Every time someone opens a banking app, shops online, books a healthcare appointment or signs up for a digital service, personal data becomes part of that interaction.

For businesses, managing this information responsibly is no longer just about securing databases or publishing a privacy policy. It also means understanding what data is being collected, why it is being processed and whether individuals have genuinely agreed to that processing.

This is where India's Digital Personal Data Protection Act, 2023 (DPDP Act) comes into the picture.

The Act introduces a framework that places individuals at the centre of their personal data rights while establishing clear responsibilities for organisations processing digital personal data.

One of the important provisions within this framework is the concept of a DPDP Consent Manager.

Although the term is gaining attention among business leaders, compliance teams and privacy professionals, there is still considerable confusion about what a Consent Manager actually does, how it differs from a conventional consent management platform and who can register as one.

Let's break it down.

In plain terms, a DPDP Consent Manager is an independent, government-registered entity that works on behalf of individuals, not businesses, to help them give, review, manage, and withdraw consent over their personal data.

Section 2(g) of the DPDP Act, 2023 defines a Consent Manager as a person registered with the Board who acts as a single point of contact for Data Principals to manage their consent.

To understand its role, it helps to know two important terms:

• Data Principal: The individual to whom the personal information relates.

• Data Fiduciary: The organisation or person who determines the purpose and means of processing personal data.

Traditionally, individuals have had to visit different websites, applications or privacy portals to understand how their information is being used and manage their consent preferences.

A registered Consent Manager aims to simplify this experience.

Through a single platform, individuals can manage consent across multiple organisations onboarded onto that platform, without having to navigate separate consent interfaces for every interaction.

Think of it as a central point through which individuals can exercise greater control over their personal data and the permissions they have granted.

The terms Consent Manager and Consent Management Platform (CMP) may sound similar, but they serve different purposes.

A Consent Management Platform is generally a software solution used by businesses to collect, store and manage user preferences. Common examples include cookie banners, consent pop-ups, preference centres and opt-in checkboxes.

A DPDP Consent Manager, on the other hand, is a statutory role recognised under the DPDP Act. It must fulfil the prescribed eligibility criteria and obtain registration from the Data Protection Board of India.

Here's how they differ:

In short, a CMP is a business-facing technology solution, whereas a registered DPDP Consent Manager is an independent, regulated intermediary designed to facilitate consent management in the interests of individuals.

The two are not interchangeable, and businesses should understand this distinction when planning their DPDP compliance approach.

A Consent Manager does more than provide individuals with a place to view their preferences. The DPDP Act and the First Schedule of the DPDP Rules, 2025 establish specific responsibilities for registered Consent Managers.

Let's look at the key functions.

1. Enable the Complete Consent Lifecycle

A Consent Manager must provide individuals with the ability to give, manage, review and withdraw consent through its platform.

This gives individuals greater visibility into the permissions they have granted and allows them to make changes as their preferences evolve.

For example, an individual may initially agree to share certain information with a financial services provider but later decide to withdraw that permission. The Consent Manager facilitates this process and communicates the relevant decision through the platform.

2. Maintain a Data-Blind Consent Framework

One of the important safeguards under the DPDP Rules is that a Consent Manager must ensure that the contents of personal data being made available or shared are not readable by it.

This means the Consent Manager facilitates the consent process and the associated sharing of information without being able to read the underlying personal data being shared.

The objective is to ensure that individuals can manage consent without exposing their personal information unnecessarily to the intermediary.

3. Act in a Fiduciary Capacity

A registered Consent Manager must act in a fiduciary capacity towards the Data Principal.

In practical terms, its responsibilities must be aligned with the individual's interests.

The Rules also require Consent Managers to avoid conflicts of interest with Data Fiduciaries, including conflicts arising through promoters, directors and key managerial personnel.

This is particularly important because individuals must be able to trust that the entity managing their consent is not compromising their interests in favour of the organisations processing their data.

