If you run a website or app in India, you will hear "Consent Manager" in the same breath as the Digital Personal Data Protection Act, 2023 (the "Act") and the DPDP Rules, 2025 (the "Rules"). Some vendors make it sound like a mandatory purchase. It is not. Here is what the law actually says.
The short answer
- A Consent Manager is a person registered with the Data Protection Board who acts as a single point of contact for an individual's consent.
- Using one is the individual's option. Nothing in the Act or Rules requires a business to appoint one or join one.
- Using one does not reduce your own compliance duties.
- A cookie banner or consent-management tool is not a Consent Manager unless the company behind it is registered with the Board.
What the Act says
Section 2(g) defines a Consent Manager as "a person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform."
Section 6 adds three points:
- Section 6(7): the Data Principal may give, manage, review or withdraw consent to a Data Fiduciary through a Consent Manager.
- Section 6(8): the Consent Manager is accountable to the Data Principal and acts on her behalf, as prescribed.
- Section 6(9): every Consent Manager must be registered with the Board, on the prescribed conditions.
Section 13 gives the Data Principal readily available grievance redressal from a Data Fiduciary or Consent Manager. Section 27(1)(c) and (d) let the Board inquire into a Consent Manager's breach of its obligations (on a Data Principal's complaint) or of its registration conditions.
The Act does not require any Data Fiduciary to offer or accept consent through a Consent Manager. It also does not say that consent given through one is more valid than consent given directly.
What the Rules add
Rule 4 and the First Schedule set the detail.
To register (Part A), the applicant must:
- be a company incorporated in India;
- have sufficient technical, operational and financial capacity, and sound financial condition and management;
- have a net worth of at least ₹2 crore;
- have adequate business volume, capital structure and earning prospects;
- have directors, key managerial personnel and senior management with a general reputation and record of fairness and integrity;
- have charter documents that require adherence to the conflict-of-interest obligations and can be amended only with the Board's prior approval;
- propose operations that are in the interests of Data Principals; and
- be independently certified as consistent with the standards and assurance framework the Board publishes.
To operate (Part B), a Consent Manager must:
- enable consent to a Data Fiduciary onboarded on its platform, directly or through another Data Fiduciary that holds the data;
- ensure the data it passes on is not readable by the Consent Manager itself;
- record consents given, denied or withdrawn, the notices that came with the requests, and any data sharing, give the Data Principal access to the record and a machine-readable copy on request, and keep it for at least seven years (or longer if agreed or required by law);
- maintain a website or app as its primary access point;
- not sub-contract or assign its obligations;
- take reasonable security safeguards against personal data breach;
- act in a fiduciary capacity towards the Data Principal;
- avoid conflicts of interest with Data Fiduciaries;
- publish details of its promoters, management and holders of more than 2% of its shares;
- maintain audit mechanisms and report results to the Board; and
- obtain the Board's prior approval before any transfer of control.
Under Rule 4(2), the Board may inquire into an application, then register the applicant and publish its particulars, or reject it with reasons. Under Rule 4(4) and (5), after a hearing, it can direct corrective measures, or suspend or cancel registration. Rule 14(3) requires Consent Managers, like Data Fiduciaries, to publish a grievance redressal system that responds within a reasonable period not exceeding 90 days.
What is in force, and what is not
| Provision | Commencement | Status on 7 Oct 2026 |
|---|---|---|
| Act ss. 1(2), 2 (including 2(g)), 18–26, 35, 38–43, 44(1) and (3); Rules 1, 2, 17–21 | 13 Nov 2025 | In force |
| Act s. 6(9) and s. 27(1)(d); Rule 4 | One year later, about Nov 2026 | Not yet in force |
| Act ss. 3–5, 6(1)–(8) and (10), 7–17 (including s. 13), rest of s. 27, 28–34 (including s. 33), 36, 37, 44(2); Rules 3, 5–16 (including Rule 14), 22, 23 | Eighteen months later, about May 2027 | Not yet in force |
Where things stand today
- The Board is not yet staffed. MeitY sought nominations for Chairperson and Members in May 2026. A Hindu BusinessLine report of 5 October 2026 says the Board is yet to be set up and its detailed Consent Manager guidelines are yet to be published. A Board with no appointed members cannot process registrations in practice.
