Published does not mean every provision is in force.

The Act: consent and withdrawal

Section 6 addresses informed, specific consent and the ability to withdraw. It also addresses withdrawal consequences and cessation of processing, subject to legal exceptions. This is why the demonstration separates a preference change from a promise that all processing or retention has ended.

Digital Personal Data Protection Act, 2023 · section 6 (PDF) ↗

Published: 11 August 2023 · Sections 6(1)–(8) and 6(10): scheduled for 13 May 2027 under the cited commencement instrument.

Three commencement stages

• 13 November 2025 · commenced cohortAct section 1(2), section 2, sections 18–26, 35, 38–43 and 44(1), 44(3). Rules 1, 2 and 17–21.
• 13 November 2026 · scheduled cohortAct section 6(9), section 27(1)(d) and Rule 4.
• 13 May 2027 · scheduled cohortAct sections 3–5, 6(1)–(8), 6(10), 7–17, the remaining section 27, sections 28–34, 36, 37 and 44(2). Rules 3, 5–16, 22 and 23.

G.S.R. 843(E), Act commencement (PDF) ↗ · G.S.R. 846(E), Rules 1–4 (PDF) ↗

Both instruments dated 13 November 2025. Future dates are calculated from their one-year and eighteen-month intervals.

Notices and Consent Managers are distinct subjects.

Rule 3 covers notice information and routes to exercise choices. Rule 4 concerns registration and obligations of Consent Managers. This site demonstrates an interface; it is not a registered Consent Manager and does not offer those services.

Final DPDP Rules, 2025 (PDF) ↗ · Rules corrigendum, G.S.R. 892(E) (PDF) ↗

Rules published: 13 November 2025 · Corrigendum: 4 December 2025. Apply the correction when reading the Rules. Rule 3 is in the May 2027 cohort; Rule 4 is in the November 2026 cohort.