The introduction of Consent Managers in India’s Digital Personal Data Protection framework gives people a chance to take more control over their personal data.
It also brings a new question for businesses about compliance:
What happens when a Consent Manager does not do what it is supposed to do?
Imagine a case where a customer pulls back consent using a Consent Manager. The platform notes the request. Does not tell the relevant Data Fiduciary.
The business keeps using the customers data.
Who is responsible?
Is it the Consent Manager since it did not share the withdrawal? Is it the Data Fiduciary because it kept processing?. Can both the Consent Manager and the Data Fiduciary face penalties from regulators?
Answering this question needs a view of the legal duties that each participant must follow.
- A Consent Manager is not a technology vendor
Section 2(g) of the DPDP Act 2023 says that a Consent Manager is a registered entity that offers one simple point of contact so that people can give, manage, review and withdraw consent.
This difference is important.
A Consent Manager is not a software provider that shows consent preferences.
The law gives the Consent Manager duties toward the Data Principal.
Section 6(8) adds that a Consent Manager must answer to the Data Principal and act on the Data Principal’s behalf in the required way.
Therefore the Rules set obligations for the Consent Manager.
- What if the Consent Manager fails?
Look at three situations.
Situation 1: Not sharing a withdrawal
A person pulls back consent using the Consent Manager.. The platform does not send the instruction to the Data Fiduciary.
The Consent Manager may have failed to do its duties about managing consent and keeping records.
The Data Fiduciary must also check if it has gotten a withdrawal notice from another source and if its own systems have met the required duties.
Situation 2: Wrong consent records
A person says no consent yet the Consent Manager’s platform mistakenly records the decision as approval.
This creates doubts about how accurate and honest the consent recordsre
Such a mistake can weaken the person’s power to control their data.
Situation 3: Unauthorised access to data
A Consent Manager’s platform has a security problem that leaks information about people.
This brings up worries about the Consent Manager’s duty to put in security measures and protect the data it handles.
The outcome will depend on what kind of incident it was, which duties were broken and the relevant laws.
- Can the Data Fiduciary avoid responsibility by blaming the Consent Manager?
No just because the Data Fiduciary hired or linked a Consent Manager does not help.
The Data Fiduciary is the entity that decides why and how personal data is processed.
The Data Fiduciary’s legal duties are different from the Consent Manager’s duties.
Section 8 of the DPDP Act says the Data Fiduciary has duties about processing, security, compliance and accountability.
Section 6(6) also says the Data Fiduciary must stop consent‑based processing and make its Data Processors stop it within a time, after a withdrawal unless the law says otherwise.
Thus a business cannot simply defend itself by saying the external Consent Manager did not share the withdrawal.
The business must look at its systems, records, messages and compliance setup.
- Can the Consent Manager itself be punished by regulators?
Yes.
Rule 4 clearly gives regulators the power to supervise registered Consent Managers.
Rule 4(4) says that if the Board thinks a Consent Manager is not following the required rules it can after giving the Consent Manager a chance to speak tell the Consent Manager it is not compliant and tell it to fix the problem.
Rule 4(5) adds more.
If the Board thinks it is needed to protect the interests of Data Principals it can after giving the Consent Manager a chance to speak and writing down the reasons:
- Suspend the registration.
- Cancel the registration.
- Issue directions to safeguard the interests of Data Principals.
The Board may also ask the Consent Manager to give information under Rule 4(6).
Therefore registration should not be seen as a one‑time OK that lets an entity run without regulator watch.
- What if both the Consent Manager and the Data Fiduciary are responsible?
This is probably the important compliance point.
Imagine the Consent Manager gets the withdrawal request. The Data Fiduciary does not update its internal systems.
The Data Fiduciary may have failed to fulfil Data Fiduciarys processing responsibilities.
Let us consider the situation: the Consent Manager records a withdrawal request but never communicates it through the required platform mechanism.
The Consent Manager may have failed to perform Consent Managers obligations.
A third possibility is that both Data Fiduciary and Consent Manager have systems resulting in an unresolved withdrawal.
The legal responsibility of each Data Fiduciary and Consent Manager must be examined independently based on the facts and the particular statutory or regulatory obligation involved.
There is no rule that every failure by one Data Fiduciary or Consent Manager makes the other entity liable for the same failure.
- Can contractual arrangements protect businesses?
Contracts are important. They cannot override statutory responsibilities.
A Data Fiduciary should have contractual arrangements with the Consent Manager covering:
- Technical integration and communication protocols.
- Security safeguards.
- Record maintenance.
- Incident reporting.
- Service availability.
- Audit cooperation.
- Error reporting and correction.
- Responsibility for operational failures.
- Business continuity and exit arrangements.
These arrangements can help determine responsibility and provide a mechanism for resolving disputes between the parties.
However a contractual indemnity cannot remove an obligation imposed directly on a Data Fiduciary or Consent Manager.
Similarly a Consent Manager cannot contract out of Consent Managers responsibilities.
- What should businesses do to reduce compliance risk?
Businesses should not wait for a withdrawal failure or security incident before establishing accountability. I see that this is crucial.
A practical approach should include:
- First conduct diligence. Verify the Consent Managers registration, financial capacity, technical capability and regulatory disclosures.
- Second establish responsibilities. Identify who receives consent requests, who communicates decisions and who implements them.
- Third maintain records. Businesses should retain their reliable records rather than depending exclusively on the Consent Managers dashboard.
- Fourth test the integration. Conduct testing of consent, denial, withdrawal and failure scenarios.
- Fifth establish escalation procedures. Every failed transaction should have an owner and a documented resolution process.
- Sixth conduct audits. Review whether the Consent Manager and the business are fulfilling their obligations.
- An important distinction concerning penalties
Section 33 of the DPDP Act provides for penalties for breaches of its provisions. However its commencement is part of the eighteen-month implementation phase.
Accordingly it would be legally inaccurate to suggest that the entire statutory penalty framework is already operative merely because Rule 4 has commenced.
Rule 4 nevertheless provides its regulatory mechanisms, including corrective directions and suspension or cancellation of registration.
Businesses and Consent Managers should distinguish between these consequences and the monetary penalty provisions that become applicable under the relevant commencement notification.
Conclusion
The introduction of Consent Managers does not reduce the compliance responsibility of businesses. Instead Consent Managers creates a relationship that must be governed carefully. I find that this is a point.
A Consent Manager must perform Consent Managers obligations while the Data Fiduciary must remain accountable for the processing activities for which Data Fiduciary determines the purpose and means.
The two entities may work together. Their legal responsibilities are not interchangeable. I think this shows that the two entities cannot swap responsibilities.
The important lesson, for businesses is that outsourcing consent management does not mean outsourcing accountability. I believe this is the important lesson.
A reliable consent-management ecosystem will require responsibilities, accurate records, effective technical integration and independent oversight.
