India's DPDP Act lets consent travel through a registered go-between that answers to the individual.

Instead of visiting every app to change what you agreed to, a consent manager gives you one place to do it. The DPDP Act lets a Data Principal, the person the data is about, give, manage, review or withdraw consent to a Data Fiduciary through one. The consent manager must be registered with the Board and acts on the individual's behalf.

For a business that relies on consent, a request arriving through a consent manager carries the same weight as one made directly. Your systems need to accept consent and withdrawals from that route and act on them. The Act makes the consent manager accountable to the Data Principal, not to the companies it connects, which changes the commercial relationship from the usual vendor arrangement. The Digital Personal Data Protection Rules, 2025 set out registration conditions and obligations, which matter if you are thinking of becoming one.

Section 2(g) of the DPDP Act

The definition: registered with the Board, a single point of contact, through an accessible, transparent and interoperable platform.

Section 6(7) to 6(9) of the DPDP Act

Consent may be handled through a consent manager, which is accountable to the individual and must be registered with the Board.

The DPDP Rules, 2025

Where the conditions for registration and the obligations of a consent manager are prescribed.

Your consent records

Each consent should show the route it came through, so a withdrawal via a consent manager can be matched and honoured.

Consent management platform (CMP)

Software a company buys to run cookie banners and preferences on its own sites. It serves the company, is not registered with the Board, and is not a consent manager in the Act's sense.

Account aggregator

A category licensed by the Reserve Bank of India for sharing financial information with consent. It is a separate regime; any overlap with DPDP consent managers depends on the Rules and RBI's framework.

Data processor

A processor acts for a data fiduciary. A consent manager acts for the individual.

• Check whether your consent records can accept requests that arrive through a third-party platform.
• Make withdrawal via any route stop processing in every downstream system.
• Record the source of each consent and withdrawal for later proof.
• If you plan to operate as a consent manager, read the registration conditions in the Rules first.

• GuideConsent managersWhat a consent manager does, and when you would use one.
• GuideValid consent and noticesWhat a notice says and what makes consent count.
• GuideData fiduciary, processor or consent manager?The three roles the Act names, and which one you are.

Sources: Digital Personal Data Protection Act, 2023, sections 2(g), 2(i), 2(k) and 6(7) to 6(9); Digital Personal Data Protection Rules, 2025 (MeitY notification).