DPDP consent managers start 13 Nov: what it means for creator deals

If your creator campaigns collect names, phone numbers or emails through giveaways, link-in-bio forms or WhatsApp opt-ins, India's data protection law is about to become very practical. The first commercial piece of it, the consent manager framework, switches on next week.

What changes on 13 November 2026?

The Digital Personal Data Protection Rules, 2025 were notified through gazette notification G.S.R. 846(E), dated 13 November 2025, according to law firm S.S. Rana & Co.. The Rules come into force in three phases. A few foundational rules applied immediately. Rule 4, which governs consent managers, applies one year after publication, as BestMediaInfo also reported when the Rules came out. S.S. Rana puts that date at 13 November 2026. Some lawyers count it as 12 November, so treat it as the middle of next week rather than a precise hour.

What is a consent manager?

A consent manager is a registered platform where a person can give, review and withdraw consent to many companies in one place. Under the Rules it must register with the Data Protection Board. A Cyberdunes explainer dated 17 October 2026, written by a company that sells consent software, summarises the eligibility criteria as an Indian company with a net worth of at least ₹2 crore, independent certification and no conflicts of interest with the brands it serves.

So next week's date is mainly about who can operate these platforms. It does not, on its own, force a brand to use one.

When do brands themselves have to comply?

The bigger set of duties applies 18 months after publication. That covers Rules 3, 5 to 16, 22 and 23: notices, consent, security safeguards, breach reporting, children's data and user rights. S.S. Rana dates this to 13 May 2027. Penalties under the Act go up to ₹250 crore for failing to take reasonable security safeguards, BestMediaInfo notes.

Cyberdunes reports that MeitY proposed in 2026 to shorten the window to 12 months for Significant Data Fiduciaries, a category for large data handlers, but says no amending notification had been issued as of September 2026. We could not confirm this on MeitY's own site, so check before relying on the May 2027 date if your company might be classed as significant.

Where does this touch creator campaigns?

More places than most brand teams think:

• Giveaways and contests: "comment your number" or "fill this form to win" collects personal data. Each needs a clear notice of what you collect and why.
• Lead forms behind creator links: the brand, not the creator, is usually the data fiduciary responsible for consent.
• Retargeting lists built from campaign sign-ups: consent has to be specific to that use, and people must be able to withdraw it as easily as they gave it.
• Teen audiences: the Act bans targeted advertising directed at children, meaning anyone under 18, and tracking of their behaviour. Creators with large school-age followings need extra care.

Our take from Delhi

Nothing breaks for a brand on 13 November, and anyone selling panic about it is overselling. But May 2027 is only six months away in campaign-planning terms, and most creator giveaways we see in Delhi NCR still collect phone numbers with no notice at all. Fix the forms now, while it is cheap, and agree in writing with creators who owns the data and what they may do with it.