Summary: The Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025 establish a framework for registered Consent Managers to help individuals give, review, manage and withdraw consent for processing their personal data through accessible, transparent and interoperable platforms. Section 2(g) defines the Consent Manager, while Section 6 governs consent-related rights and obligations. Rule 4, read with the First Schedule, prescribes registration conditions, including incorporation in India, adequate operational and technical capacity, a minimum net worth of ₹2 crore, management integrity and independent certification. Registered Consent Managers must maintain prescribed consent records, provide access to individuals, implement security safeguards, preserve independence and comply with continuing oversight requirements. The framework distinguishes Consent Managers from Data Fiduciaries, which retain responsibility for lawful processing and compliance. For businesses, the principal implications concern technology integration, withdrawal management, vendor governance, record retention and audit readiness. Rule 4 is scheduled to commence on 13 November 2026, making advance preparation important for prospective applicants and organisations planning to integrate with registered Consent Managers.
- Introduction
- 1. What is a Consent Manager under the DPDP Act?
- 2. Legal Framework Governing Consent Managers
- 3. Who Can Become a Consent Manager?
- 4. Key Roles and Responsibilities of a Consent Manager
- 4.1 Facilitating Consent
- 4.2 Enabling Review and Withdrawal
- 4.3 Maintaining Consent-Related Records
- 4.4 Providing Access to Consent Records
- 4.5 Protecting Personal Data
- 4.6 Maintaining Independence and Avoiding Conflicts
- 4.7 Complying with Oversight and Audit Requirements
- 5. How Will Consent Managers Affect Businesses?
- 5.1 Consent Architecture and Technology Integration
- 5.2 Withdrawal Management
- 5.3 Vendor and Contractual Governance
- 5.4 Record-Keeping and Audit Readiness
- 5.5 Customer Trust
- 6. Consent Manager versus a Data Fiduciary: A Critical Distinction
- 7. Practical Readiness Checklist for Businesses
- 8. Commencement and Implementation Timeline
- Conclusion
Introduction
In the digital economy, consent is no longer merely a checkbox on a website or a one-time acceptance of a privacy policy. Individuals increasingly expect to understand how their personal data is used, which organisations process it and how they can withdraw their consent when they no longer wish to permit such processing.
The Digital Personal Data Protection Act, 2023 (DPDP Act), read with the Digital Personal Data Protection Rules, 2025, introduces the concept of a Consent Manager to facilitate the exercise of these rights through an accessible, transparent and interoperable platform.
The concept is particularly relevant in an ecosystem where individuals interact with multiple digital platforms, financial institutions, service providers and other organisations. Instead of managing consent separately across multiple interfaces, a Consent Manager is intended to provide a structured mechanism through which individuals can give, review, manage and withdraw consent.
For businesses, this development has implications for consent architecture, technology integration, record-keeping, privacy governance and customer experience.
1. What is a Consent Manager under the DPDP Act?
Section 2(g) of the DPDP Act defines a Consent Manager as a person registered with the Data Protection Board of India who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform.
In the terminology of the Act:
- Data Principal: The individual to whom the personal data relates.
- Data Fiduciary: The person who determines the purpose and means of processing personal data.
- Consent Manager: The registered intermediary that enables the Data Principal to manage consent through its platform.
The Consent Manager does not replace the Data Fiduciary. The two have distinct functions within the data protection ecosystem.
The Data Fiduciary remains responsible for complying with its obligations under the Act, including ensuring that personal data is processed lawfully and that applicable consent requirements are satisfied.
2. Legal Framework Governing Consent Managers
The principal statutory provisions are:
| Legal provision | Relevance |
|---|---|
| Section 2(g) of the DPDP Act | Defines a Consent Manager |
| Section 6 of the DPDP Act | Governs consent and withdrawal of consent |
| Rule 4 of the DPDP Rules, 2025 | Prescribes the registration framework and obligations |
| First Schedule, Part A | Sets out registration conditions |
| First Schedule, Part B | Prescribes obligations of Consent Managers |
Section 6 requires consent, where relied upon as the legal basis for processing, to be free, specific, informed, unconditional and unambiguous, with a clear affirmative action. A Data Principal must also be able to withdraw consent, with the ease of withdrawal comparable to the ease with which consent was given.
