Short answer: a consent manager is a company registered with the Data Protection Board that gives people one platform to give, manage, review and withdraw their consent to many businesses. The DPDP Rules on consent managers apply from 13 November 2026. Most businesses do not need to become one — but they should expect customers to manage consent this way and plan how their systems will work with it.
What is a consent manager?
The Digital Personal Data Protection Act, 2023 lets a person (the "Data Principal") give, manage, review or withdraw consent either directly with a business or through a consent manager. Think of it as a consent dashboard that sits between people and the businesses that hold their data. The consent manager is accountable to the individual, not to the businesses, and must act on their behalf.
When does this apply?
| Date | What applies |
|---|---|
| 13 November 2025 | DPDP Rules notified; Data Protection Board provisions in force |
| 13 November 2026 | Registration and obligations of consent managers |
| 13 May 2027 | Most obligations on businesses — notice, consent, security, breach reporting, retention, children's data |
Who can become a consent manager?
The First Schedule to the DPDP Rules, 2025 sets the conditions for registration with the Data Protection Board. In summary, the applicant must:
- be a company incorporated in India;
- have net worth of at least ₹2 crore, and sufficient technical, operational and financial capacity;
- have directors, key managerial personnel and senior management with a reputation for fairness and integrity;
- have its interoperable platform independently certified against the standards the Board publishes.
What must a consent manager do?
- Enable people to give, manage, review and withdraw consent for businesses onboarded on its platform.
- Act in a fiduciary capacity towards the individual.
- Keep records of consents given, denied and withdrawn for at least seven years.
- Not sub-contract or assign its obligations, and avoid conflicts of interest with businesses.
- Not change control — by sale, merger or otherwise — without the Board's prior approval.
- Maintain effective audit mechanisms and report the results to the Board.
What it means for your business
Consent managers are a way for individuals to manage consent; the law does not oblige every business to use one. In practice, though, you should be ready for consent and withdrawals to arrive through a consent manager as well as through your own website or app:
- Know what consent you hold and why. A clear data map and purpose list makes it possible to connect with any consent platform. A consent management framework sets this up.
- Make withdrawal work end to end. When consent is withdrawn — however it arrives — you and your vendors must stop processing for that purpose within a reasonable time.
- Keep good consent records. You must be able to show what notice was given and what the person agreed to.
- Check your notices. Notices must be clear, itemised and available in English or the Eighth Schedule languages your users need — see privacy notice drafting and our free consent notice builder.
Thinking of becoming a consent manager?
Registration requires an Indian company meeting the net-worth and governance conditions, a certified interoperable platform and ongoing audit and reporting. Planning the corporate structure, conflict-of-interest safeguards and record-keeping from the start avoids problems at the application stage. We work on economical, reasonable professional fees and share a transparent quote before starting.
Frequently asked questions
When do the consent manager rules apply?
From 13 November 2026, one year after the DPDP Rules, 2025 were notified.
Do businesses have to use a consent manager?
No. Consent managers are an option for individuals. Businesses should still be able to honour consent and withdrawals that reach them through one.
Who can register as a consent manager?
A company incorporated in India with net worth of at least ₹2 crore, adequate technical, operational and financial capacity, management of good repute, and an independently certified interoperable platform.
How long must a consent manager keep records?
At least seven years, or longer if agreed with the individual or required by law.
Can Vakil Help Desk help us prepare?
Yes — we set up consent frameworks for businesses and advise companies planning to register as consent managers. We work on economical, reasonable professional fees and share a transparent quote before starting.
