India’s DPDP framework is entering a new phase on 13 November 2026. With Rule 4 of the Digital Personal Data Protection Rules, 2025 coming into force, the role of Consent Managers will move from regulatory design to a formal registration and compliance framework. But what exactly can a Consent Manager do, and what legal responsibilities will come with that role?
India’s Digital Personal Data Protection (DPDP) framework is gradually taking shape. Among its most interesting features is the introduction of the concept of a Consent Manager.
While much of the public discussion around the DPDP Act focuses on Data Fiduciaries, consent notices, data breaches and penalties, the role of Consent Managers deserves equal attention.
Rule 4 of the Digital Personal Data Protection Rules, 2025, which comes into force on 13 November 2026, provides the regulatory framework for their registration and obligations.
But a Consent Manager is not simply another technology company offering a privacy dashboard. It is intended to function as an independent intermediary that enables individuals to exercise meaningful control over their personal data.
Let’s understand what this means in practice.
1. Who is a Consent Manager?
Section 2(g) of the DPDP Act defines a Consent Manager as a person registered with the Data Protection Board of India, who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform.
In simple terms, imagine an individual who has shared personal information with several organisations, including banks, insurance companies, healthcare platforms and online service providers.
Managing consent separately with every organisation can become complicated.
A Consent Manager seeks to simplify this process by providing a common platform through which individuals can manage their consent-related decisions.
The important distinction is that the Consent Manager acts for the benefit of the Data Principal, rather than functioning as an agent of the organisation seeking personal data.
2. What can a Consent Manager legally do from 13 November?
The First Schedule, Part B, of the DPDP Rules specifies the obligations and functions of a Consent Manager.
Its principal functions include:
A. Enable individuals to give consent
A Consent Manager can enable a Data Principal to give consent to a Data Fiduciary onboarded onto its platform.
This can happen directly or through another Data Fiduciary that already maintains the relevant personal data with the individual’s consent.
For example, suppose an individual wants to share a bank statement with a financial institution for a loan application.
The individual may use a Consent Manager’s platform to authorise the sharing of the bank statement, either directly or through the bank that maintains the account.
B. Enable management, review and withdrawal of consent
The platform should allow individuals to manage their consent decisions rather than treating consent as a one-time transaction.
This includes the ability to review previous decisions and withdraw consent.
Consequently, the Consent Manager can become an important mechanism for making consent management more accessible and convenient.
C. Maintain records of consent-related activities
A Consent Manager must maintain records of:
- Consent given, denied or withdrawn by the individual.
- Notices preceding or accompanying requests for consent.
- Sharing of personal data with a transferee Data Fiduciary.
These records must remain accessible to the Data Principal.
On request, the Consent Manager must also make the information available in machine-readable form, in accordance with its terms of service.
Importantly, these records must be maintained for at least seven years, unless a longer period is agreed upon or required by law.
3. Can a Consent Manager access or read personal data?
This is one of the most important safeguards under the Rules.
The First Schedule expressly requires that the manner in which personal data is made available or shared must ensure that its contents are not readable by the Consent Manager.
Consider the bank statement example.
The Consent Manager may facilitate the sharing of the statement between the individual and the receiving financial institution. However, it should not be able to read the contents of that statement.
This requirement is significant because it separates the function of facilitating consent from the function of accessing or exploiting personal information.
The objective is to create trust in the consent-management ecosystem.
4. Who can become a registered Consent Manager?
Rule 4 does not permit every technology company or privacy consultancy to claim the status of a statutory Consent Manager.
The First Schedule, Part A, prescribes specific eligibility conditions.
Some important requirements include:
- The applicant must be a company incorporated in India.
- It must have sufficient technical, operational and financial capacity.
- Its net worth must be at least ₹2 crore.
- Its directors and senior management must have a reputation for fairness and integrity.
- Its proposed operations must be in the interests of Data Principals.
- Its interoperable platform must satisfy the applicable data protection standards and assurance framework and be independently certified.
The applicant must apply to the Data Protection Board of India.
The Board may conduct an inquiry into the applicant’s eligibility before granting registration or rejecting the application with reasons.
Therefore, merely developing a consent-management application does not make an organisation a legally recognised Consent Manager.
Registration by the Board is essential.
5. What responsibilities come with registration?
Registration is only the beginning.
A Consent Manager will have continuing legal and operational responsibilities.
First, it must maintain reasonable security safeguards to prevent personal data breaches.
Second, it must act in a fiduciary capacity in relation to the Data Principal. This is particularly important because the individual must be able to trust the platform handling consent-related decisions.
Third, it must avoid conflicts of interest with Data Fiduciaries, including their promoters and key managerial personnel.
The Rules also require transparency regarding promoters, directors, senior management and significant shareholders.
Further, a Consent Manager cannot subcontract or assign the performance of its statutory obligations.
It must also establish effective audit mechanisms to periodically review its technical and organisational controls, continued eligibility and compliance with its legal obligations.
These requirements demonstrate that the regulatory framework is designed around independence, transparency and accountability.
6. What happens if a Consent Manager violates the Rules?
The Data Protection Board has supervisory powers under Rule 4.
Where the Board believes that a Consent Manager is not complying with the prescribed conditions or obligations, it may, after providing an opportunity of being heard, direct it to take corrective measures.
The Board may also suspend or cancel its registration where necessary in the interests of Data Principals, after following the prescribed procedure.
It may further require the Consent Manager to furnish relevant information.
Thus, registration is not a permanent authorisation without continuing accountability.
7. What should individuals and businesses understand?
For individuals, the introduction of Consent Managers represents an opportunity to exercise greater control over how their personal data is shared and how consent decisions are managed.
For businesses, it creates an additional consideration when designing their consent-management architecture.
Organisations may need to examine how their systems can interact with registered Consent Managers and how consent requests, authorisations and data-sharing arrangements can be appropriately integrated.
However, one distinction is important: Rule 4 coming into force does not mean that every provision of the DPDP Act and Rules becomes operational on the same date. The commencement of the remaining provisions follows a separate phased timeline.
Conclusion: Consent must mean control, not merely acceptance
The real significance of Rule 4 lies in the institutionalisation of consent management.
For years, individuals have routinely clicked ‘I Agree’ without necessarily understanding how their personal information would be used or shared.
The Consent Manager framework seeks to introduce a more structured mechanism through which individuals can give, review, manage and withdraw consent.
However, its success will depend on more than the availability of technology. Independence, interoperability, data security, transparency and public trust will determine whether Consent Managers can deliver meaningful control to individuals.
The larger question is no longer simply whether an organisation obtains consent. It is whether individuals can meaningfully exercise control over that consent throughout the data-processing lifecycle.
Rule 4 is an important step towards answering that question.
