--- title: "Building the Consent Layer: Consent Managers Under the DPDP Rules, 2025 " date: 2026-08-13 author: "Dhruv Kaushal" url: https://ksandk.com/data-protection-and-data-privacy/dpdp-consent-manager-framework-india/ --- ## Introduction Every time a person clicks “I agree” on a website, downloads an app or opens a bank account, a separate act of consent may be given to an organisation processing that person’s personal data. Until recently, there has been no mechanism under Indian law through which an individual could manage, in one place, the consents given to different organisations, including reviewing and withdrawing those consents.  The [Digital Personal Data Protection Act](https://www.dpdpa.com/), 2023 (“DPDP Act”) seeks to address this fragmentation by creating a new regulated intermediary: the Consent Manager. A Consent Manager is intended to act as a single point of contact through which a Data Principal can give, manage, review and withdraw consent through an accessible, transparent and interoperable platform. Section 2(g) of the DPDP Act defines a Consent Manager as a person registered with the Data Protection Board of India (“Board”) for this purpose.  ### Are you a Significant Data Fiduciary? Answer 25 questions to see your DPDPA risk level and whether the DPO obligation applies to you — free, instant, with a branded PDF. [Check your compliance score →](https://ksandk.com/privacy-review/scorecard) The concept draws upon India’s broader Data Empowerment and Protection Architecture (“DEPA”), which has also informed the design of consent-based data-sharing frameworks such as the Account Aggregator ecosystem in the financial sector. While there is no direct equivalent to the Consent Manager framework in the European Union’s General Data Protection Regulation (“GDPR”), the concept is intended to provide individuals with greater control over how their personal data is shared and processed.   With the notification of the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”) by the Ministry of Electronics and Information Technology (“MeitY”) on 13 November 2025, the statutory framework for Consent Managers has been supplemented by specific registration conditions and ongoing obligations. However, the framework has a staggered commencement structure. Rule 4, which governs the registration and obligations of Consent Managers, comes into force one year after publication of the Rules, i.e. on 13 November 2026. Other substantive provisions of the Rules come into force 18 months after publication, i.e. on 13 May 2027.  This article examines the statutory and regulatory framework governing Consent Managers, the registration conditions and ongoing obligations prescribed under the DPDP Rules, 2025, and the broader legal uncertainty arising from the constitutional challenges pending before the Supreme Court of India.  ## The Statutory and Regulatory Basis: Section 6 of the DPDP Act and Rule 4 of the DPDP Rules, 2025 Section 2(g) of the DPDP Act defines a Consent Manager as a person registered with the Board who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform.  Section 6(7) of the DPDP Act provides that a Data Principal may give, manage, review or withdraw consent through a Consent Manager. Section 6(8) makes the Consent Manager accountable to the Data Principal and requires it to act on behalf of the Data Principal in the manner prescribed. Section 6(9) provides that a Consent Manager must be registered with the Board, subject to such technical, operational, financial and other requirements as may be prescribed.  The Ministry of Electronics and Information Technology notified the Digital Personal Data Protection Rules, 2025 on 13 November 2025 vide Notification G.S.R. 846(E). Rule 4 establishes the registration framework for Consent Managers. It provides that a person satisfying the conditions in Part A of the First Schedule may apply to the Board for registration by furnishing the particulars, information and documents specified by the Board. The Board may conduct an inquiry to determine whether the applicant satisfies the prescribed conditions and may either register the applicant or reject the application with reasons.  Importantly, Rule 4 does **not** come into force immediately. Under Rule 1(3), it comes into force one year after publication of the Rules, i.e. on 13 November 2026. Rules 3 and 5 to 16, 22 and 23 come into force 18 months after publication, i.e. on 13 May 2027. This staggered commencement is important when assessing the present compliance status of the DPDP framework. The DPDP Act itself follows a similar [staggered commencement structure](https://ksandk.com/data-protection-and-data-privacy/dpdp-act-rules-2026-compliance-deadline/). Section 6(9), which provides the statutory basis for Consent Manager registration, comes into force one year after 13 November 2025, while most of the substantive provisions concerning the processing of personal data and consent come into force 18 months after that date.  ## Registration and Obligations: The First Schedule Framework The conditions for registration of a Consent Manager are set out in Part A of the First Schedule to the DPDP Rules. An applicant must, among other things:  - be a company incorporated in India;  - have sufficient technical, operational and financial capacity to fulfil its obligations as a Consent Manager;  - have sound financial condition and management;  - have a minimum net worth of ₹2 crore;  - have adequate capital structure, earning prospects and anticipated business volume;  - have directors, key managerial personnel and senior management with a general reputation and record of fairness and integrity; and - ensure that its constitutional documents contain provisions addressing specified obligations and conflict-of-interest requirements.  The applicant must also ensure that its proposed operations are in the interests of Data Principals and must obtain independent certification that its interoperable platform complies with the data protection standards and assurance framework published by the Board, together with appropriate technical and organisational measures.  ### **Ongoing Obligations of a Consent Manager** Upon registration, a Consent Manager will be required to comply with the obligations specified in Part B of the First Schedule. Primarily, a Consent Manager must operate a platform through which a Data Principal can give consent to the processing of personal data by a Data Fiduciary onboarded onto the platform. The Rules contemplate both direct consent to the relevant Data Fiduciary and arrangements in which consent may be routed through another [Data Fiduciary onboarded onto the platform](https://ksandk.com/data-protection-and-data-privacy/significant-data-fiduciary-sdf-readiness-audit/).  The Consent Manager must ensure that the manner in which personal data is made available or shared is such that the contents of the personal data are not readable by the Consent Manager. This is an important structural safeguard intended to limit the Consent Manager’s access to the underlying personal data while allowing it to facilitate consent management. The Consent Manager must also maintain records on its platform of:  - consents given, denied or withdrawn;  - notices preceding or accompanying requests for consent; and  - sharing of personal data with a transferee Data Fiduciary.  The Data Principal must have access to these records, and the Consent Manager must, on request and subject to its terms of service, make the information available in machine-readable form. These records must be maintained for at least seven years, or for a longer period where agreed between the Data Principal and Consent Manager or required by law. The Consent Manager must also:  - maintain a website or app, or both, as the primary means through which Data Principals access its services;  - not subcontract or assign the performance of its obligations under the DPDP Act and the Rules;  - [implement reasonable security safeguards to prevent personal data breaches](https://ksandk.com/data-protection-and-data-privacy/data-breach-response-notification-counsel/);  - act in a fiduciary capacity in relation to the Data Principal; and  - avoid conflicts of interest with Data Fiduciaries.  The conflict-of-interest framework extends to the promoters, directors, key managerial personnel and senior management of the Consent Manager. The Rules specifically require measures to address conflicts arising from directorships, financial interests, employment, beneficial ownership or material pecuniary relationships with Data Fiduciaries.  Transparency is another important component of the framework. A Consent Manager must publish accessible information concerning its promoters, [directors, key managerial personnel and senior management](https://ksandk.com/data-protection-and-data-privacy/dpdp-act-director-liability/), as well as persons holding more than two per cent of its shareholding and certain corporate relationships involving its management.  Where a Consent Manager fails to adhere to the prescribed conditions or obligations, the Board may, after providing an opportunity of being heard, direct the Consent Manager to take remedial measures. Where it considers suspension or cancellation necessary in the interests of Data Principals, the Board may suspend or cancel the Consent Manager’s registration and issue appropriate directions.  ## Litigation and Institutional Uncertainty: The DPDP Act Before the Courts The Consent Manager framework is being developed against a backdrop of broader constitutional challenges to the DPDP Act and the DPDP Rules. In February 2026, the Supreme Court of India considered a group of writ petitions, including *Venkatesh Nayak v. Union of India*[1](#41541b45-103a-47ac-8175-ee3f07fc67a3) and *The Reporters Collective Trust & Anr. v. Union of India & Ors.