Consent Managers under DPDP: registration opens 13 November 2026. Do you need one?

A Consent Manager is an Indian company registered with the Data Protection Board that lets a person give, manage, review and withdraw her consent to many organisations from one platform (s. 2(g), s. 6(7)). Registration opens on 13 November 2026 under Rule 4 and the First Schedule of the DPDP Rules. An applicant needs a net worth of at least ₹2 crore, independent certification against standards the Board has yet to publish, directors and senior management free of conflicts, and no conflicts with the fiduciaries it serves. People may choose to use one, and nothing in the Act obliges an organisation to join one. Most organisations need two things instead: their own consent records, and a way to honour consent and withdrawals that arrive through a Consent Manager.

Commons Trust provides consent software and services to fiduciaries. It is not, and does not plan to become, a registered Consent Manager. Like the Act (s. 2(y)), we say "she" and "her" for every person.

Jump to what you need.

• Most organisations: Consent Manager or consent software?, Do you need one? A decision tree.
• CTOs and fiduciaries in data-sharing sectors: If people come to you through a Consent Manager, What the messages should carry.
• Would-be Consent Managers and their investors: Who can register, What a registered Consent Manager must do.
• Legal and DPOs: The law, and when each part starts, Open questions.

The law, and when each part starts

The Act defines a Consent Manager as "a person registered with the Board, who acts as a single point of contact" so that a Data Principal can give, manage, review and withdraw her consent "through an accessible, transparent and interoperable platform" (s. 2(g)). The rest of the regime is spread across the Act and the Rules (G.S.R. 846(E), as corrected by G.S.R. 892(E)), and commences in two steps.

From 13 November 2026 a registered company is bound by Part B. The provisions that let people use it with fiduciaries, make it answerable to them and set penalties arrive six months later. See DPDP compliance deadline for every commencement date.

The Consent Manager acts for the person, in a fiduciary capacity towards her (s. 6(8), First Schedule Part B, item 8), so the fiduciaries it connects to are not its clients in the usual sense. It must also make data available or share it in a way that keeps the contents unreadable to the Consent Manager itself (Part B, item 2).

How "data-blind" sharing works. The closest working example in India is the account aggregators registered by the Reserve Bank of India as NBFC-AAs for sharing financial information. The RBI's Master Direction on NBFC-Account Aggregators (2016) says financial information an aggregator accesses must not reside with it, and requires providers to digitally sign and securely transmit the data. A bank's explainer describes the flow as encrypted so that only the receiving institution can process it (Union Bank of India). Our illustration, generically: the Consent Manager carries the consent and the instruction to share; the fiduciary holding the data encrypts it for the receiving fiduciary; the Consent Manager passes it on, or the two exchange it directly, without the Consent Manager holding a key. The DPDP Rules do not mention account aggregators, and whether an aggregator must also register as a Consent Manager is not settled.

Who can register

An applicant must satisfy the Board on all nine conditions in Part A (Rule 4(1)). Most are judgement calls about capacity, finances, management reputation and the business plan (items 2, 3, 5, 6 and 8). The four below are the ones most likely to decide whether an application can go in at all:

Item 6 adds a fit-and-proper test: directors, key managerial personnel and senior management must have a general reputation and record of fairness and integrity.

A section 8 company is incorporated under the Companies Act, so item 1 does not exclude it. But the Board must also be satisfied that likely business, capital structure and earning prospects are adequate (item 5). That is not a legal bar to a not-for-profit model; expect the Board to ask how the service will be funded for at least the seven years it must keep records.

The applicant files the particulars and documents the Board publishes on its website (Rule 4(1)). The Board may inquire as it thinks fit, then registers the applicant, informs it and publishes its particulars, or rejects the application with reasons (Rule 4(2)).

