DPDP consent managers
A consent manager works for the individual. Your duties stay with you.
The Act lets people give, manage, review and withdraw consent through a consent manager: a registered company running one platform that connects to many businesses. The registration rule is the first operational part of the Rules to switch on, so this is a good moment to understand what it is, and what it is not.
Back to DPDP services01 · What it is
One place to manage consent, run for the person
Defined in section 2(g); working under sections 6(7) to 6(9).
A consent manager is a company registered with the Data Protection Board of India (the Board) that acts as a single point of contact for people to give, manage, review and withdraw consent. The Act requires its platform to be accessible, transparent and interoperable. It is accountable to the individual and acts on her behalf, whatever the commercial arrangement with the businesses that join it.
02 · Status
Where the framework stands in October 2026
Rule 4 takes effect one year after the Rules were published.
Rule 4 and the First Schedule set out registration and obligations. Rule 4 comes into force one year after the Rules were published in November 2025, which puts it in November 2026. Before then there is no registration route under the Rules. The Board also has to publish the application particulars, and the data protection standards and assurance framework a platform must be certified against.
If a provider says it is a registered DPDP consent manager, ask for its entry on the Board's website. The Board publishes the particulars of every consent manager it registers.
03 · Registration
What it takes to register
Nine conditions in Part A of the First Schedule.
| Condition | What the Board looks for |
|---|---|
| Incorporation | A company incorporated in India |
| Capacity | Technical, operational and financial capacity to meet its obligations |
| Soundness | Sound finances and sound management |
| Net worth | At least two crore rupees |
| Viability | Adequate expected business, capital structure and earning prospects |
| People | Directors, key managerial personnel and senior management known for fairness and integrity |
| Constitution | Articles and memorandum that lock in the conflict-of-interest duties, changeable only with the Board's prior approval |
| Purpose | Operations in the interests of data principals |
| Independent certification | Platform and controls certified as consistent with the standards and assurance framework the Board publishes |
The Board may inquire before deciding and must give reasons if it rejects an application. Later, after a hearing, it can direct a consent manager to fix non-compliance, and it can suspend or cancel a registration to protect the people using the platform.
04 · Obligations
What a consent manager owes
The duties in Part B, grouped into six.
- CM.1Carry consent, not contentLet a person consent to an onboarded fiduciary directly or through another fiduciary holding her data, and share data in a way the consent manager cannot read.
- CM.2Keep the recordRecord consents given, refused and withdrawn, the notices behind them and each sharing. Give the person access and a machine-readable copy, and keep it at least seven years.
- CM.3Do the work itselfRun its own website or app, never sub-contract or assign its obligations, and keep reasonable security safeguards.
- CM.4Stay on the person's sideAct in a fiduciary capacity to the individual, avoid conflicts with fiduciaries, and publish its promoters, directors and shareholders above two per cent.
- CM.5Answer to the BoardRun audit mechanisms and report results to the Board, and get prior approval before any change of control.
- CM.6Handle complaintsOffer grievance redressal and publish its response period, as fiduciaries must.
05 · Plugging in
How a business would plug in
Most of the work is mapping, not integration.
- Decide where a consent manager helps: where people move data between businesses (lending, insurance, health) more than at a simple sign-up.
- Choose only from the Board's published register, and check the registration is current.
- Map each consent request onto the platform: purpose, data items and wording that match your own notice.
- Connect withdrawals from the platform to your systems, so processing stops, at your processors too, within a reasonable time.
- Reconcile the platform's record with your own consent log on a schedule.
- Keep your own direct route open as well: using a consent manager is the person's choice, not yours.
06 · What stays with you
What stays with you
The consent manager carries the consent. The duties stay with the fiduciary.
The consent manager
- Presents your request on its platform
- Records consents, refusals and withdrawals
- Moves the data without reading it
- Answers complaints about its own conduct
Your company, the fiduciary
- A notice that meets section 5 and rule 3
- Choosing purposes and asking only for necessary data
- Proving notice and consent if challenged (section 6(10))
- Security, breach intimation, erasure and retention
- Answering access, correction and erasure requests
- Contracts with your own processors
Account aggregators regulated by the Reserve Bank of India already run a consent-led model for financial data. The Rules do not say how they relate to DPDP consent managers, so check with counsel before assuming one counts as the other.
Sources: The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), sections 2(g), 6(7) to 6(10) and 13; the Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E)), rules 1, 4 and 14 and the First Schedule.
Questions about consent managers
Do we have to use a consent manager?
No. Using one is the individual's choice.
The Act says a person may manage consent through a consent manager. You still need your own notice, consent capture and withdrawal path for people who deal with you directly.
Is a consent manager our processor?
No. It acts for the individual.
It is accountable to the data principal and must avoid conflicts of interest with fiduciaries. Treat it as a channel the person controls, not as a vendor working to your instructions.
Can a consent tool vendor call itself a consent manager?
Only once the Board has registered it.
The Act defines a consent manager as a registered person. A consent-management tool that sits inside your own website is your software, and you remain the one collecting consent.
Can a foreign company register?
No. The applicant must be a company incorporated in India.
Part A of the First Schedule makes Indian incorporation the first condition, alongside a net worth of at least two crore rupees and independent certification of the platform.
Does the consent manager hold our customers' data?
It keeps a consent record; the data it moves must stay unreadable to it.
It must keep a record of consents, notices and sharing for at least seven years, but the personal data it routes must be shared in a way whose contents it cannot read.
Get consent right before you route it anywhere.
A DPDP readiness assessment checks your notices, consent logs and withdrawal paths, so plugging into a consent manager later is a mapping job. Counsel should confirm how the law applies to your contracts.