4. Maintain Consent and Data-Sharing Records

Consent Managers must maintain records of:

• Consent given, denied or withdrawn by individuals.

• Notices provided before or along with consent requests.

• Instances where personal data is shared with another Data Fiduciary.

Individuals must be able to access these records through the platform. The Consent Manager must also make the information available in machine-readable form when requested, in accordance with its terms of service.

The First Schedule requires these records to be maintained for at least seven years or longer where agreed or required by law.

5. Provide Grievance Redressal

Consent Managers must establish an effective grievance redressal mechanism through which individuals can raise concerns and seek assistance.

The DPDP Rules require the grievance redressal system to provide for responses within a reasonable period not exceeding 90 days.

This gives individuals a formal channel to address issues relating to consent management and the services provided by the Consent Manager.

6. Ensure Security, Transparency and Periodic Audits

Consent Managers must implement reasonable security safeguards to prevent personal data breaches.

They are also required to disclose relevant information about their promoters, directors, key managerial personnel, senior management and specified shareholding interests.

In addition, they must establish effective audit mechanisms to periodically review their technical and organisational controls, continued eligibility for registration and adherence to their regulatory obligations.

These requirements are intended to support accountability and maintain confidence in the Consent Manager framework.

Registration is not open to every entity. Under Part A of the First Schedule of the DPDP Rules, 2025, strict eligibility criteria apply:

• Indian incorporation: The applicant must be a company incorporated in India.

• Minimum net worth: The company must have a net worth of at least ₹2 crore.

• Technical and operational capacity: It must demonstrate sufficient technical, operational and financial capability to fulfil its responsibilities.

• Sound financial position: Its financial condition and general management must be sound.

• Management integrity: Directors, key managerial personnel and senior management must have a general reputation and record of fairness and integrity.

• Adequate business and financial prospects: The expected volume of business, capital structure and earning prospects must be adequate.

• Independent certification: The proposed interoperable platform must be independently certified as meeting the data protection standards and assurance framework published by the Board, along with the required technical and organisational measures.

• Governance safeguards: The company's constitutional documents must include provisions supporting specified regulatory obligations and conflict-of-interest safeguards.

The Board will assess the application and may conduct an inquiry before deciding whether to grant registration.

Does every business need to register as a Consent Manager?

No. The DPDP Act does not mandate every organisation to register as or engage a Consent Manager.

Businesses can manage consent directly, provided they comply with the applicable requirements of the Act and Rules.

However, organisations with large customer bases, multiple digital services or complex consent requirements may evaluate integration with a registered Consent Manager as part of their broader privacy and compliance strategy.

The Data Protection Board of India (DPBI) oversees registration under Rule 4 of the DPDP Rules, 2025.

Step 1: Confirm Eligibility: Verify that your company meets all Part A conditions, incorporation status, net worth, technical capability, and governance standards.

Step 2: Build Your Platform: Your consent management system must meet the data protection standards and assurance framework published by the Board. It must be interoperable, accessible, and capable of handling consent artefacts securely.

Step 3: Compile Documentation: Assemble corporate documents, financial records, technical certifications, director details, and governance evidence.

Step 4: Submit Application: File through the Board's published process once the portal is live. The Board will review, raise queries if needed, and issue registration upon satisfaction.

Step 5: Maintain Ongoing Compliance: Registration is not a one-time milestone. Registered Consent Managers are subject to ongoing obligations under Part B of the First Schedule, including periodic audits and transparency reporting.

India's DPDP framework is rolling out in phases. Understanding these timelines is important for organisations planning their privacy programmes, consent infrastructure and regulatory readiness.

Here's where things stand:

The registration framework and the wider compliance requirements therefore have different commencement dates.

For organisations planning to become Consent Managers, November 2026 is an important milestone. For other businesses, May 2027 is a significant date for preparing to meet the broader requirements of the DPDP framework.

However, preparation should not begin only when the deadlines approach. Reviewing existing data practices, consent mechanisms, privacy notices and governance processes takes time, particularly for organisations with complex digital operations.

