The DPDP Act consent and notice rules were notified on 13 November 2025 and do not bind an Indian business until May 2027. Notification G.S.R. 843(E) places section 5 of the Digital Personal Data Protection Act, 2023, which governs notice, and section 6(1) to (8) and (10), which governs consent, in an eighteen-month commencement tranche, together with rule 3 of the Digital Personal Data Protection Rules, 2025. Only section 6(9), the Consent Manager provision, arrives earlier, at twelve months in November 2026. Until the eighteen-month date, consent for sensitive personal data is still governed by the older SPDI Rules 2011 made under the Information Technology Act, 2000.<\/p>\n
This article sets out the DPDP Act consent and notice rules as the Gazette text states them.<\/p>\n
The gap between notification and commencement explains most of what is now circulating about these provisions. A notification fixes the text of a law. A commencement date fixes when it starts to bind, and here the two sit eighteen months apart. That is not a drafting quirk either, because section 1(2) of the Act expressly allows different dates for different provisions, and the Ministry of Electronics and Information Technology used it.<\/p>\n
One misreading has travelled particularly far. Several outlets reported that companies have until November 2026 to appoint a Consent Manager. Section 6(9) says nothing of the kind: it permits a Data Principal to give, manage, review and withdraw her consent through a Consent Manager registered with the Data Protection Board of India, and rule 4 sets out how an entity applies to become one. No business is required to appoint anybody.<\/p>\n\n