*, challenging various provisions of the DPDP Act and the DPDP Rules. The challenges raise, among other issues, questions concerning the constitutional validity of aspects of the framework, including the institutional independence of the Data Protection Board and provisions affecting transparency and freedom of speech and expression. The Supreme Court issued notice and referred the matters for consideration by a larger bench, while declining to grant an interim stay on the operation of the DPDP framework.  The challenge concerning the Board’s institutional structure is particularly relevant to the Consent Manager framework because the Board is the authority responsible for registering Consent Managers under Section 6(9) of the DPDP Act and Rule 4 of the DPDP Rules. The petitioners have raised concerns regarding the role of the executive in the composition of the Board and its implications for institutional independence. However, these constitutional challenges should not be treated as having invalidated or stayed the DPDP framework. As of the present position, the Supreme Court has not stayed the operation of the framework. The Rules therefore remain the applicable regulatory framework, subject to their respective commencement dates and the outcome of the pending proceedings.  The broader litigation nevertheless creates a degree of institutional uncertainty for [businesses considering entering the](https://ksandk.com/data-protection-and-data-privacy/india-uk-fta-it-companies-gccs-key-changes/) Consent Manager ecosystem. Any future judicial determination concerning the validity or interpretation of the DPDP Act or Rules could affect the manner in which the framework is implemented.  ## Why This Is a Growing Concern: The Case for Special Compliance Focus There are several factors that suggest that the Consent Manager framework should be studied closely by any organisation considering becoming a Consent Manager. Firstly, the registration framework will become operational before the broader substantive compliance provisions **of the DPDP Rules.** Rule 4 comes into force on 13 November 2026, one year after the Rules were notified, whereas Rules 3 and 5 to 16, 22 and 23 come into force on 13 May 2027. This means that organisations considering becoming Consent Managers will need to assess the registration requirements in advance of the wider implementation of the DPDP framework.  Secondly, the DPDP Act does not require every Data Fiduciary to route consent through a Consent Manager. The framework instead provides Data Principals with the ability to use a Consent Manager for giving, managing, reviewing and withdrawing consent. Consequently, a Data Fiduciary may need to consider how its existing consent-management and governance mechanisms interact with Consent Managers where Data Principals choose to use them. Section 6(7) specifically contemplates the use of a Consent Manager by the Data Principal; it does not make a Consent Manager universally mandatory.  Thirdly, the Consent Manager framework places significant importance on independence and conflict management. A Consent Manager acts in a fiduciary capacity towards the Data Principal and is required to avoid conflicts of interest with Data Fiduciaries. The Rules also contain specific restrictions and disclosure requirements concerning the interests of its management in Data Fiduciaries.  Fourthly, the Consent Manager is required to maintain detailed records for at least seven years. This includes records of consents given, denied or withdrawn, notices accompanying requests for consent and sharing of personal data with transferee Data Fiduciaries. This creates significant requirements concerning record management, security, governance and auditability.  Fifthly, the Consent Manager must operate an interoperable platform while ensuring that the contents of personal data made available or shared through the platform are not readable by the Consent Manager. This creates an important technical and governance requirement for any entity considering entry into this space.  Finally, organisations considering becoming Consent Managers will need to account for the possibility that the regulatory framework may evolve as the constitutional challenges before the Supreme Court progress. This does not presently suspend the framework, but businesses should monitor developments closely when making long-term investments in Consent Manager infrastructure.  ## Conclusion The Consent Manager is one of the structurally significant concepts introduced by the DPDP framework. It seeks to create a single point through which individuals can give, manage, review and withdraw consent in an increasingly [interconnected digital economy](https://ksandk.com/intellectual-property-rights/why-ai-cannot-be-patent-inventor-india/).  