Status as of 25 October 2026. We have found no published application particulars and no published standards or assurance framework. MeitY sought nominations for the Board's Chairperson and Members on 6 May 2026 and issued a further notification in June; reports through August 2026 said no appointments had been made (LiveLaw), and we have found none announced since. The first registrations are likely to follow the appointments and the framework, whatever the date in Rule 4.

What a registered Consent Manager must do

Part B of the First Schedule binds a registered Consent Manager (Rule 4(3)). Its thirteen items fall into five areas:

• Service. Let a person give consent to an onboarded fiduciary directly, or through another onboarded fiduciary that holds her data with her consent, through its own website or app (items 1, 5).
• Data blindness and security. Keep shared data unreadable to itself, and take reasonable security safeguards against breach (items 2, 7).
• Records. Record consents given, denied or withdrawn, the notices that came with each request, and each sharing of her data with a receiving fiduciary. Give her access to the record and, on request and in accordance with its terms of service, a copy in machine-readable form. Keep it for at least seven years, or longer if agreed or required by law (items 3, 4).
• Accountability. Act in a fiduciary capacity towards her; do not subcontract or assign any obligation; run audits of controls, eligibility and compliance and report the results to the Board periodically and when directed (items 6, 8, 12).
• Independence and control. Avoid conflicts with fiduciaries and their promoters and key managers; publish insiders and holdings; no change of control without the Board's approval (items 9, 10, 11, 13).

The Board can call for information (Rule 4(6)), direct compliance after a hearing (Rule 4(4)), and, in the interests of Data Principals and with written reasons, suspend or cancel registration and give protective directions (Rule 4(5)). From 13 May 2027 a breach can also attract a penalty of up to ₹50 crore under the Schedule's residual item, after an inquiry finds it significant and a hearing (s. 33(1), Schedule item 7). Whether breaches before May 2027 can be penalised is in Open questions.

The independence test, and cap tables

We expect items 9 to 11 of Part B to be where most would-be applicants struggle. Item 10 requires measures so that no conflict arises from directors, key managerial personnel or senior management holding a directorship, financial interest, employment or beneficial ownership in a fiduciary, or having a material pecuniary relationship with one. Item 11 then makes the structure public: insiders, every shareholder above 2%, and every body corporate in which an insider holds more than 2%, as on the first day of the preceding month.

In practice:

• Group-owned ventures. Our view: a consent business set up by a bank, insurer, hospital group or large platform that would also sit on it as a fiduciary has a conflict at the shareholder level (item 9) and usually at the director level (item 10). We expect the Board to question whether item 10 measures can work without structural change, such as a different owner or a holding cap.
• Venture investors. A fund that holds more than 2% of the Consent Manager and board seats in fiduciaries on the same platform will appear in the item 11 disclosures. Its nominee directors may create item 10 conflicts. Term sheets should restrict cross-holdings and nominee roles.
• Independent directors and advisers. Directorships in fiduciaries count, and so do "material pecuniary relationships", which the Rules do not define. Keep a live register and re-check it every month, since the item 11 disclosure is dated to the first of each month.
• Changes later. Because the articles must hard-wire items 9 and 10 and can be changed only with the Board's approval (Part A, item 7), and control cannot change without approval (Part B, item 13), structure has to be right before applying.

Consent Manager or consent software?

The two are easy to confuse. A consent management platform is software an organisation buys to meet its own duties as a fiduciary. A Consent Manager is a registered intermediary that works for the person.

From 13 November 2026 nobody can be a Consent Manager without registration (s. 2(g), s. 6(9)). If a vendor uses the term, ask for its particulars on the Board's website (Rule 4(2)(a)). For choosing consent software, see how to choose a DPDP consent management platform.

If people come to you through a Consent Manager

From 13 May 2027 a person may give, manage, review or withdraw her consent to you through a Consent Manager (s. 6(7)). Your duties stay with you when she does.

