Consent Managers Under the DPDP Act: Who They Are and How Registration Works

Registering as a Consent Manager under India's DPDP Act requires more than a working consent management platform.

Your company must be incorporated in India, have a minimum net worth of ₹2 crore, and obtain independent certification of its platform before the Data Protection Board of India can approve its registration.

You'll also need to meet conditions related to financial stability, management, and data protection. And the requirements don't end with approval. Once registered, your company must maintain consent records, conduct audits, and follow rules on conflicts of interest.

So, what does your company need to qualify, and how does the registration process actually work?

I'll walk you through the eligibility conditions under Rule 4 of the DPDP Rules, 2025, how the Board reviews applications, and the responsibilities you'll take on after registration.

TL;DR – Consent Managers Under the DPDP Act

• Consent Managers are registered intermediaries that help individuals give, manage, review, and withdraw consent across different Data Fiduciaries.
• Using a Consent Manager is not mandatory. Businesses can collect and manage consent directly if they meet the DPDP Act's consent requirements.
• To register as a Consent Manager, a company must be incorporated in India, have a minimum net worth of ₹2 crore, and meet the required financial, technical, and governance conditions.
• Registration is handled by the Data Protection Board of India under Rule 4 of the DPDP Rules, 2025.
• After registration, Consent Managers must maintain consent records, protect personal data, undergo audits, handle grievances, and avoid conflicts of interest.
• Rule 4 takes effect on November 13, 2026. This is when the Consent Manager registration rules come into effect, not a deadline for companies to register.

What Is a Consent Manager Under the DPDP Act?

Under Section 2(g) of the DPDP Act, 2023, a Consent Manager is a person registered with the Data Protection Board of India who acts as a single point of contact for individuals to give, manage, review, and withdraw consent.

Although the Act uses the word person, the DPDP Rules, 2025, require an applicant to be a company incorporated in India. Once registered, that company provides a platform where individuals (Data Principals) can manage consent given to different organizations (Data Fiduciaries).

For example, suppose you've given consent to a bank, an insurance company, and a financial services app to use your personal data. Normally, you would need to check each company's website or app to review or withdraw your consent. 

But if all three organizations are connected to the same registered Consent Manager, you can use its platform to:

• See the consent you've given to each organization.
• Review the notices associated with those consent requests.
• Withdraw consent from one organization without withdrawing it from the others.
• Access records of your consent decisions.

The Consent Manager communicates these decisions to the relevant organizations. It must also maintain the required consent records and ensure it cannot read the personal data shared through its platform.

The key difference is who the Consent Manager serves. A regular consent management platform helps a business collect and record consent from its users. A registered Consent Manager acts on behalf of the individual and has a legal duty to act in their interests.

To become a registered Consent Manager, a company must meet the eligibility and registration conditions under Rule 4 and the First Schedule of the DPDP Rules, 2025.

Are Consent Managers Mandatory Under the DPDP Act?

No. The DPDP Act, 2023, does not require every Data Fiduciary to use a registered Consent Manager. Businesses can collect, record, manage, and manage consent directly without registering as a Consent Manager or using one.

For example, if you run an e-commerce website, you can ask customers for consent through your own website or app. You do not need to connect with a registered Consent Manager just to collect that consent.

However, you must still meet the DPDP Act's consent requirements. Consent must be free, specific, informed, unconditional, and unambiguous, and given through a clear affirmative action. Individuals must also be able to withdraw consent. The distinction is important:

• For Data Fiduciaries: Using a registered Consent Manager is optional. They remain responsible for meeting the Act's consent requirements.
• For individuals (Data Principals): Using a Consent Manager is optional. They can manage consent directly with the Data Fiduciary.
• For companies offering registered Consent Manager services: Registration with the Data Protection Board of India is required under Rule 4 of the DPDP Rules, 2025.

So, registration is mandatory if a company wants to operate as a Consent Manager, but using a Consent Manager is not mandatory for every business collecting personal data.

Who Can Register as a Consent Manager in India?

Under Rule 4 and Part A of the First Schedule of the DPDP Rules, 2025, only companies incorporated in India can apply to become registered Consent Managers. To qualify, a company must meet these conditions:

• Registered in India: The company must be incorporated in India.
• Minimum net worth: It must have a net worth of at least ₹2 crore.
• Financial capacity: It must have enough funds to run and maintain its services.
• Technical capacity: It must have the technology and resources needed to manage consent and protect personal data.
• Suitable management: The company's directors and key management personnel must meet the required fit-and-proper conditions. 
• Independent certification: The company must obtain independent certification confirming that its platform meets the required standards for interoperability and data protection.
• Company documents: Its Memorandum and Articles of Association must include provisions requiring it to follow the Consent Manager rules.

Meeting these conditions does not mean automatic registration. The Data Protection Board of India must review the application and approve it.

How to Register as a Consent Manager Under the DPDP Rules

Rule 4 of the DPDP Rules, 2025, explains how a company can apply for registration as a Consent Manager with the Data Protection Board of India. The process involves the following steps.

1. Check the Eligibility Requirements

Before applying, the company must meet the conditions in Part A of the First Schedule. These include Indian incorporation, a minimum net worth of ₹2 crore, sufficient financial and technical capacity, suitable management, and independent certification of its platform.

2. Prepare the Required Documents

The company must prepare the details and supporting documents required by the Board. Under Rule 4(1), the Board may publish these requirements on its website.