Even if you don't plan to become a Consent Manager, the framework directly affects how you collect and handle user data.

The impact can be understood from two perspectives.

For organisations working with a registered Consent Manager:

Businesses that choose to work with a registered Consent Manager may benefit from:

• Simplified Consent Workflow: Compliance, consent collection, artefact generation, and withdrawal handling are managed through the Consent Manager's infrastructure.

• Better Consent Visibility: Individuals can review their permissions and manage their preferences through a central interface.

• Easier Audit Readiness: Standardised, tamper-proof consent records reduce the documentation burden.

• Reduced Duplication: Users across your ecosystem don't need to re-consent for every touchpoint.

• Greater transparency: A clear mechanism for managing consent can help organisations demonstrate accountability to individuals.

• Trust Signal: Partnering with a regulated intermediary demonstrates accountability to users and regulators.

Remember that integration does not remove a Data Fiduciary's responsibilities under the DPDP Act.

For organisations managing consent directly:

Businesses that manage consent through their own platforms must ensure that their processes meet the applicable legal requirements.

• Ensure your consent management system meets the DPDP Act's requirements for informed, specific, freely given, and unambiguous consent.

• Every notice must clearly state the purpose, categories of data being processed, and the individual's rights.

• Withdrawal must be possible at any time, without any consequence to service access.

• Establishing processes to address Data Principal requests and grievances.

The focus should be on making consent meaningful rather than treating it as a formality during registration or onboarding.

Consent management in banking and fintech: The RBI's Account Aggregator framework already facilitates consent-based financial data sharing. The DPDP Consent Manager framework is the broader ecosystem layer that extends similar principles across all sectors, not just finance.

As digital services become part of everyday life, individuals increasingly share personal information across multiple platforms, applications and service providers.

This creates a practical challenge: how can individuals keep track of the permissions they have granted, and how can businesses ensure that consent is obtained and managed responsibly?

The DPDP Consent Manager framework is one of the mechanisms introduced to address this challenge.

By creating a common, interoperable approach to consent management, the framework aims to give individuals greater control over their personal data while supporting transparency and accountability across the digital ecosystem.

For businesses, it also brings an important shift in perspective. Consent should not be viewed as a one-time checkbox or an isolated compliance activity. It needs to be supported by clear processes, appropriate technology, reliable records and ongoing governance.

The organisations that take this seriously now, before the May 2027 enforcement deadline, will be the ones who turn compliance into competitive advantage.

Under Section 6 of the DPDP Act, 2023, establishes the conditions for valid consent:

• Free: no coercion, no bundled opt-ins disguised as service conditions.

• Specific: tied to a defined purpose, not a blanket agreement.

• Informed: the user must know exactly what they're agreeing to

• Unconditional: cannot be a precondition for service unless the data is genuinely necessary.

• Unambiguous: signified through a clear, affirmative action: a click, a toggle, a tick.

Vague, pre-ticked, or inferred consent has no legal standing under this law.

The DPDP Consent Manager is one of the most innovative elements of India's data protection architecture. It positions individuals, not organisations, at the Centre of data relationships. For businesses navigating this landscape, understanding the difference between a statutory Consent Manager and a general consent management platform, knowing the registration requirements, and planning around the compliance timeline isn't optional; it's foundational.

Data privacy in India is no longer a checkbox. It's a trust framework. That means building systems and practices that respect individual choices and create confidence in how personal information is handled. And the organisations that build on it early will be better positioned, legally, operationally, and reputationally, than those who treat it as a last-minute obligation.

At 63SATS Cybertech, this broader approach to data protection is central to helping organisations navigate the evolving privacy landscape. From DPDP readiness assessments and personal data mapping to consent governance and privacy compliance, the focus remains on helping businesses understand their gaps and build practical, sustainable data protection frameworks.

Preparing for the DPDP era begins with understanding where your organisation stands today.