• Proof stays with you. If consent is questioned in a proceeding, the fiduciary must prove that notice was given and consent obtained in line with the Act and Rules (s. 6(10)). That burden does not move to the Consent Manager because consent came through it. Keep your own copy of every consent it sends you, with the notice version it carried.
• So does notice. The notice must be "given by the Data Fiduciary" (s. 5(1)), and the Consent Manager records the notices that came with each request (Part B, item 3(b)). Your Rule 3 notice has to travel through its platform intact, in the language she chose (s. 5(3)).
• Withdrawal must reach your systems. A withdrawal through a Consent Manager triggers the same duty to stop, and make your processors stop, within a reasonable time (s. 6(6)).
• Erasure follows. You must erase the data, and make your processors erase what you gave them, unless a law requires you to keep it (s. 8(7)). State bodies are exempt from s. 8(7) (s. 17(4)).
• Rights requests come to you. She makes rights requests to the fiduciary she consented to, using the means you publish (Rule 14(2)). We would accept requests relayed by a Consent Manager acting for her (s. 6(8)), verifying her identity as for a direct request.
• Grievances split by who acted. Complaints about your conduct go to your grievance route; complaints about the Consent Manager's go to its route (s. 13(1)).
• Sharing needs a log. Where she has you share her data with another onboarded fiduciary (Part B, item 1), log it. She can ask you who received her data (s. 11(1)(b)).

What the messages should carry

Nothing is standardised yet; the Board's framework will decide. The field lists below are illustrative, derived from what a Consent Manager must record (Part B, item 3) and what you must be able to prove (s. 6(10)).

Your system should send back an acknowledgement for each, with the time received and, for withdrawals, the time processing stopped.

Terms to ask for when you onboard

• Acknowledgement of every withdrawal, with a stated maximum delivery time and retry rules.
• A test environment and published message formats, with notice of changes.
• Your access to the record of consents and notices concerning your users, for use in a proceeding (s. 6(10)).
• How your notice versions are displayed, and in which languages.
• Incident notice from the Consent Manager to you, in hours.
• What happens to pending messages and records if its registration is suspended or cancelled (Rule 4(5)).
• Fees, if any (see FAQ).

Do you need one? A decision tree

Work down the questions in order. Stop at the first answer that fits.

1. Do you want to run the service yourself, as an independent business that people use to manage consent across organisations? Yes: you are considering becoming a Consent Manager. Read Who can register, check the ₹2 crore net worth and the independence test, and wait for the Board's framework before fixing interfaces. No: go to 2.
2. Are you a fiduciary connected to, or invested in, a company planning to register? Yes: map directorships, holdings above 2% and material pecuniary relationships now (Part B, items 10 and 11). Expect the Board to question whether item 10 measures can work without structural change. No: go to 3.
3. Do people ask you to send their data to other organisations, or do you receive data from others with their consent? Lending, insurance, health records, employment checks and education credentials are typical. Yes: a Consent Manager may become a channel your users expect. Design consent records that can accept consents from outside, and plan to integrate once one is registered in your sector. No: go to 4.
4. Do your users already use a consent or data-sharing intermediary, such as an RBI account aggregator or a consent vendor that says it will register? Yes: ask it whether and when it will apply, which fiduciaries it expects to onboard, and what message formats it will use. If it registers and you are onboarded onto it, your users can manage consent to you through it from 13 May 2027 (s. 6(7)), and its withdrawals trigger your s. 6(6) duty to stop. Our view: even if you are not onboarded, treat any withdrawal it relays as a withdrawal (s. 6(4)). No: go to 5.
5. None of the above. You do not need a Consent Manager. You need your own notices, consent records, withdrawal and rights handling, which a consent management platform or a well-run process provides. Add one rule: any consent or withdrawal arriving through a Consent Manager goes to the DPO.

Most NGOs, CSR foundations, SaaS startups and mid-sized companies end at question 5. Our position: do not let the Consent Manager regime delay the work due on 13 May 2027.

Open questions

These are our positions until the Board, the government or a court says otherwise.

