Topic starter
22/07/2026 4:38 pm
TL;DR: India’s DPDP Act is now operational, with the Data Protection Board live since November 2025, Consent Manager registration opening in November 2026, and full enforcement arriving on May 13, 2027; the article says enterprises need real-time consent enforcement at the authorization layer, not batch-synced preference updates, according to OpenIAM. The compliance gap is architectural, because withdrawal, rights handling, and jurisdiction-specific consent cannot be left to delayed downstream propagation.
Editorial analysis by NHI Mgmt Group, based on content published by OpenIAM: “India’s DPDP Act Is Now Operational — What Enterprises Need to Have in Place Before the Consent Manager Deadline”.
Key questions
Q: What breaks when DPDP consent is managed as a profile update instead of an access decision?
A: Processing continues during the synchronisation window, so withdrawn consent still leaves a usable access path in downstream systems.
Q: Why does real-time consent enforcement matter more than batch sync for DPDP?
A: Because DPDP treats withdrawal as an immediate stop condition, not as a preference change to be propagated later.
Q: What are the signs that a CIAM platform cannot meet DPDP rights workflows?
A: The clearest signs are separate consent stores, manual handling of withdrawal requests, and no reliable way to propagate correction or erasure across connected systems.
Practitioner guidance
- Map consent to the authorisation layer Replace preference-only handling with policy decisions that evaluate current consent before each data access or processing request.
- Build API-level Consent Manager integration Validate that the CIAM platform can ingest, verify, and translate Consent Manager artefacts in real time, including revocation and purpose-specific conditions.
- Inventory identity-linked data stores Document every system that holds Data Principal data, including CRM, analytics, marketing, and third-party processors, so access, correction, and erasure requests can propagate consistently.
Bottom line: DPDP consent compliance is an access-control problem as much as a privacy problem, because withdrawn consent must stop processing at the point of decision.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/07/2026 4:42 pm
DPDP consent compliance exposes an authorisation-layer control gap, not a notice-management gap. The article makes clear that consent withdrawal has to stop processing across every dependent system, which means the decisive control is where access is authorised, not where preferences are stored. That shifts the governance problem from recordkeeping to runtime policy enforcement, and teams that treat consent as a UI or CRM concern will miss the actual failure mode. The practitioner conclusion is simple: consent governance has to sit in the request path.
A question worth separating out:
Q: How should organisations handle DPDP and GDPR consent requirements in one identity programme?
A: Use a single policy engine with jurisdiction-specific rules rather than building separate CIAM deployments for each population. That approach lets the organisation apply DPDP’s stricter consent and withdrawal expectations to Indian residents while preserving GDPR logic where it still applies. The key is policy separation, not platform duplication.
👉 Read our full editorial: DPDP consent manager compliance now requires real-time CIAM controls