The DPDP Consent Manager Deadline Is 13 November 2026

Dr Tiwari runs six diagnostic labs across Lucknow. His website takes a name, a mobile number, a test selection and a home-collection address, then WhatsApps it to a shared inbox. It has done that since 2019. When we walked him through DPDP Act compliance for websites in July, the uncomfortable part was not the law. It was that nobody in his office could say where those enquiries went after the WhatsApp message, or who still had access.

India's Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025, starting a staged compliance runway under the DPDP Act, 2023. The Consent Manager framework under Rule 4 becomes operational on 13 November 2026. That is the first hard, date-bound obligation most Indian businesses will meet, and it is now under three months away.

The Timeline, Stated Honestly

Compliance dates get exaggerated by people selling compliance. Here is what is reported consistently across Indian legal and trade coverage, and nothing beyond it.

What the Consent Manager Framework Means for You

This is where DPDP Act compliance for websites stops being paperwork. A Consent Manager is a registered intermediary through which a person can give, review and withdraw consent across the businesses holding their data. For most small and mid-sized site owners the practical consequence is not that you must become one. It is that consent stops being a checkbox you rendered once and forgot.

If someone can review and withdraw consent, your systems have to be able to answer three questions on demand: what did this person agree to, when, and for which purpose. If the answer lives in a WhatsApp thread, that is the project.

Six Concrete Changes for DPDP Act Compliance for Websites

The Data Map Nobody Wants to Draw

Before any of that, draw the map. Every serious attempt at DPDP Act compliance for websites we have run started here, and every panicked one skipped it. One page. For every field you collect: where it enters, where it lands, who can read it, how long it stays, and which outside service touches it. Half of DPDP Act compliance for websites is discovering the exports somebody set up in 2022 and never turned off.

• Every form on the site, including the one on the old landing page nobody links to
• Every integration with a webhook pointed at it
• Every spreadsheet a team member downloads weekly
• Every shared inbox and shared login
• Retention period per field, written down and defensible

What the Lab Chain Actually Shipped

Dr Tiwari's team had eleven weeks and no in-house developer. Illustrative scope, but this is a realistic amount of work for a small operation.

They replaced the single tick box with three purpose lines. They added a consent table storing timestamp, purpose, notice version and withdrawal state. They killed a Google Sheet export that had been mailing enquiry data to a former marketing consultant. They wrote a deletion runbook, three pages, that a receptionist can follow. They published a grievance contact with a 72-hour reply commitment they could actually honour.

What they did not do: buy a compliance platform. At six locations and a few hundred enquiries a month, DPDP Act compliance for websites at their scale was a schema change, a runbook and an honest afternoon of deleting things.

What DPDP Act Compliance for Websites Costs, and What It Does Not

The honest trade-off: separated, purpose-specific consent will reduce your marketing list. Bundled ticks inflate lists with people who never meant to opt in. Expect a smaller database and better deliverability, and tell your sales team before the numbers move, not after.

Five Mistakes We Keep Seeing

• Copying an EU cookie banner and assuming the notice requirement is met
• Storing consent as a single column with no timestamp or purpose
• Building a deletion request form with no workflow behind it
• Forgetting the chat widget, which usually collects more than the contact form does
• Treating the November date as the finish line rather than the first checkpoint

A Twelve-Week Plan You Can Start on Monday

Deadlines get met by calendars, not by intentions. Twelve weeks is roughly what remains, and it is enough for a small team if nobody waits for a compliance vendor to sell them a plan first.

Weeks 1 to 2, discovery. Draw the data map. One person, two afternoons, a shared document. List every form, every integration, every export, every shared inbox. Do not fix anything yet. Half of DPDP Act compliance for websites is discovering what you did not know you were collecting, and discovery gets sloppy the moment somebody starts patching in parallel.

Weeks 3 to 4, decisions. For each field, decide the purpose in plain words and the retention period in days. Write both down. Delete what has no purpose. This is the step where a lot of legacy data quietly leaves the building, and it is the cheapest risk reduction available to you.

Weeks 5 to 8, build. Notice text on every collection point. Unbundled consent choices. A consent table storing timestamp, purpose, notice version and withdrawal state. A withdrawal route in the footer. A grievance contact with a response time you can honour. Most of DPDP Act compliance for websites at small scale lands in this block, and it is ordinary development work.

Weeks 9 to 10, the processors. Chase every vendor whose script or API touches your users' data and get their terms in writing. This takes longer than the code, because it depends on other people replying to email. Start it early if your stack is vendor-heavy.

Weeks 11 to 12, rehearsal. Run a fake deletion request end to end and time it. Run a fake access request. Have someone outside the project try to withdraw consent unaided. Whatever breaks here is what would have broken in front of a regulator or an annoyed customer.