What will the Board's standards and assurance framework contain? Interoperable formats for consent artefacts, security controls, data blindness and audit, we expect. Why: those are what Part A item 9 and Part B items 2, 7 and 12 test. Would change if: the Board publishes the framework. Confidence: low.

Who can certify a platform? Unknown. Why: the Rules require independent certification (Part A, item 9) but name no certifier, accreditation or method, so no application can yet be complete. Would change if: the framework names certifying bodies or criteria. Confidence: low.

Can a breach of Part B committed between 13 November 2026 and 13 May 2027 be penalised? Possibly, after 13 May 2027. Why: s. 27(1)(d) and Rule 4 are in force from November 2026, so the obligation existed when the breach happened; the inquiry procedure (s. 28) and penalties (s. 33, Schedule) start later, and whether they can reach earlier breaches of an obligation then in force is untested. Until May 2027 the Board's certain tools are directions, suspension and cancellation (Rule 4(4)–(5)). Would change if: the Board acts, or a court rules, on the point. Confidence: low. We recommend that a registered Consent Manager treat Part B as enforceable from its first day.

Must a fiduciary accept consent that arrives through a Consent Manager? Probably yes, once you are onboarded; whether you must onboard at all is open. Why: the Act gives the person the option (s. 6(7)) and places no express duty on fiduciaries to join a platform, but refusing to act on her withdrawal through a Consent Manager you deal with would be hard to defend under s. 6(4) and s. 6(6). Would change if: the framework or a case addresses onboarding. Confidence: low.

Does "no subcontracting" stop a Consent Manager using cloud hosting? No, in our view. Why: item 6 of Part B bars subcontracting or assigning "the performance of any of its obligations"; using infrastructure differs from handing over an obligation, though outsourcing the consent service itself would be caught. Would change if: the framework or the Board says otherwise. Confidence: medium.

Who is liable if a Consent Manager fails to pass on a withdrawal? Both may be exposed. Why: the Consent Manager answers for its own obligations (s. 6(8), s. 27(1)(c)); you must stop within a reasonable time once you have the withdrawal (s. 6(6)) and prove consent (s. 6(10)). The Act does not say whether a withdrawal lodged with the Consent Manager counts as received by you. Would change if: the standards fix delivery and acknowledgement rules. Confidence: low.

Is a Consent Manager a Data Fiduciary for its own users' data? Yes. Why: it decides why and how it processes account and record data (s. 2(i)), so it carries ordinary fiduciary duties as well as Part B. Would change if: the Board treats Part B as a complete code for Consent Managers. Confidence: medium.

What to do before 13 May 2027

• Most organisations: take Consent Managers off the critical path. Add one design requirement: consent records must accept consents and withdrawals from an outside channel, and every record keeps the notice version.
• Fiduciaries in data-sharing sectors: name someone to track registrations on the Board's website, and ask your industry body what interface it expects. Budget for an integration in 2027–28, after the May deadline work is done.
• Would-be Consent Managers: confirm net worth and funding, restructure directorships and holdings for items 9 to 11, amend the articles (Part A, item 7) and prepare the item 11 disclosures. Build security and audit to a recognised standard now, and fix interfaces only once the framework appears.
• Investors and boards: check whether any portfolio or group company is a fiduciary that would sit on a Consent Manager you own. See questions a board should ask.
• Everyone: get your own notices and consent right first. See how to write a DPDP notice and the DPDP Act and Rules explained.

How we wrote this guide. We worked from the text of the Digital Personal Data Protection Act, 2023 (No. 22 of 2023), the Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), as corrected by G.S.R. 892(E)), in particular Rule 4 and the First Schedule, and commencement notification G.S.R. 843(E), as published in the Gazette of India. The status of the Board and its framework, and the account-aggregator example, come from the linked sources and our own search of public sources, last checked 25 October 2026. The message fields and onboarding terms are illustrative. Statements marked "our view" or "our position" are our judgement. This guide explains the law; it is not legal advice.