3. Submit the Application to the Board

Once the company meets the eligibility conditions, it can apply to the Data Protection Board of India under Rule 4(1). The application must include the details and supporting documents specified by the Board.

4. The Board Reviews the Application

Under Rule 4(2), the Board may conduct an inquiry to check whether the applicant meets the registration conditions in Part A of the First Schedule.

5. The Board Approves or Rejects Registration

If the Board is satisfied, it registers the company as a Consent Manager, informs the applicant, and publishes its details on the Board's website. If the Board rejects the application, it must communicate the reasons for rejection to the applicant.

Important: Rule 4 sets out the legal registration process but leaves the exact application details and supporting document requirements to be published by the Board.

What Are the Responsibilities of Registered Consent Managers?

Under Part B of the First Schedule of the DPDP Rules, 2025, registered Consent Managers must meet the following requirements.

1. Act in the individual's interests - Consent Managers must act in a fiduciary capacity toward Data Principals and avoid conflicts of interest with Data Fiduciaries.
2. Allow individuals to manage consent - They must provide an interoperable platform where individuals can give, review, manage, and withdraw consent.
3. Protect personal data - They must ensure they cannot read personal data shared through their platform and maintain the required security measures.
4. Maintain consent records - They must keep consent, notice, and data-sharing records for at least seven years, or longer if agreed with the individual or required by law. Individuals must be able to access these records.
5. Conduct audits - They must audit their security measures and compliance with registration conditions and the Rules, and report the findings to the Board.
6. Handle complaints - They must provide a grievance system and publish a response period of no more than 90 days.
7. Follow business restrictions - They cannot subcontract or assign their Consent Manager obligations. They must also obtain prior Board approval before transferring control of the company.
8. Disclose company information - They must publish the required details about promoters, directors, key management personnel, senior management, and specified shareholdings.

If a Consent Manager fails to meet these obligations, the Data Protection Board of India can take action, including suspending or cancelling its registration.

What Happens If a Consent Manager Violates the DPDP Rules?

Under Rule 4 of the DPDP Rules, 2025, the Data Protection Board of India can take the following actions against a Consent Manager that violates its obligations.

1. Conduct an inquiry - The Board can investigate violations and ask the Consent Manager for information about its compliance.
2. Order corrective action - After giving the Consent Manager an opportunity to be heard, the Board can direct it to correct violations within a specified period.
3. Suspend or cancel registration - If necessary to protect Data Principals, the Board can suspend or cancel registration after giving the Consent Manager an opportunity to be heard and recording its reasons in writing.
4. Impose financial penalties - Under Section 33 and item 7 of the DPDP Act's Schedule, penalties of up to ₹50 crore may apply to violations covered by the general penalty category. The Board must first determine that a significant breach occurred after an inquiry. These monetary penalty provisions are scheduled to take effect in May 2027.

Consent Manager vs. Consent Management Platform

Consent Managers are often confused with Consent Management Platforms (CMPs) because both deal with consent. For example, your business may already use a CMP to show cookie banners, collect marketing permissions, save consent records, or let users change their privacy choices. But that does not make the CMP a Consent Manager under the DPDP Act.

A CMP works for the business collecting personal data. It helps that business collect and manage consent from its own users.

A registered Consent Manager works for the individual giving consent. It gives a Data Principal one place to manage consent across different Data Fiduciaries participating in its platform.

For example, if you give consent separately to a bank, an insurer, and a financial app, each business may use its own CMP to manage the consent it collects from you.

But if those businesses participate in the same registered Consent Manager, you can use that Consent Manager to review and withdraw your consent across them from one place.

The key difference is simple. A CMP helps a business manage the consent it receives. A registered Consent Manager helps an individual manage the consent they give.

Conclusion

Consent Manager registration is meant for a specific type of company. If you simply collect consent from your own customers, you do not need to register as one.

But if you want to give individuals a single place to manage consent across different Data Fiduciaries, registration under Rule 4 is required. And once registered, the responsibilities continue beyond getting the Board's approval.

For businesses that are focused on meeting their own DPDP requirements instead, IQWorks can help manage the work behind compliance, including RoPA, DSRs, assessments, risks, approvals, and controls.

You can explore IQWorks if you want to bring that work into one place instead of managing it across separate documents and processes.

Frequently Asked Questions

1. What is a Consent Manager under the DPDP Act?

A Consent Manager is a person registered with the Data Protection Board of India that acts as a single point of contact for Data Principals to give, manage, review, and withdraw consent. Under the DPDP Rules, an applicant for registration must be a company incorporated in India.

2. Is it mandatory for businesses to use a Consent Manager?

No. Data Fiduciaries can collect and manage consent directly as long as they meet the consent requirements of the DPDP Act. Using a registered Consent Manager is optional.

3. What is the minimum net worth required to register as a Consent Manager?

A company applying to become a Consent Manager must have a minimum net worth of ₹2 crore, along with the other conditions listed in Part A of the First Schedule of the DPDP Rules, 2025.

4. Who registers Consent Managers in India?

The Data Protection Board of India handles Consent Manager registration under Rule 4 of the DPDP Rules, 2025.

5. Does a Consent Manager need independent certification?

Yes. The applicant must obtain independent certification confirming that its platform meets the required standards for interoperability and data protection.