one place, rather than negotiating consent separately with every business.

When is the Consent Manager framework being rolled out? MeitY is operationalizing it between June and August 2026, following the notification of the DPDP Rules in November 2025.

Has the Data Protection Board of India been formed yet? MeitY invited applications for the Chairperson and four Members in May 2026; formal appointments are expected in the following months as the enforcement body stands up.

Could the DPDP compliance deadline change? Yes — MeitY is consulting industry on a proposal to shorten the deadline for Significant Data Fiduciaries from 18 months to 12 months, which would move their effective deadline earlier than the originally planned May 2027 date.

What should businesses do now? Treat 2026 as the real working deadline for DPDP implementation rather than waiting for the 2027 hard-enforcement date, since enforcement infrastructure is actively being built out this year.

---

Cor Advance Solutions helps Indian businesses build practical DPDP compliance programs. Start with our free DPDP compliance assessment or read our 90-day DPDP compliance roadmap.

Source: India Briefing — India's DPDP Timeline: Critical Compliance Deadlines for 2026-27