DPDP Consent Manager Deadline, 13 November 2026: What Your ERP Must Handle
The DPDP consent manager framework becomes real on 13 November 2026. That is when Rule 4 of the Digital Personal Data Protection Rules, 2025, covering consent managers, comes into force, one year after the Rules were notified. Six months later, on 13 May 2027, the core obligations on every data fiduciary apply, with penalties of up to Rs 250 crore per instance. If your ERP holds employee, customer, dealer or supplier data, and it almost certainly does, the next seven weeks are the time to get its consent handling in order.
What is a DPDP consent manager?
A consent manager is a registered entity that gives individuals one place to give, review and withdraw consent across the businesses that hold their data. Under the DPDP Act and Rules, consent managers register with the Data Protection Board and must act for the individual, not the business. When a person manages consent through a DPDP consent manager, the business on the other side must be able to receive that decision and act on it.
Consent managers are new, and the registration process is still settling. That is not a reason to wait. The capabilities your systems need are the same whether consent arrives through a consent manager, your website or a signed form.
Why your ERP is on the front line
Most personal data in a mid-sized Indian company lives in the ERP: employee records and payroll, customer contacts, dealer and distributor KYC, supplier contacts, and increasingly WhatsApp and email logs attached to CRM records. A privacy notice on the website does not help if the ERP cannot show why it holds a person’s data, for what purpose and until when.
5 ERP steps to take before 13 November
1. Map personal data by purpose
List every doctype that holds personal data, what it is used for and who can see it. This data map is the foundation for every other DPDP task.
2. Record consent per person and purpose
Replace a single “consented” checkbox with a consent record that stores the person, the purpose, the notice version shown, the date and the source, including a DPDP consent manager where one is used.
3. Make withdrawal flow through
When consent is withdrawn, marketing lists, integrations and automations must stop using that data. In ERPNext this is a workflow plus server-side checks, not a manual email to IT.
4. Set retention and erasure rules
Define how long each record type is kept once its purpose ends, and build a controlled, logged erasure or anonymisation process that respects tax and statutory retention.
5. Prove it with logs
Keep an audit trail of consent changes, access to sensitive records and erasure actions, so you can answer the Data Protection Board with evidence rather than assurances.
How ERPNext supports DPDP consent manager readiness
ERPNext already provides role-based permissions, document version history and workflow approvals. On top of that we typically add a consent register doctype linked to contacts and employees, API endpoints so a DPDP consent manager or your website can post consent events, and scheduled jobs that enforce retention. The work is usually weeks, not months, when the data map is done first.
What stays a legal task
Privacy notices, consent wording, processor contracts and deciding whether you may be a significant data fiduciary are legal questions. Confirm them with qualified counsel. The systems work and the legal work should run together, each owning its part.
Start with a clear data map. Talk to KlyONIX Tech about a DPDP data map and consent review of your ERP, or read our DPDP readiness checklist first.
Frequently asked questions
When do the DPDP consent manager rules apply?
Rule 4, on consent managers, applies from 13 November 2026. The main obligations on data fiduciaries apply from 13 May 2027.
Do we have to use a consent manager?
Individuals may choose to use one. Your business needs to be able to honour consent decisions that arrive through a registered consent manager, as well as those collected directly.
Does this apply to employee data?
Yes. Employee personal data is covered, although some processing for employment purposes may rely on legitimate uses. Map it and confirm the basis with counsel.
DPDP consent manager: key takeaways
The DPDP consent manager deadline is the first hard date most businesses will feel, and the ERP is where readiness is won or lost. Read the official DPDP Rules, 2025 from MeitY, see how ERPNext supports DPDP compliance, and explore our compliance and governance service.