Consent Managers under the DPDP Act
Last checked 22 Oct 2026 · Draft. Awaiting counsel review.
A Consent Manager is a company registered with the Data Protection Board that lets a person give, manage, review and withdraw consent across many businesses through one platform; it must be a company incorporated in India with a net worth of at least two crore rupees (s.6(9), Rule 4). Registration starts on 13 Nov 2026. Using one is optional: Fohrkast reads nothing in the Act or the Rules as requiring a business to join one, and Fohrkast is not a Consent Manager.
Which duties weigh most for a business that uses a Consent Manager?
- Use only a registered Consent Manager. From 13 Nov 2026 every Consent Manager must be registered with the Board (s.6(9), Rule 4). The Board publishes the details of each Consent Manager it registers on its website. A business that accepts consent through one checks that the Board has registered it before relying on it, notes when it checked, and checks again if the Board suspends or cancels a registration. The law puts registration on the Consent Manager; asking the business to check is Fohrkast's reading, shown as Recommended until counsel confirms.
- The business's own consent duties. Fohrkast's rulebook applies the same consent duties whether or not a business uses a Consent Manager: a notice before or with every consent request (s.5(1), s.5(3), Rule 3), consent per purpose with withdrawal as easy as giving it (s.6(1), s.6(4)), and proof of each notice and consent, whose burden is on the business (s.6(10)). Penalty up to ₹50 crore (s.33, Schedule item 7).
- Responsibility. The business remains responsible for its own processing and its vendors' (s.8(1)).
When do the duties start?
| Date | What starts | Gazette reference |
|---|---|---|
| 13 Nov 2026 | Registration of Consent Managers (s.6(9), s.27(1)(d), Rule 4). | G.S.R. 843(E), item (b); G.S.R. 846(E), Rule 1(3) |
| 13 May 2027 | Nearly every duty on businesses, and the Board's penalties. | G.S.R. 843(E), item (c); G.S.R. 846(E), Rule 1(4) |
Both dates count from the Gazette dated 13 November 2025; some sources give 14 Nov 2026 and 14 May 2027. Fohrkast counts from 12 Nov 2026 and 12 May 2027, a day early, until counsel confirms, and shows each duty as a recommended step until its start date.
Why is Fohrkast not a Consent Manager?
A Consent Manager serves the person, across many businesses, and must be registered with the Board (s.6(9), Rule 4). Fohrkast serves one business at a time: it records the consent that business collects, as its processor under the processor agreement at fohrkast.com/dpa (s.8(2)), and holds no registration as a Consent Manager. Fohrkast is consent management software, not a Consent Manager.
What does Fohrkast do with consent?
- Fohrkast drafts the notice from the business's purposes and data map; the business checks and publishes it (s.5(1), Rule 3), in English or a language of the Eighth Schedule (s.5(3)).
- Consent is recorded per purpose, withdrawal is as easy as giving it (s.6(4)), and each record is kept to its retention date (s.6(10)).
- A business without a website uses a hosted page, opened by a short link or a QR poster.
- On the business's own website, a banner holds each marked tracker until the matching consent, and treats a browser that sends Global Privacy Control or Do Not Track as declining every optional purpose.
- For a business that says it uses a Consent Manager, the duty to check its registration shows from 12 Nov 2026, a day before the Gazette date, until counsel confirms.
- Every step is written to a hash-chained record (SHA-256) with times in IST, and the evidence pack can be exported on every plan.
What does Fohrkast not do?
- Give legal advice.
- File or send on a business's behalf.
- Hold more personal data than a duty needs.
- Claim a security certification. Fohrkast holds none yet.
The business remains the Data Fiduciary, responsible for its duties (s.8(1)).
Which plan usually fits?
| Plan | For | Price | Billed yearly |
|---|---|---|---|
| Professional | One business with a few systems: clinics, schools, practices and single-site firms | ₹9,999 a month, GST extra | ₹1,19,988 a year, GST extra |
| Business | A firm with a privacy lead or a compliance team, or any business above a Professional limit | ₹49,999 a month, GST extra | ₹5,99,988 a year, GST extra |
Consent withdrawal, the hosted consent page with its QR code and consent records kept to their retention date are on every plan and are never limited by plan or by non-payment. The plan follows the number of consent records held, among its other limits: up to 2,50,000 on Professional and 50,00,000 on Business. Prices are before GST at 18% and billed yearly in advance, in INR. Full terms: fohrkast.com/pricing.
Questions and answers
What is a Consent Manager under the DPDP Act?
A Consent Manager is registered with the Data Protection Board and lets a person give, manage, review and withdraw consent across many businesses through one platform; it must be a company incorporated in India with a net worth of at least two crore rupees (s.6(9), Rule 4).
Does a business need a Consent Manager?
On Fohrkast's reading, no: using one is optional, and nothing in the Act or the Rules requires a business to join one. A business that accepts consent through a Consent Manager checks first that the Board has registered it (s.6(9), Rule 4).
When does Consent Manager registration start?
On 13 Nov 2026, one year after the Gazette dated 13 November 2025 (s.6(9), s.27(1)(d), Rule 4; G.S.R. 846(E), Rule 1(3)). Some sources give 14 Nov 2026; Fohrkast counts from 12 Nov 2026 until counsel confirms.
Is consent management software a Consent Manager?
No. Software a business uses to record its own customers' consent serves that business. A Consent Manager serves the person across many businesses and must be registered with the Board (s.6(9), Rule 4). Fohrkast is consent management software, not a Consent Manager.
What should a consent management platform for the DPDP Act do?
Record consent per purpose, keep proof of each notice and consent (s.6(10)) and make withdrawal as easy as giving consent (s.6(4)), with notices in English or a language of the Eighth Schedule (s.5(3)). Fohrkast does each of these, from a hosted page or a QR poster. On a business's own website, its banner holds each marked tracker until the matching consent.
Sources
- Digital Personal Data Protection Act, 2023 (22 of 2023): MeitY copy. Read 21 Oct 2026.
- G.S.R. 846(E), Digital Personal Data Protection Rules, 2025: MeitY copy. Read 21 Oct 2026.
- G.S.R. 843(E), commencement of the Act, 13 Nov 2025: MeitY copy. Read 21 Oct 2026.
- Fohrkast rulebook in.dpdp version 1: published duties.
Related duties in the published rulebook: a registered Consent Manager, notice before consent, valid and withdrawable consent, proof of notice and consent.
Not legal advice. Legal statements on this page are awaiting counsel review.