Notifications
Clear all
Topic starter
22/07/2026 4:38 pm
TL;DR: India’s DPDP Act is now operational, with the Data Protection Board live since November 2025, Consent Manager registration opening in November 2026, and full enforcement arriving on May 13, 2027; the article says enterprises need real-time consent enforcement at the authorization layer, not batch-synced preference updates, according to OpenIAM. The compliance gap is architectural, because withdrawal, rights handling, and jurisdiction-specific consent cannot be left to delayed downstream propagation.
NHIMG editorial — based on content published by OpenIAM: India’s DPDP Act Is Now Operational and what enterprises need before the consent manager deadline
By the numbers:
- The Data Protection Board of India has been operational since November 13, 2025.
- The Consent Manager registration framework opens November 13, 2026.
- May 13, 2027 is a simultaneous enforcement date with no grace period.
Questions worth separating out
Q: How should enterprises implement DPDP consent enforcement in CIAM systems?
A: Enterprises should enforce consent at the authorization layer so every access decision checks the current consent state before data use begins.
Q: Why do batch-synced consent models fail DPDP compliance?
A: Batch-synced consent models fail because they create a gap between withdrawal and enforcement.
Q: What do identity teams get wrong about Consent Manager integration?
A: Teams often treat Consent Manager integration like a configuration task, but it is an API-level identity architecture change.
Practitioner guidance
- Move consent into the authorization layer Evaluate whether every data access request can check the current consent state before processing begins.
- Map every processing purpose to its own policy Break bundled consent flows into purpose-specific decisions and test them against each business process that consumes Indian resident data.
- Validate API-level Consent Manager integration Confirm that your CIAM platform can receive consent artefacts from a registered Consent Manager, translate them into runtime authorization rules, and preserve auditability across the full exchange path.
What's in the full article
OpenIAM's full article covers the operational detail this post intentionally leaves for the source:
- A timeline walk-through of the DPDP milestones that affect CIAM delivery sequencing and implementation order.
- A breakdown of consent manager integration considerations at the API layer for enterprise identity teams.
- A practical checklist for testing withdrawal, correction, and erasure workflows across connected systems.
- A comparison of DPDP and GDPR consent handling for multinational identity programmes.
👉 Read OpenIAM's analysis of DPDP consent manager compliance and CIAM readiness →
DPDP consent manager compliance: is your CIAM stack ready for 2027?
Explore further
22/07/2026 4:42 pm
DPDP consent governance exposes a runtime authorization gap, not a notice-management gap. The article makes clear that consent withdrawal must cease processing, which means the decisive control is whether authorization decisions see current consent state at the moment of access. A user profile update that propagates later is not a compliance control under that model. Practitioners should treat this as a shift from recordkeeping to runtime policy enforcement.
A few things that frame the scale:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to The 2024 ESG Report: Managing Non-Human Identities.
- Two-thirds of enterprises have endured a successful cyberattack resulting from compromised non-human identities, with a quarter encountering multiple attacks.
A question worth separating out:
Q: Who is accountable when DPDP obligations fail?
A: The data fiduciary remains accountable for lawful processing, security, breach handling, and rights fulfilment, even when processors or platforms perform parts of the work. That means governance must include contracts, access controls, and evidence trails. Delegation does not remove responsibility under the statute.
👉 Read our full editorial: DPDP consent manager compliance now requires real-time CIAM controls
