Consent Manager under the DPDP Act: what it is and what it must do
The registered entity that manages consent on behalf of Data Principals: the Act’s definition, the Rule 4 registration conditions and duties, and why a consent management platform is something different.
Last updated 22 October 2026
What is a Consent Manager under the DPDP Act?
A Consent Manager is a company registered with the Data Protection Board that acts for Data Principals as a single point of contact to give, manage, review and withdraw consent through an interoperable platform. It is accountable to the individual, not the business. Rule 4, on registration and duties, comes into force on 13 November 2026.
How does the DPDP Act define a Consent Manager?
Section 2(g) of the DPDP Act, 2023 defines a Consent Manager as a person registered with the Board who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform. Three sub-sections of section 6 then set the frame:
- s. 6(7): a Data Principal may give, manage, review or withdraw her consent to a Data Fiduciary through a Consent Manager.
- s. 6(8): the Consent Manager is accountable to the Data Principal and acts on her behalf, under obligations set by the Rules.
- s. 6(9): every Consent Manager must be registered with the Board under technical, operational, financial and other conditions set by the Rules.
Consent Managers must also offer grievance redressal and respond to grievances (s. 13(1) and (2)), and must publish how Data Principals can exercise their rights and a grievance response period not exceeding ninety days (Rule 14(1) and (3)). The Board can inquire into complaints against a Consent Manager and breaches of its registration conditions, and impose penalties (s. 27(1)(c) and (d)).
When do the Consent Manager provisions apply?
| From | Provision | Source |
|---|---|---|
| 13 November 2025 | Definition of Consent Manager (s. 2(g)) | G.S.R. 843(E) |
| 13 November 2026 | Registration with the Board (s. 6(9)) and the Board’s power to inquire into breach of registration conditions (s. 27(1)(d)) | G.S.R. 843(E) |
| 13 November 2026 | Rule 4 and the First Schedule: registration conditions and obligations | DPDP Rules, Rule 1(3) |
| 13 May 2027 | Using a Consent Manager and its accountability (s. 6(7) and (8)), grievances (s. 13), complaints against Consent Managers (s. 27(1)(c)), Rule 14 | G.S.R. 843(E) |
What does it take to register as a Consent Manager?
Under Rule 4(1) and (2), an applicant meeting the Part A conditions applies to the Board with the particulars and documents the Board publishes on its website. The Board may inquire and then either registers the applicant and publishes its particulars on its website, or rejects the application with reasons. The PIB release on the Rules sums it up: Consent Managers must be Indian companies.
| Part A condition | What it requires |
|---|---|
| 1. Indian company | The applicant is a company incorporated in India |
| 2. Capacity | Sufficient technical, operational and financial capacity to fulfil its obligations |
| 3. Soundness | Sound financial condition and general character of management |
| 4. Net worth | Not less than ₹2 crore |
| 5. Business viability | Adequate likely volume of business, capital structure and earning prospects |
| 6. People | Directors, key managerial personnel and senior management with a general reputation and record of fairness and integrity |
| 7. Constitution | Memorandum and articles require the conflict-of-interest obligations (Part B items 9 and 10), changeable only with the Board’s prior approval |
| 8. Purpose | Proposed operations are in the interests of Data Principals |
| 9. Independent certification | The interoperable platform is certified consistent with the data protection standards and assurance framework the Board publishes, with measures in place to follow them |
The Board can direct a Consent Manager to fix non-adherence, suspend or cancel its registration, and call for information (Rule 4(4) to (6)).
What must a registered Consent Manager do?