The registration and obligations framework in the First Schedule to the DPDP Rules is detailed and places significant responsibilities on Consent Managers, recognising the fiduciary position that such entities will occupy between Data Principals and Data Fiduciaries. These responsibilities extend beyond facilitating consent and include maintaining detailed consent records, ensuring interoperability, implementing security safeguards, managing conflicts of interest and maintaining transparency regarding ownership and management.  At present, the Consent Manager registration framework is scheduled to come into force on 13 November 2026, while the wider substantive provisions of the DPDP Rules are scheduled to commence on 13 May 2027. Accordingly, businesses considering entering this space should begin evaluating the registration requirements, platform architecture, governance arrangements, conflict-of-interest controls and record-management systems well before the relevant commencement dates.  The constitutional challenges pending before the Supreme Court add an element of uncertainty to the developing framework. However, the Supreme Court has not stayed the operation of the DPDP framework, and the notified Rules continue to provide the applicable regulatory roadmap, subject to their staggered commencement and the outcome of the pending proceedings.  The emergence of Consent Managers therefore represents not merely a new compliance requirement, but a potentially significant development in India’s data-protection ecosystem. Organisations considering becoming Consent Managers should assess the regulatory, ,technological and governance requirements in advance, while Data Fiduciaries should consider how the emergence of Consent Managers may affect their consent-management processes and interactions with Data Principals  ## Frequently Asked Questions ### 1. What is a Consent Manager under the DPDP Act? A Consent Manager is a person or entity registered with the Data Protection Board of India that acts as a single point of contact for a Data Principal to give, manage, review and withdraw consent for the processing of their personal data. This is defined under Section 2(g) of the DPDP Act, 2023. ### 2. When does the Consent Manager registration framework come into force? Rule 4 of the DPDP Rules, 2025, which governs registration and obligations of Consent Managers, comes into force on 13 November 2026, one year after the Rules were notified. Most other substantive provisions of the Rules come into force later, on 13 May 2027. ### 3. Is it mandatory for every organisation to route consent through a Consent Manager? No. Section 6(7) of the DPDP Act allows a Data Principal to use a Consent Manager if they choose to, but it does not make this route mandatory for every Data Fiduciary. Existing consent mechanisms can continue to operate alongside the Consent Manager framework. ### 4. What are the eligibility requirements to register as a Consent Manager? Under Part A of the First Schedule to the DPDP Rules, an applicant must be a company incorporated in India with a minimum net worth of ₹2 crore, sound financial and operational capacity, and directors and key management personnel with a good record of integrity. The applicant must also obtain independent certification confirming its platform meets the Board’s data protection standards. ### 5. Have the constitutional challenges to the DPDP Act affected the Consent Manager framework? As of now, no. The Supreme Court is examining petitions challenging various provisions of the DPDP Act and Rules, including questions about the independence of the Data Protection Board, but it has not stayed the operation of the framework. The Rules therefore remain applicable, subject to their staggered commencement dates and the outcome of the pending litigation. ### Explore KSK Data Privacy Hub Free compliance tools and expert guidance covering 75+ jurisdictions. [Global Regulation Finder](/privacy-review/map/)[DPDPA Scorecard](/privacy-review/scorecard/)[DPDPA Guide](/privacy-review/guides/dpdpa/)[GDPR Guide](/privacy-review/guides/gdpr/)[Cross-Border Transfers](/privacy-review/guides/cross-border/) --- ## Office Locations - [New Delhi](https://ksandk.com/locations/top-corporate-law-firm-in-delhi/) (HQ): +91-11-41318190 | info@ksandk.com - [Mumbai](https://ksandk.com/locations/top-corporate-law-firm-in-mumbai/): 3 offices (Nariman Point, Lower Parel, Andheri) | mumbai@ksandk.com - [Bangalore](https://ksandk.com/locations/top-corporate-law-firm-in-bangalore/): bangalore@ksandk.com - [Chennai](https://ksandk.com/locations/chennai/): chennai@ksandk.com - [Hyderabad](https://ksandk.com/locations/hyderabad/): hyderabad@ksandk.com - [Pune](https://ksandk.com/locations/pune/): pune@ksandk.com - [Kochi](https://ksandk.com/locations/kochi/): kochi@ksandk.com ## Contact - [Contact Page](https://ksandk.com/contact-us/) - General: info@ksandk.com | +91-11-41318190 - WhatsApp: +91-7428567444 - [Privacy Statement](https://ksandk.com/privacy-statement/) - [Terms of Use](https://ksandk.com/terms-of-use/)