A consent manager is a company registered with the Data Protection Board that gives people one platform to give, manage, review and withdraw consent (section 2(g)). Rule 4 and the First Schedule, which set conditions such as a ₹2 crore net worth, apply from 13 November 2026. No consent manager is registered yet, no application portal has been reported, and no Board members have been appointed.
Key takeaways
- Rule 4, section 6(9) and section 27(1)(d) came into force on 13 November 2026.
- Applicants must be companies incorporated in India with a net worth of at least ₹2 crore and an independently certified, interoperable platform.
- A consent manager acts for the individual, cannot read the data it helps share, and keeps consent records for at least seven years.
- A consent manager is not the same as a consent management platform: one is a registered intermediary for people, the other is software a company runs.
- Fiduciaries still need their own consent ledger. Design it so a consent manager can plug in later.
Today, 13 November 2026, Rule 4 of the DPDP Rules came into force. It sets out how a company can register with the Data Protection Board as a consent manager, and the conditions and obligations it must meet. Section 6(9) of the Act, which requires every consent manager to be registered, and section 27(1)(d), which lets the Board inquire into breaches of registration conditions, started on the same day.
The law is live, but the machinery is not. The Board has been established, yet no Chairperson or Members had been appointed as of early November 2026, and no application portal has been reported. This guide explains what a consent manager is, who can become one, what it must do, how it differs from the consent software most companies buy, and what to do while the Board gets going.
What is a consent manager under the DPDP Act?
Section 2(g) defines a Consent Manager as a person registered with the Board who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform. Section 6(7) lets a Data Principal deal with a fiduciary through a consent manager, and section 6(8) makes the consent manager accountable to her and requires it to act on her behalf.
The idea is a dashboard for the individual. Instead of hunting through settings in dozens of apps, a person can see and change her consents in one place, and route consent to share data from one organisation to another.
The First Schedule includes an illustration of exactly this: a person uses a consent manager to give one bank consent to access her bank statement, either directly from her digital locker or by instructing the bank that holds her account to send it.
What changed on 13 November 2026?
| Provision | What it does | Status |
|---|---|---|
| Section 6(9) | Every consent manager must be registered with the Board, subject to prescribed conditions | In force from 13 Nov 2026 |
| Section 27(1)(d) | Board's power to inquire into a breach of a consent manager's registration conditions (penalties under section 33 start on 13 May 2027) | In force from 13 Nov 2026 |
| Rule 4 and First Schedule | Registration process, conditions (Part A) and obligations (Part B) | In force from 13 Nov 2026 |
| Section 6(7) and 6(8) | People may use a consent manager; it is accountable to them | From 13 May 2027 |
| Rule 14 | Fiduciaries and consent managers publish how to exercise rights and a grievance period of up to 90 days | From 13 May 2027 |
In practice, registration depends on the Board. Rule 4(1) says applicants furnish the particulars the Board publishes on its website, and the platform must be certified against standards the Board publishes. MeitY invited applications for one Chairperson and four Members on 6 May 2026. In October 2026 the Centre told the Kerala High Court that the Board was "constituted but not made functional", and the court expected it to be functional within about eight weeks. Until members are in place, expect no registrations.
Who can register as a consent manager?
Part A of the First Schedule sets the conditions for registration. The Board inquires into them before deciding (Rule 4(2)).
| Condition | What it means in practice |
|---|---|
| Company incorporated in India | Foreign entities need an Indian company to apply |
| Net worth of at least ₹2 crore | Assets less liabilities in the books of account |
| Technical, operational and financial capacity | Ability to run the platform and meet the obligations |
| Sound finances and management | Plus adequate business volume, capital structure and earning prospects |
| Directors and senior management of fair reputation | A record of fairness and integrity |
| Constitutional documents | Memorandum and articles must require the conflict-of-interest obligations, changeable only with Board approval |
| Operations in the interests of Data Principals | The business model must serve the individual |
| Independent certification | The interoperable platform and its controls certified against the Board's standards and framework |
What must a registered consent manager do?
Part B of the First Schedule lists the obligations. The Board can direct a consent manager to fix non-adherence and, after a hearing, suspend or cancel its registration (Rule 4(4) and 4(5)).
| Obligation | Detail |
|---|---|
| Enable consent | Let a person give consent to an onboarded fiduciary, directly or through another onboarded fiduciary that holds her data |
| Data not readable | Personal data made available or shared through it must not be readable by it |
| Keep records | Consents given, denied or withdrawn; the notices with each request; sharing with a transferee fiduciary |
| Give access to records | Access for the person, in machine-readable form on request, kept at least seven years |
| Primary channel | A website or app, or both, as the main way people use the service |
| No sub-contracting | Cannot sub-contract or assign its obligations |
| Security | Reasonable security safeguards to prevent a personal data breach |
| Fiduciary capacity | Act in a fiduciary capacity towards the person |
| Conflicts of interest | Avoid conflicts with fiduciaries, including through directors' and managers' interests |
| Ownership transparency | Publish promoters, directors, key managers and shareholders above 2% |
| Audits | Audit controls, registration conditions and compliance, and report to the Board |
| Change of control | No transfer of control without the Board's prior approval |
Consent manager vs consent management platform
The two are often confused, and vendors sometimes blur them. They serve different parties and carry different legal weight.
