India's Digital Personal Data Protection Rules make Consent Managers a legal requirement starting 14 November 2026. The catch: as of mid-2026, the Data Protection Board that is supposed to license and supervise them still had not appointed a Chairperson.
This post is a practical checklist: what the rules ask of a website, what we audit before recommending a redesign, and why waiting for the regulator to sort itself out is the wrong call for the site you run today.
What the DPDP Rules Actually Ask of Your Website
Strip away the legal language and the DPDP framework asks for a handful of concrete things from any website that collects personal data, which in practice means almost every website with a contact form, a checkout, or a newsletter signup.
- Consent has to be specific and informed. A single "we use cookies, accept all" banner does not meet the bar; each purpose (analytics, marketing, personalisation) needs its own opt-in.
- Withdrawing consent has to be as easy as giving it. If accepting takes one click and withdrawing takes four, that is a gap regulators are expected to look at.
- Notices have to name the purpose in plain language, in the languages a business actually operates in, not a legal team's boilerplate.
- Verifiable parental consent is required anywhere a site might knowingly collect data from a child.
- A grievance officer's name and contact details have to be published somewhere a user can actually find them.
The Website Audit Checklist We Run Before a Redesign
Before we touch a line of code on any project, we run the same short audit. It doubles as a reasonable DPDP starting point for any founder or product lead who wants to check their own site first.
- Does the consent banner let someone decline specific categories, or only "accept all" versus "reject all"?
- Do non-essential scripts (analytics, ad pixels, chat widgets) fire before consent is captured, or after?
- Is there a privacy notice attached to every data collection point, not one generic policy page linked from the footer?
- Is the grievance officer's contact information live, and does the inbox behind it actually get checked?
- Is there an age-gate or verified-consent flow anywhere the site might reasonably collect a minor's data?
- Can the business actually produce, on request, what data it holds on one specific person, and delete it?
- Is consent logged somewhere durable, or does it live only in a cookie that resets the moment someone clears their browser?
Why "Wait for the Regulator" Is the Wrong Strategy
The absence of a seated Data Protection Board is a real gap, and it is fair to be frustrated that the enforcement body is not fully staffed months out from the deadline. It is also not a reason to sit still. Registration opens 14 November 2026, full enforcement with penalties up to ₹250 crore begins 14 May 2027, and none of that timeline moves because the appointment process is running behind.
There is also a separate wrinkle worth flagging for anyone in fintech or lending: the existing RBI-regulated Account Aggregator framework already manages consent for well over two billion financial accounts, and how that regime lines up with the new Board's authority is still unsettled. If that overlap applies to your business, it is worth a direct conversation with counsel. For most standard business websites, though, the checklist above holds regardless of how that specific question resolves, so there is no real upside to waiting.
When an Audit Turns Into a Redesign
For a lot of the founders who come to us with this exact question, the audit above surfaces a website that was built a few years ago: a WordPress cookie plugin bolted on after the fact, a privacy policy copied from a template, analytics firing on page load regardless of what the banner says. At that point, patching the banner is not really the fix. The forms, the analytics stack, and the actual structure of the privacy notice all need to move together, and that is a redesign conversation rather than a plugin update.
We wrote recently about why founders who start with an AI website builder often end up back in an agency's inbox within eighteen months (see "Hire a Web Designer in India, Not an AI Builder"). Compliance is one more place that gap shows up: a templated site has no clean way to wire consent state into every third-party script it loads, because there is no one who actually owns that architecture.
The Takeaway
- The 14 November 2026 registration deadline is fixed. The regulator being understaffed does not extend it.
- Run the seven-point audit above on your own site this month, not after the Board publishes final technical standards.
- If the audit turns up a banner problem, fix the banner. If it turns up an architecture problem, plan for a redesign now while there is still runway before enforcement.
Running the audit on your own site and finding more architecture problems than banner problems? Start a project with our web design and development team, or book a free consultation and we will walk through the findings together.
