The Consent Manager framework
In short
A Consent Manager is a person registered with the Data Protection Board who operates an interoperable platform through which a Data Principal can give, manage, review and withdraw consent. Registration is governed by Rule 4 of the DPDP Rules 2025. The conditions for registration are in Part A of the First Schedule and the obligations that follow registration are in Part B.
Rule 4 comes into force one year after publication of the notification of 13 November 2025, which is the earliest point at which the Board can register anyone.
01Conditions for registration
Part A of the First Schedule sets nine conditions. The ones that most often decide whether an applicant is viable are these.
- The applicant is a company incorporated in India.
- Net worth of not less than two crore rupees.
- Sufficient technical, operational and financial capacity to discharge the obligations.
- Sound financial condition and general character of management, and directors, key managerial personnel and senior management of good reputation and record.
- Memorandum and articles requiring adherence to the conflict of interest obligations in items 9 and 10 of Part B, amendable only with the previous approval of the Board.
- Independent certification that the interoperable platform is consistent with the data protection standards and assurance framework the Board publishes, and that appropriate technical and organisational measures are in place.
02Obligations after registration
| Obligation | Detail |
|---|---|
| Data not readable | The manner of making available or sharing personal data must be such that the Consent Manager cannot read the contents |
| Records | Maintain a record of consents given, denied and withdrawn, the notices preceding or accompanying consent requests, and the sharing of personal data with a transferee Data Fiduciary |
| Access and portability | Give the Data Principal access to that record and, on request, make it available in machine readable form |
| Retention | Maintain the record for at least seven years, or longer if agreed or required by law |
| No sub contracting | Obligations under the Act and the Rules may not be sub contracted or assigned |
| Fiduciary capacity | Act in a fiduciary capacity in relation to the Data Principal, and avoid conflicts of interest with Data Fiduciaries |
| Transparency | Publish details of promoters, directors, key managerial personnel, senior management and holders of more than two per cent of shareholding |
| Audit | Maintain effective audit mechanisms and report outcomes to the Board periodically and as directed |
| Change of control | Control may not be transferred by sale, merger or otherwise without the previous approval of the Board |
03Board supervision
Rule 4 gives the Board a graduated set of powers. It may inquire before registering, reject an application with reasons, direct a Consent Manager that is not adhering to its conditions to take corrective measures after an opportunity of being heard, and suspend or cancel registration by a reasoned written order. It may also call for information.
For a Data Fiduciary onboarding onto a Consent Manager platform, the practical point is that consent records held by the Consent Manager are evidence the Data Fiduciary will want to reach during an inquiry. Access to that record, and its format, belongs in the onboarding agreement.
04Common questions
Is using a Consent Manager mandatory?
The Rules provide the framework for Consent Managers and the route by which a Data Principal may give consent through one. A Data Fiduciary's own consent obligations under Sections 5 and 6 apply whether or not a Consent Manager is used.
When can a Consent Manager register?
Rule 4 comes into force one year after publication of the notification of 13 November 2025. Applications are made to the Board with the particulars it publishes on its website.
Can a Consent Manager read the data it routes?
No. Part B of the First Schedule requires the sharing mechanism to be such that the contents are not readable by the Consent Manager.
Ask an AI assistant about this page
Each button opens the assistant with the prompt below already written.
Answers are generated by third party systems and are not published or verified by this site. Check anything load bearing against the gazette text.