From 13 November 2026 the Data Protection Board can register Consent Managers. The name invites confusion with consent software. They are different things, with different owners, different duties and a different legal basis. This guide sets out which is which, and what each means for a Data Fiduciary.
Last reviewed · Sources: G.S.R. 843(E), G.S.R. 846(E), Lok Sabha Q.3960 (12 Aug 2026)
No. A Consent Manager is a Board-registered intermediary that works for the Data Principal. A consent management platform is software a Data Fiduciary runs to collect, record and evidence its own consents. A Data Fiduciary does not need to become, or appoint, a Consent Manager to comply with the Act.
A Consent Manager is a company registered with the Data Protection Board that acts as a single point of contact through which a Data Principal can give, manage, review and withdraw her consent, on an accessible, transparent and interoperable platform (section 2(g)). It is accountable to the Data Principal and acts on her behalf (section 6(8)).
The Act gives the Consent Manager three anchors. Section 6(7) lets a Data Principal give, manage, review or withdraw consent through one. Section 6(8) makes it accountable to the Data Principal. Section 6(9) requires it to be registered with the Board on technical, operational and financial conditions, which Rule 4 and the First Schedule now set. A Consent Manager also owes a grievance mechanism of its own under section 13, and the Board can inquire into a Consent Manager's breach under section 27.
In practice the model resembles India's account aggregator framework: a neutral platform the individual uses to route consent to many organisations, without reading the data that passes through it.
| Consent Manager | Consent management platform (CMP) | |
|---|---|---|
| Works for | The Data Principal (Sec 6(8)) | The Data Fiduciary that runs it |
| Legal status | Board-registered intermediary (Sec 6(9), Rule 4) | Software; a Data Processor where it handles personal data for the Data Fiduciary |
| Who can be one | Indian company, net worth ≥ ₹2 crore, independently certified platform | Any vendor, or an in-house build |
| Scope | One person's consents across many Data Fiduciaries | One Data Fiduciary's consents across its own channels |
| Can read the data | No (First Schedule, Part B item 2) | Yes, as instructed under a valid contract (Sec 8(2)) |
| Required by the Act | No; the Data Principal may choose to use one (Sec 6(7)) | No; but the Data Fiduciary must prove notice and consent (Sec 6(10)) |
| In force from | 13 November 2026 | Duties it supports apply from 13 May 2027 |
No. Section 6(7) says a Data Principal may give, manage, review or withdraw consent through a Consent Manager. It is an option for the Data Principal, not a duty on the Data Fiduciary. Every Data Fiduciary that relies on consent must still give notice and be able to prove consent under section 6(10). A consent management platform is one way to carry that burden of proof: it records which notice a person saw, in which language, for which purposes, and when they withdrew. TruPriv is software of that kind. It is not, and is not seeking to be, a registered Consent Manager.
An applicant applies to the Board under Rule 4(1) with the particulars the Board publishes on its website. The Board may inquire, then register the applicant and publish its details, or reject the application with reasons (Rule 4(2)). The conditions in Part A are:
The Board can direct a Consent Manager to correct non-adherence, and suspend or cancel its registration after a hearing (Rule 4(4)–(5)).
| Part B | Obligation |
|---|---|
| Item 1 | Let the Data Principal give consent to an onboarded Data Fiduciary, directly or routed through another onboarded Data Fiduciary. |
| Item 2 | Share personal data in a way that keeps its contents unreadable to the Consent Manager itself. |
| Items 3–4 | Keep a record of consents given, denied or withdrawn, the notices behind them, and data shared, for at least seven years, and give the Data Principal access to it in machine-readable form. |
| Item 6 | Not sub-contract or assign any of its obligations. |
| Item 8 | Act in a fiduciary capacity towards the Data Principal. |
| Items 9–11 | Avoid conflicts of interest with Data Fiduciaries and publish its promoters, directors and shareholders above 2%. |
| Item 13 | Not transfer control of the company without the Board's prior approval. |
Nothing changes on 13 November 2026 for a business that is not applying to be a Consent Manager. Its own duties start on 13 May 2027. Three things are worth doing now:
A Consent Manager is a company registered with the Data Protection Board that acts as a single point of contact through which a Data Principal can give, manage, review and withdraw her consent, on an accessible, transparent and interoperable platform (section 2(g)). It is accountable to the Data Principal and acts on her behalf (section 6(8)).
No. A Consent Manager is a Board-registered intermediary that works for the Data Principal. A consent management platform is software a Data Fiduciary runs to collect, record and evidence its own consents. A Data Fiduciary does not need to become, or appoint, a Consent Manager to comply with the Act.
No. Section 6(7) says a Data Principal may give, manage, review or withdraw consent through a Consent Manager. It is an option for the Data Principal, not a duty on the Data Fiduciary. Every Data Fiduciary that relies on consent must still give notice and be able to prove consent under section 6(10).
Under Part A of the First Schedule to the DPDP Rules, 2025, the applicant must be a company incorporated in India with a net worth of at least ₹2 crore, sound finances and management, directors of integrity, conflict-of-interest safeguards in its articles, and an independently certified interoperable platform. Registration under Rule 4 opens on 13 November 2026.
On 13 November 2026. Rule 4 of the DPDP Rules, 2025 commences one year after the Rules were published on 13 November 2025, and section 6(9) of the Act, which requires every Consent Manager to be registered with the Board, commences the same day under G.S.R. 843(E).
This guide summarises the DPDP Act, 2023 and the DPDP Rules, 2025; the Gazette texts govern. This is informational and is not legal advice. Liability under the DPDP Act, 2023 remains with the Data Fiduciary.
