Consent Manager
A registered entity that gives a Data Principal one place to give, manage, review and withdraw consent.
A Consent Manager is a registered organisation that lets a person give, review and withdraw consent for many companies from a single place. It works for the individual, not for the businesses.
Meaning of Consent Manager
A Consent Manager is registered with the Data Protection Board and must be accessible, transparent and interoperable. It acts for the Data Principal, and is accountable to them. A Consent Manager is different from a company's own consent tool, which only manages that company's own consents.
Section 2(g) of the DPDP Act defines a Consent Manager as a person registered with the Board who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform. Section 6(7) confirms that a Data Principal may use such a manager, Section 6(8) says the Consent Manager is accountable to the Data Principal and acts on her behalf, and Section 6(9) requires registration with the Board.
Registration is governed by Rule 4 and the First Schedule. An applicant must meet conditions in Part A, which include being a company incorporated in India with a net worth of at least ₹2 crore, sound financial condition and management, directors and key personnel of good reputation and an independently certified, interoperable platform. Part B sets continuing obligations, such as acting as a fiduciary toward the Data Principal and keeping consent records for at least seven years. The Board can suspend or cancel registration after a hearing.
The timeline matters. The provisions on Consent Manager registration come into force one year after publication of the Rules, which is 13 November 2026. The wider Chapter II duties for fiduciaries apply from 13 May 2027. This stagger lets Consent Managers register and build integrations before fiduciaries must honour them.
A Consent Manager is not a consent management platform, which is software a business buys to run its own banners and records. A Consent Manager is a regulated intermediary that sits between individuals and many fiduciaries. Its role is to handle consent, not to build its own business on the personal data behind it. Account Aggregators regulated by RBI are a similar idea in the financial sector, but they are governed by separate rules, and the two should not be confused.
Examples of Consent Manager
Instead of reviewing consent separately in ten apps, a person uses one registered Consent Manager to see and withdraw all of them.
A customer uses a registered Consent Manager to see that her bank, an insurer and a lending app each hold consent. She withdraws consent for the lender with one action. The lender receives the signal and stops the relevant processing within a reasonable time.
A technology company plans to apply for registration. It confirms net worth above ₹2 crore, hires an independent assessor to certify its platform and drafts a policy that bars it from selling or [profiling](term/profiling) consent data.
A marketplace updates its consent database to match consent purposes with codes. When a withdrawal arrives through a Consent Manager, the system pauses marketing messages and informs its email vendor to stop sending.
Why Consent Manager matters
If the model works, a person will see every consent she has given on one dashboard and withdraw it with one action, which Section 6(4) already says must be as easy as giving it. That raises the standard for every business, since its consent flows must read and honour signals from registered Consent Managers.
For firms that want to become Consent Managers, the stakes are high. They carry a fiduciary-style duty to the individual, face inquiry by the Board under Section 27(1)(c) and (d) for breaches, and can lose registration. For ordinary fiduciaries, the risk is operational: failing to honour withdrawals relayed via a manager is a consent breach and could attract a penalty under the Schedule, which for general breaches goes up to ₹50 crore.
How it works in practice
- 1Businesses should decide whether to integrate with Consent Managers once they are registered, and design their consent store so that it can accept a signal, record it and act on it quickly.
- 2Map each consent purpose to a machine-readable code so that a Consent Manager can present it accurately to the individual and relay changes without ambiguity.
- 3Build an endpoint or process to receive withdrawals and stop the affected processing, including instructing processors under Section 6(6).
- 4Applicants for registration should prepare the net-worth evidence, independent certification of the platform, governance policies, conflict-of-interest rules, seven-year retention architecture and a plan for handling Board information requests.
- 5Individuals should check that any consent app they use is on the Board's published list of registered Consent Managers.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Calling any cookie banner software a Consent Manager. Only a person registered with the Board qualifies under the Act.
Assuming using a Consent Manager removes the fiduciary's duty to give notice and prove consent. Section 6(10) still puts the burden of proof on the fiduciary.
Treating the Consent Manager as the fiduciary's agent. It is accountable to the Data Principal and acts for her.
Ignoring the dates. Registration opens from 13 November 2026, but integration with fiduciaries must be ready before 13 May 2027.
Compliance tips
Keep consent records in a structured, queryable format with purpose, time, version of the notice and channel, so they can be exchanged with a manager.
Test withdrawal end to end, including processors, before relying on any external signal.
Track the Board's register of Consent Managers when it is published and avoid advertising any status that is not confirmed there.
If you plan to apply, read the First Schedule carefully with your auditor and company secretary before investing in the platform.
Common questions about Consent Manager
What is a Consent Manager under the DPDP Act?
A person registered with the Data Protection Board that provides an accessible, transparent and interoperable platform where a Data Principal can give, manage, review and withdraw consent. It is accountable to the individual and acts on her behalf.
Is a Consent Manager the same as a consent management platform?
No. A consent management platform is software a business uses for its own consent records. A Consent Manager is a registered legal entity with duties to the individual, and it works across many fiduciaries.
Who can register as a Consent Manager?
An Indian-incorporated company that meets the First Schedule conditions, including a minimum net worth of ₹2 crore, sound management and an independently certified platform. The Board decides on the application and may reject it with reasons.
When can Consent Managers start registering?
Rule 4 comes into force one year after the Rules were published, which is 13 November 2026. The wider consent obligations on fiduciaries apply from 13 May 2027, giving time for integration.