Part B of the First Schedule lists thirteen obligations. In short:
| Item | Obligation |
|---|---|
| 1 | Let a Data Principal give consent to an onboarded Data Fiduciary, directly or routed through another onboarded fiduciary that holds her data |
| 2 | Make data available or share it in a way that the Consent Manager itself cannot read the contents |
| 3 | Keep a record of consents given, denied or withdrawn, the notices that preceded them, and sharing with a transferee fiduciary |
| 4 | Give the Data Principal access to that record, provide it in machine-readable form on request, and keep it for at least seven years |
| 5 | Run a website or app, or both, as the primary means of access |
| 6 | Not sub-contract or assign any of its obligations |
| 7 | Take reasonable security safeguards to prevent personal data breach |
| 8 | Act in a fiduciary capacity towards the Data Principal |
| 9–10 | Avoid conflicts of interest with Data Fiduciaries, including through directors’ and managers’ holdings or relationships |
| 11 | Publish its promoters, directors and senior management, shareholders above 2%, and related bodies corporate |
| 12 | Run effective audits and report outcomes to the Board periodically and when directed |
| 13 | No transfer of control by sale, merger or otherwise without the Board’s prior approval |
The Schedule’s own illustration involves a bank customer using a Consent Manager platform to consent to one bank receiving her account statement, either from her digital locker or by instructing her own bank to send it.
How is a Consent Manager different from a consent management platform?
The two are often confused because both deal with consent. They sit on opposite sides of the relationship:
| Aspect | DPDP Consent Manager | Consent management platform (CMP) |
|---|---|---|
| What it is | A company registered with the Data Protection Board (s. 2(g), s. 6(9)) | Software a business buys or builds |
| Who it acts for | The Data Principal, in a fiduciary capacity (s. 6(8); Part B item 8) | The business that deploys it |
| Registration | Required, with Part A conditions including ₹2 crore net worth | None under the DPDP Act |
| Where it works | Across every Data Fiduciary onboarded onto its platform | On the deploying business’s own website or app |
| Reads the data? | Must not be able to read the personal data it routes (Part B item 2) | Usually stores consent records, not the underlying data |
| Record keeping | At least seven years, accessible to the Data Principal (Part B item 4) | As the business configures it |
| Accountable to the Board | Yes, directly; registration can be suspended or cancelled (Rule 4(5)) | No; the Data Fiduciary using it remains responsible (s. 8(1)) |
A business can use a CMP to meet its own duties (notice, consent records and easy withdrawal under sections 5 and 6) and also accept consent arriving through a Consent Manager. The CMP does not make the business a Consent Manager, and does not shift any of its duties.
Where does the Perimattic DPDP Compliance Suite fit?
The Perimattic DPDP Compliance Suite is planned as software for Data Fiduciaries, closer to a consent management platform than to a Consent Manager. Perimattic is not a Consent Manager and is not registered with the Board. Relevant planned features:
- Consent capture and records, including withdrawal as easy as giving consent.
- A notice builder for DPDP notices with the Rule 3 items, in English and Eighth Schedule languages.
- Data Principal rights requests and grievances with response-time tracking.
- Verifiable parental consent workflow for children’s data under Rule 10.
Status: The Perimattic DPDP Compliance Suite is in development; none of this is available to use yet. It is not certified or approved by any government body, and using it will not by itself make a business compliant. Sign up to follow the build.
General guidance, not legal advice. Checked against the DPDP Act, 2023 and DPDP Rules, 2025 on 22 October 2026.
More on DPDP consent
Consent Managers, answered
Does my business need to use a Consent Manager?
The Act does not require it. Section 6(7) says a Data Principal may give, manage, review or withdraw consent through a Consent Manager, so it is the individual’s option. A Data Fiduciary still has to give notice, collect valid consent and make withdrawal easy itself, and should be ready to work with Consent Managers its users choose.
Is a cookie banner or consent management platform a Consent Manager?
No. A consent management platform is software a business uses to collect and record consent on its own website or app. A Consent Manager under the DPDP Act is a company registered with the Data Protection Board that acts for Data Principals, in a fiduciary capacity, across many businesses. Software alone cannot be a Consent Manager.
Is Perimattic a Consent Manager?
No. Perimattic is not registered with the Data Protection Board as a Consent Manager. The planned Perimattic DPDP Compliance Suite is software for Data Fiduciaries to manage their own notices, consents and records. It is in development and not yet available.
Want DPDP compliance built around how your business handles data?
Sign up to tell us what personal data you handle, follow the build and be first to try the DPDP Compliance Suite when it opens.
Sign up