Consent Managers under the DPDP Act: what they do and who needs one

A Consent Manager is a company registered with the Data Protection Board that runs a platform through which a person can give, manage, review and withdraw consent to businesses from one place s.2(g) Rule 4 and the First Schedule to the DPDP Rules. The registration provisions start on 13 November 2026 (s.6(9), Rule 4), and the provisions that let a person act through a Consent Manager start on 13 May 2027 s.6(7) and (8). The Act says a person "may" use one, and Fohrkast reads nothing in the Act or the Rules as requiring a business to join one; a business that does accept consent through a Consent Manager should first check that the Board has registered it.

What is a Consent Manager?

The Act defines it as "a person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform" s.2(g).

Three features set it apart:

• It works for the person, not the business. It is "accountable to the Data Principal" and acts on her behalf (s.6(8)), and must "act in a fiduciary capacity in relation to the Data Principal" First Schedule, Part B, item 8.
• It routes consent, and can route data, without reading it. A person can give consent to a business on the platform directly, or through another business on the platform that holds her data (Part B, item 1), and the platform must make the data available in a way whose contents "are not readable by it" (Part B, item 2). The Rules illustrate this with a person sending her bank statement from one bank to another through the platform.
• It must be registered. Under the Act, only a person registered with the Board is a Consent Manager s.2(g), s.6(9).

Who can become one?

Part A of the First Schedule sets the conditions for registration. Among them:

• the applicant is a company incorporated in India (item 1);
• its net worth is not less than two crore rupees (item 4);
• it has the technical, operational and financial capacity for the role, and its finances and management are sound (items 2 and 3);
• its directors, key managerial personnel and senior management have a record of fairness and integrity (item 6);
• its memorandum and articles require it to avoid conflicts of interest with businesses, and can be amended on that point only with the Board's approval (item 7);
• it is "independently certified" that its interoperable platform meets the data protection standards and assurance framework the Board publishes (item 9).

The PIB explainer of 17 November 2025 puts it plainly: Consent Managers "must be companies based in India".

What must a registered Consent Manager do?

Part B of the First Schedule lists its obligations. It must:

• keep a record of the consents given, denied or withdrawn, the notices that came with each request, and each sharing of data with another business (item 3);
• give the person access to that record, a machine readable copy on request, and keep it for at least seven years (item 4);
• run a website or app as the main way people use it (item 5), and not subcontract its obligations (item 6);
• take reasonable security safeguards (item 7);
• avoid conflicts of interest with businesses, including through its directors and managers (items 9 and 10), and publish its promoters, directors, senior managers and every shareholder above two per cent (item 11);
• report audits to the Board (item 12), and not change control without the Board's prior approval (item 13).

Like a business, a Consent Manager must publish how people can make requests and a grievance period of at most 90 days Rule 14(1) and (3).

How does registration work?

An applicant that meets Part A applies to the Board with the particulars and documents the Board publishes on its website Rule 4(1). The Board may inquire, and then either registers the applicant and publishes its particulars on its website, or rejects the application with reasons Rule 4(2). The Board can direct a Consent Manager that falls short to put things right, and can suspend or cancel its registration after a hearing Rule 4(4) and (5). The Act lets the Board inquire into a breach of a condition of registration (s.27(1)(d)), and into a person's complaint against a Consent Manager s.27(1)(c).

On 21 October 2026 Fohrkast could not find a Data Protection Board website or any list of Consent Managers. The Board can register Consent Managers only once Rule 4 is in force.

When does this start?

Both dates count from the Gazette dated 13 November 2025; some sources count from 14 November. The DPDP dates post explains why, and why Fohrkast plans to the day before.

Does a business need a Consent Manager?

On Fohrkast's reading, no. Section 6(7) says a person "may" give, manage, review or withdraw consent through a Consent Manager: the choice is the person's. The Act and the Rules contain no duty for a business to join a Consent Manager's platform.

Using one does not move a business's own duties. The business still gives the notice (s.5), still carries the burden of proving notice and consent if a question arises (s.6(10)), and stays responsible for its processing s.8(1).

A business that does accept consent through a Consent Manager should:

1. check that the Board has registered it before relying on it, and note when it checked;
2. check again if the Board suspends or cancels a registration Rule 4(5).

Fohrkast lists this as a duty from 12 November 2026 for businesses that say they use a Consent Manager (duty). The law puts registration on the Consent Manager, so asking the business to check is Fohrkast's reading and shows as Recommended.

Is consent management software a Consent Manager?

No. Software a business uses to collect and record its own customers' consent works for that business. A Consent Manager works for the person, must be registered with the Board, and must avoid conflicts of interest with the businesses on its platform s.2(g), s.6(8) First Schedule, Part B, items 8 to 10.

Fohrkast is consent management software, not a Consent Manager. It records consent for each business as that business's processor, under a processor agreement (fohrkast.com/dpa, s.8(2)).

Fohrkast dates each of these duties for the business and keeps the evidence. Request access »