Consent manager
- Registered with the Data Protection Board
- A company incorporated in India
- Acts for the individual, in a fiduciary capacity
- Works across many organisations, interoperably
- Cannot read the data it helps share
- Chosen by the person, not by the business
Consent management platform (CMP)
- Software a business buys or builds
- No registration needed
- Acts for the business that runs it
- Shows notices and captures consent on its own site or app
- Stores the proof needed under section 6(10)
- Configured by the business for its purposes
Every fiduciary that relies on consent needs CMP-like capability: itemised notices, per-purpose consent, easy withdrawal and a ledger. The consent and legitimate uses guide covers that. A consent manager is an extra channel through which some people will reach you, not a replacement for your own records.
Itemised data, purpose, rights, how to complain
Clear affirmative action, per purpose
Only for that purpose, only what's needed
As easy as giving it
Fiduciary and processors cease
Unless law requires retention
How do fiduciaries integrate with a consent manager?
The technical standards will come from the Board, so build to principles now and adapt later. The integration points are predictable:
- Onboarding. A fiduciary is onboarded onto a consent manager's platform before people can use it to deal with that fiduciary.
- Notice with every request. The consent manager keeps the notice that accompanied each request, so your request must carry a Rule 3-compliant notice: itemised data and specific purposes.
- Consent and withdrawal signals. Consents and withdrawals arriving through the consent manager must update your own ledger, and a withdrawal must stop processing within a reasonable time, at your processors too (section 6(6)).
- Data sharing on instruction. If you hold data a person wants shared with another fiduciary, you may receive an instruction through the consent manager to send it directly.
- Evidence. Section 6(10) still puts the burden of proving notice and consent on you. Keep your own record, linked to the consent manager's reference.
- Rights and grievances. Rule 14 applies to both you and the consent manager for rights requests and grievances, so agree how requests that arrive through it reach your team.
Design for purpose IDs and notice versions
If your ledger already stores a stable purpose ID, the notice version and the channel for each consent event, adding a consent manager is a new channel, not a rebuild.
What to do now
If you are a Data Fiduciary
- Build your own consent ledger and withdrawal flow for 13 May 2027, as the compliance checklist sets out.
- Give every purpose a stable ID and version every notice, so an external channel can plug in.
- Watch the Board's website for registered consent managers and published standards.
- Map where your sector may use consent managers first, such as data sharing between financial institutions (see DPDP for fintech), and plan for it.
If you plan to become a consent manager
- Check each Part A condition: Indian company, ₹2 crore net worth, capacity, management record.
- Amend the memorandum and articles to carry the conflict-of-interest obligations.
- Design the platform so data is never readable by you, and records are kept for seven years and exportable.
- Prepare for independent certification once the Board publishes its standards.
- Assemble the ownership disclosures and audit mechanism Part B requires.
We help fiduciaries build consent ledgers that are ready for consent manager integration, and help applicants prepare platforms and evidence. Book a scoping call to discuss your position.
Frequently asked questions
What is a consent manager under the DPDP Act?
Section 2(g) defines a Consent Manager as a person registered with the Board who acts as a single point of contact for a Data Principal to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform. It is accountable to the individual and acts on her behalf.
How do you register as a consent manager in India?
Under Rule 4, a company that meets the conditions in Part A of the First Schedule applies to the Data Protection Board with the particulars the Board publishes on its website. The Board inquires and either registers the applicant and publishes its details, or rejects the application with reasons. As of 13 November 2026, no application portal has been reported and Board members have not been appointed.
What is the net worth requirement for a consent manager?
At least ₹2 crore. The applicant must also be a company incorporated in India, have sufficient technical, operational and financial capacity, have directors and senior management with a record of fairness and integrity, and have its platform independently certified against the Board's standards.
What is the difference between a consent manager and a consent management platform?
A consent manager is a registered intermediary that acts for the individual across many companies. A consent management platform is software a company uses to show notices and record consent on its own website or app. Most companies will need a consent management capability; few will become consent managers.
Do businesses have to use a consent manager?
The Act gives Data Principals the option to give, manage, review or withdraw consent through a consent manager (section 6(7)), from 13 May 2027. It does not require every business to become one. How fiduciaries connect to registered consent managers will become clearer once the Board registers them and publishes its standards.
Can a consent manager see my personal data?
Not the data it helps share. The First Schedule requires a consent manager to make sure that personal data made available or shared through it is not readable by it. It keeps records of consents, notices and sharing, not the contents of the data.
Turn this guide into a working programme
A 30-minute scoping call maps your gaps against the Rules and the order to close them. You get a fixed-fee proposal within three working days.
Related guides
This guide explains the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 as notified on 13 November 2025. It is general information, not legal advice. Check the official text, and your counsel, before relying on it.