A Consent Manager provides an infrastructure through which these consent-related rights can be exercised. It does not create a substitute for valid consent or remove the need for a Data Fiduciary to comply with Section 6.
3. Who Can Become a Consent Manager?
Rule 4, read with Part A of the First Schedule, establishes a registration framework administered by the Data Protection Board of India.
The prescribed conditions include:
- Indian incorporation: The applicant must be a company incorporated in India.
- Adequate capacity: It must possess sufficient technical, operational and financial capacity to perform its obligations.
- Financial soundness: Its financial condition and the general character of its management must be sound.
- Minimum net worth: The applicant must have a net worth of at least ₹2 crore.
- Business viability: Its anticipated business volume, capital structure and earning prospects must be adequate.
- Management integrity: Its directors, key managerial personnel and senior management must have a general reputation and record of fairness and integrity.
- Appropriate constitutional documents: Its memorandum and articles of association must contain the prescribed safeguards concerning specified obligations and the relevant approval requirements.
- Data Principal’s interests: The proposed operations must be in the interests of Data Principals.
- Independent certification: The applicant must obtain the prescribed independent certification regarding its interoperable platform and compliance with the applicable standards and assurance framework.
Meeting the prescribed conditions does not itself amount to registration. The applicant must apply to the Board, which may examine the application and determine whether to grant registration.
These conditions make it clear that the Consent Manager framework is intended for entities with appropriate governance, technical infrastructure and financial capacity, rather than any organisation that merely provides a consent-management feature.
4. Key Roles and Responsibilities of a Consent Manager
The First Schedule, Part B, sets out the obligations of a registered Consent Manager. Its principal functions include the following.
4.1 Facilitating Consent
The Consent Manager must enable a Data Principal to give consent to the processing of personal data by a Data Fiduciary onboarded onto its platform. The framework also addresses consent being communicated directly to the relevant Data Fiduciary or through another onboarded Data Fiduciary that maintains the individual’s personal data with consent.
The objective is to facilitate a transparent and interoperable consent-management process.
4.2 Enabling Review and Withdrawal
The platform must enable individuals to review and manage their consent and withdraw it when they choose to do so.
For businesses, this means that consent withdrawal cannot be treated as merely a front-end user-interface function. The relevant systems and workflows must be capable of receiving and appropriately acting upon withdrawal instructions.
4.3 Maintaining Consent-Related Records
Consent Managers must maintain the prescribed records, including records of consent, notices and the relevant sharing of personal data. These records support transparency and help establish the history of consent-related decisions.
The First Schedule prescribes a minimum retention period of seven years for the specified records, subject to the applicable requirements and any longer period agreed upon or required by law.
Businesses integrating with a Consent Manager should therefore establish clear arrangements for record synchronisation, access, reconciliation and audit trails.
4.4 Providing Access to Consent Records
The framework provides for Data Principals to access their consent records and request the records in machine-readable form in accordance with the prescribed requirements.
This supports individuals’ ability to understand and manage consent-related decisions without depending entirely on the individual interfaces of different organisations.
4.5 Protecting Personal Data
A Consent Manager must comply with prescribed technical and organisational safeguards. The First Schedule includes requirements intended to prevent the contents of personal data from being readable by the Consent Manager itself when the data is made available or shared through the platform.
This is an important design principle. The platform’s ability to facilitate consent should not automatically give it unrestricted access to the underlying personal data.
4.6 Maintaining Independence and Avoiding Conflicts
The Consent Manager framework contains safeguards relating to independence, conflicts of interest and prescribed disclosures.
These requirements are important because the Consent Manager must operate in a manner consistent with the interests of Data Principals. Its commercial relationships should not undermine the individual’s ability to exercise consent freely.
4.7 Complying with Oversight and Audit Requirements
The Board may seek information from a Consent Manager and take action in cases of non-compliance, following the applicable procedure. Rule 4 provides for directions to address non-compliance and, where warranted, suspension or cancellation of registration.
Registration is therefore not simply a one-time approval; the framework contemplates continuing compliance with the applicable obligations.