- Industry is cautious. Privacy-technology firms told the same publication they are waiting for the Board's guidelines. Some said they would rather stay technology providers than become intermediaries.
- No change to the dates. MeitY consulted industry in January 2026 on shortening the eighteen-month period.
- A constitutional challenge is pending. Petitions in the Supreme Court (led by W.P.(C) 177/2026) challenge sections 17(1)(c), 17(2), 33(1), 36 and 44(3) and Rules 17 and 23(2). The Court issued notice on 16 February 2026 and refused an interim stay. Section 6 and the Consent Manager provisions are not among the provisions listed in the petition. Section 33(1), which sets the penalty threshold ("significant" breach), is.
Consent Manager vs. consent-management software
| Statutory Consent Manager | Consent-management software | |
|---|---|---|
| Board registration | Required (s. 6(9); Rule 4) | The Act has no registration regime for software |
| Who it serves | The Data Principal, in a fiduciary capacity | The business that deploys it |
| Reads the personal data it routes | Must not be able to (Part B, item 2) | Depends on the product |
| Takes over the business's compliance duties | No | No |
Calling an ordinary banner or consent platform a "Consent Manager" risks being misleading unless the company is actually registered.
Does using a Consent Manager reduce your liability?
No.
- Section 8(1): a Data Fiduciary is responsible for complying with the Act and Rules "irrespective of any agreement to the contrary", including for processing done on its behalf by a Data Processor.
- Section 6(10): where consent is the basis of processing and the question arises in a proceeding, you must prove that notice was given and consent was given in accordance with the Act and Rules.
A Consent Manager's seven-year record may help you evidence consent. The burden stays with you.
A word on penalties
Under section 33, the Board can impose a penalty only after an inquiry finds the breach "significant" and after hearing the person concerned. The Schedule has no entry specific to Consent Managers. Its residual entry covers breach of any other provision of the Act or Rules, with a penalty that may extend to ₹50 crore. A Consent Manager's breach of Rule 4 would most likely fall there, but the Act does not say so expressly.
The ₹250 crore figure in the Schedule applies to a Data Fiduciary's failure to take reasonable security safeguards under section 8(5). It is not a penalty for consent failures.
If you sell online: a separate deadline
The Consumer Protection (E-Commerce) (Amendment) Rules, 2026 are made under the Consumer Protection Act, 2019, not the DPDP Act. They were notified on 9 September 2026 (G.S.R. 789(E)) and come into force on 1 January 2027. They do not mention Consent Managers. As notified, they require every e-commerce entity to:
- comply with the Dark Patterns Guidelines, 2023;
- conduct a yearly self-audit; and
- display a certificate to that effect.
A marketplace also needs the "express and affirmative consent" of the consumers concerned before using information it collects to sell goods under a brand common with its own, or to promote a seller as associated with it. The Rules do not tie that phrase to the DPDP Act. Compliance with one framework does not establish compliance with the other, and a Consent Manager would not take over the audit duty.
What to do now
- Don't rush to appoint a Consent Manager. None is required, and none is yet registered.
- Build for May 2027. The notice (Rule 3) and consent (section 6) duties for your own site or app apply from about 13 May 2027.
- If you sell online, plan for 1 January 2027.
- Keep your own consent records. Section 6(10) puts the burden on you. (This is practical advice, not a stated retention rule.)
- Watch the Board. Its composition and its registration standards are the next milestones.
- If you want to become a Consent Manager, check the ₹2 crore net worth, the conflict-of-interest and no-sub-contracting rules, and the independent certification before investing.
Common myths
- "Every Indian website must appoint a Consent Manager." Not in the Act or Rules.
- "Consent Managers are already mandatory." The registration provisions start about 13 November 2026, and registration is mandatory only for those who want to operate as one.
- "A cookie banner is a Consent Manager." Only a Board-registered company can be one.
- "Using a Consent Manager makes you compliant." Section 8(1) keeps responsibility with you.
- "The DPDP Act fines ₹250 crore for consent failures." That figure is tied to security safeguards.
A Consent Manager is one component of the statutory framework, not a substitute for proper notices, lawful processing, governance, security, record-keeping and accountability.For businesses, the practical message is straightforward: prepare your own compliance framework first, and treat Consent Manager integration as an additional mechanism rather than the foundation of compliance.