DPDP-Ready series
In our first post in the DPDP-ready series, we mentioned that the Consent Manager registration provisions are scheduled to take effect in November 2026, and that most ordinary businesses do not need to register as one. That distinction matters enough to deserve its own explanation, so here it is in full.
What a Consent Manager actually is
Right now, if you want to see what you have agreed to share with different apps and services, you have to check each one separately. A Consent Manager is meant to fix that: a single, registered platform giving individuals one place to:
- Give consent to a business through a unified interface
- Manage existing consents across multiple businesses
- Review what is active and what data is being used for
- Withdraw consent from one or several businesses at once
Think of it as a universal remote for your personal data. Instead of ten separate remotes for ten separate devices, one remote controls all of them.
The idea is not new to India. It borrows directly from the Account Aggregator model already running in Indian banking, where a single registered intermediary lets you share financial data across banks and lenders without each institution needing direct access to the others’ records.
Consent Manager vs. consent management software
This is the single most common point of confusion, so it is worth being precise about it.
A Consent Manager, in the DPDP Act’s sense, is a specific, registered legal entity. It sits between individuals and businesses as a neutral intermediary, and it must register with the Data Protection Board before it can operate.
Consent Management Platform (CMP), is a different thing entirely: a tool that a business uses internally to collect and manage consent from its own customers. This does not require registration with anyone. Most businesses reading this need the second thing, not the first.
| Consent Manager | Consent management platform/software | |
|---|---|---|
| What it is | A registered intermediary entity | A software tool a business uses |
| Registration required | Must register with the Data Protection Board | No. Consent Manager registration required simply to use the software |
| Who it serves | Individuals, across many businesses | One business, for its own customers |
| Who typically needs it | Fintech, healthtech, and identity platforms building cross-platform consent infrastructure | Ordinary businesses collecting consent from their own users |
Who actually needs to register
Registration is relevant to a narrow, specific group: businesses trying to become the neutral intermediary itself, not businesses trying to collect consent from their own customers.
That narrow group includes account aggregator-style platforms extending into broader personal data consent, fintech and healthtech platforms building consent infrastructure across multiple institutions, and dedicated identity or consent-management startups whose entire product is being that single dashboard.
If your business collects consent from your own customers so you can run your own operations, whether that is a bank, an e-commerce site, a hospital, or a SaaS company, you are a Data Fiduciary, not a Consent Manager, and none of the registration requirements below apply to you.
The deadline and what it takes to register
The DPDP Rules’ Consent Manager registration provisions are scheduled to take effect on 13 November 2026. Organisations intending to operate as Consent Managers must meet the prescribed conditions and register with the Data Protection Board.
An organisation wanting to register must satisfy a full set of eligibility conditions before the Data Protection Board will approve it, including:
- Being a company incorporated in India, under the Companies Act, 2013, which rules out foreign entities applying directly
- A minimum net worth of ₹2 crore
- Demonstrated technical and operational capacity to run an interoperable platform at scale
- Directors and senior management with a clean track record and good standing
- Independent certification that the platform meets the data protection standards and assurance framework published by the Board.
- Company documents (its MOA and AOA) that lock in fiduciary obligations to the individuals it serves, changeable only with the Board’s approval
Once registered, a Consent Manager also carries ongoing duties: keeping consent records for a minimum of seven years, staying fully independent from any business whose consent it manages, and remaining interoperable across platforms rather than locked to one.
A Consent Manager must be registered with the Data Protection Board. The DPDP Act provides for a penalty of up to ₹50 crore for a Consent Manager’s contravention of the relevant obligations under Section 6(7) or 6(8). This is a statutory maximum, not an automatic fine for every instance.
The registration process itself works like most regulatory approvals: an eligible business submits its application and supporting documents to the Data Protection Board, the Board can inquire further before deciding, and it either grants registration or explains why it did not. If your business is genuinely in that narrow group, the DPDP Rules themselves spell out the complete conditions and procedure.
What this means if you are not registering
Even if you never register as a Consent Manager, you still need to get ready for one existing. Once Consent Managers go live, individuals may start giving, reviewing, and withdrawing consent to your business through a registered Consent Manager’s platform instead of your own consent form.
Practically, that means your systems eventually need to be able to accept a consent action, especially a withdrawal, that arrives from a Consent Manager rather than directly from your own website or app. This is a good thing to have on your radar now, well before the deadline, even though it is not something you need to build overnight.
Frequently Asked Questions
What is a Consent Manager under the DPDP Act?
A Consent Manager is a Data Protection Board-registered platform that acts as a single point of contact for individuals to give, manage, review, and withdraw their consent across multiple businesses.
Does my business need to register as a Consent Manager?
Almost certainly not. If your business collects consent from its own customers to run its own operations, you are a Data Fiduciary, not a Consent Manager, and registration does not apply to you.
What is the deadline for Consent Manager registration?
The DPDP Rules’ Consent Manager registration provisions are scheduled to take effect on 13 November 2026. Organisations intending to operate as Consent Managers must meet the prescribed conditions and register with the Data Protection Board.
What is the net worth requirement to register as a Consent Manager?
An applicant must demonstrate a minimum net worth of ₹2 crore, among other eligibility conditions, before the Data Protection Board will approve registration.
What is the difference between a Consent Manager and consent management software?
A Consent Manager is a registered legal entity acting as a neutral intermediary between individuals and multiple businesses. Consent management software is a tool a single business uses internally to manage consent from its own customers, and it does not require registration.
What happens if a business operates as a Consent Manager without registering?
The DPDP Act provides for a penalty of up to ₹50 crore for a Consent Manager’s contravention of the relevant obligations under Section 6(7) or 6(8). This is a statutory maximum, not an automatic fine for every instance.
References
For more information, refer to the official legal documents below:
Digital Personal Data Protection Act, 2023
DPDP Act, 2023 — Commencement Notification, 13 November 2025
Digital Personal Data Protection Rules, 2025
Disclaimer: This article is intended for general informational purposes only and does not constitute legal advice. Businesses should consult qualified legal professionals to understand how the DPDP Act applies to their specific circumstances.
Follow our Twitter and Facebook feeds for new releases, updates, insightful posts and more.