5. How Will Consent Managers Affect Businesses?
The impact will depend on the organisation’s business model, the nature of its personal data processing and whether it chooses or needs to integrate with a Consent Manager.
5.1 Consent Architecture and Technology Integration
Businesses should evaluate whether their existing consent-management systems can exchange consent instructions and records with an interoperable platform.
This may require changes to application interfaces, consent databases, customer-facing workflows and internal systems.
5.2 Withdrawal Management
Organisations should be able to identify the processing activities affected by a withdrawal and implement the applicable changes in accordance with the Act.
Withdrawal does not necessarily mean that every item of personal data must be immediately deleted in all circumstances. Processing may continue where another applicable legal basis or legal retention requirement permits or requires it.
5.3 Vendor and Contractual Governance
Businesses should review contracts with technology providers and other relevant service providers to clarify responsibilities for consent communication, record accuracy, security, incident escalation and system integration.
Where a Consent Manager is engaged, the contractual arrangement should not be treated as transferring the Data Fiduciary’s statutory accountability.
5.4 Record-Keeping and Audit Readiness
Organisations should maintain reliable evidence of notices, consent instructions, withdrawals and actions taken in response. The ability to reconstruct what happened, when it happened and how the relevant system responded will be important for compliance reviews.
5.5 Customer Trust
An effective consent-management mechanism can help improve transparency and reduce friction for individuals managing their privacy choices across digital services.
However, these benefits depend on implementation quality, accurate records and clear communication—not simply on deploying a new platform.
6. Consent Manager versus a Data Fiduciary: A Critical Distinction
A Consent Manager is not the same as a Data Fiduciary.
The Consent Manager facilitates consent-related interactions through its registered platform. The Data Fiduciary determines the purpose and means of processing personal data and remains responsible for the obligations imposed on it by the Act.
For example, a digital lending platform may determine why and how customer data is processed. A registered Consent Manager may facilitate consent-related interactions involving that platform. The lending platform cannot assume that the engagement automatically discharges its own compliance obligations.
This distinction is central to designing appropriate accountability and contractual arrangements.
7. Practical Readiness Checklist for Businesses
Before the relevant provisions become effective, organisations should consider the following actions:
- Map the personal data collected and the purposes for which it is processed.
- Identify where consent is relied upon as the legal basis for processing.
- Review consent notices, withdrawal procedures and internal records.
- Assess the technical feasibility of integrating with a registered Consent Manager, where relevant.
- Establish procedures for receiving, validating and acting upon consent instructions.
- Review vendor contracts and data-sharing arrangements.
- Define record-retention, access-control and audit-trail requirements.
- Assign responsibility across legal, compliance, technology, product and customer-service teams.
- Monitor the Board’s registration process and any standards or assurance framework published for Consent Managers.
Not every organisation will necessarily need to engage a Consent Manager. The appropriate approach should be determined by the organisation’s processing activities, business model and applicable legal requirements.
8. Commencement and Implementation Timeline
The DPDP Rules, 2025 were notified on 13 November 2025. Under the commencement provision in Rule 1, Rule 4 is scheduled to come into force one year after publication, i.e., on 13 November 2026.
As of today, organisations have a limited period to prepare for the scheduled commencement of the Consent Manager registration framework.
Businesses should verify the latest official notifications and any subsequent amendments or directions before making implementation decisions.
Conclusion
Consent Managers represent an important development in India’s evolving personal data protection framework. By enabling individuals to give, review, manage and withdraw consent through an interoperable platform, they can support greater transparency and control over personal data.
For businesses, the real challenge is not merely to connect with a consent-management platform. It is to ensure that consent-related instructions are reflected accurately in operational systems, supported by reliable records and handled consistently with the law.
Consent management should be treated as an integral part of data governance, not as a standalone technology feature.
Legal references: Digital Personal Data Protection Act, 2023, Sections 2(g) and 6; Digital Personal Data Protection Rules, 2025, Rule 4 and First Schedule.
Disclaimer: This article is intended for general informational purposes and should be read with the official legislation, Rules, commencement notifications and subsequent directions or amendments.
