The DPDP Rules create a new kind of regulated company: a Consent Manager, registered with the Board, through which individuals can give and withdraw consent across many services. This note explains the registration conditions, the operating duties, the liability gap the law leaves open, and the contract terms that close it.
What a Consent Manager is
A Consent Manager is a company registered with the Data Protection Board that acts as a single point of contact through which an individual can give, manage, review and withdraw consent to the processing of her personal data.[1] It is accountable to the individual and acts on her behalf.[2] It is not a Data Processor working for a business; it is a separate category with its own duties. The model is borrowed from the RBI’s Account Aggregator framework, which puts a regulated, blind intermediary between an individual and the institutions holding her financial data.[3]
Rule 4, which starts on 13 November 2026, sets out how registration works. The Board checks the application, can ask for more information, grants or refuses registration, publishes the register, and can suspend or cancel a registration after a hearing.[4] Nothing obliges a business to integrate with a Consent Manager or an individual to use one.
Who can register
An Indian company with a net worth of at least ₹2 crore, sound finances and management, adequate technical and operational capacity, and directors and senior managers with a reputation for fairness and integrity. Its constitutional documents must contain provisions to prevent conflicts of interest with the businesses it deals with, and those provisions cannot be changed without the Board’s approval. Its platform must be independently certified against technical standards the Board publishes. Its operations must be in the interests of individuals.[5]
[1] Digital Personal Data Protection Act, 2023 (“the Act”), s. 2(g) and s. 6(7).
[2] Act, s. 6(8).
[3] Reserve Bank of India, Master Direction – Non-Banking Financial Company – Account Aggregator (Reserve Bank) Directions, 2016.
[4] Digital Personal Data Protection Rules, 2025 (“the Rules”), r. 4; r. 1(2) (in force twelve months after publication).
[5] Rules, First Schedule, Part A.
Two of those conditions cannot be met today. The certification is against standards the Board has not published, because the Board has no members. The lock on the constitutional documents needs the Board’s approval, which cannot be sought. An applicant can prepare everything else by November and should, but the register will open in substance only when the Board is constituted and has issued its standards.
What a Consent Manager must do
Let individuals give consent to a business, including consent for one business to share their data with another. Ensure the personal data passing through its platform cannot be read by it. Keep records of every consent given, refused, changed or withdrawn, of the notices attached to each, and of every data sharing, and keep them for seven years. Give the individual access to those records in machine-readable form. Run a website or app as its main channel. Not subcontract its duties. Take reasonable security measures. Act in a fiduciary capacity to the individual and avoid conflicts with businesses. Publish the names of its promoters, directors, senior managers and significant shareholders. Audit itself and report the audits to the Board. Not change control without the Board’s approval.[1]
The rule that the Consent Manager cannot read the data is the centre of the design. It records the fact and scope of consent and passes it on. It never sees what is consented to.
The gap the law leaves
The Act makes the business responsible for lawful processing, whatever any contract says.[2] It makes the Consent Manager accountable to the individual. It does not say what happens when the Consent Manager’s record is wrong: it shows consent that was never given, or shows consent as still valid after it was withdrawn, and the business processes data in reliance on it.
On the text, the business is exposed to the Board for processing without consent. The Consent Manager is exposed for breaching its record-keeping duties and may lose its registration. The business that has been penalised has no statutory route to recover from the Consent Manager. Recovery depends entirely on the contract. That is why the terms below are not optional.
What a business should require
A warranty that the Consent Manager is registered, with an obligation to notify any Board action against it within twenty-four hours. A precise specification of the consent record: fields, timestamp, identifier, the notice version attached, and the format in which the business can retrieve it as evidence. A withdrawal-transmission commitment measured in minutes, with the Consent Manager bearing the consequence of any processing that happens after withdrawal but before it told the business. An indemnity for loss, including regulatory penalties, caused by an inaccurate record. Audit rights, and copies of the audit reports sent to the Board. Advance notice of any change of control. An exit clause delivering the full consent record to the business if the registration is suspended or cancelled. A warranty that the
[6] Rules, First Schedule, Part B.
[7] Act, s. 8(1).
platform cannot read personal data. A ban on any fee structure tied to how many consents are obtained, which would create exactly the conflict the Rules prohibit. Indian law and Indian courts for contractual disputes.
A Consent Manager will resist the indemnity, the timing commitment and the audit right. The answer is the same each time: the business carries the legal exposure, the Consent Manager carries the record, and the contract is the only thing connecting them.
What a Consent Manager should require
The business must warrant that every notice it submits meets Rule 3, because the Consent Manager records the notice and cannot fix it. The business must pass on any withdrawals it receives directly, so the record stays complete. The business must indemnify for loss caused by a defective notice or an unlawful purpose. And the business must accept that the Consent Manager’s duty runs to the individual and will be performed even when the business would prefer otherwise.
The market
There is no obvious revenue model. A Consent Manager cannot charge by consent outcomes, cannot monetise data it cannot read, and must fund a seven-year evidentiary record and a Board-reported audit function. Adoption will likely come from institutional participation, as it did with Account Aggregators, and from the fact that an individual who chooses to give consent only through a Consent Manager forces the business to integrate or lose the customer. Financial services and health will move first.
The open questions
Whether the Board will treat a Consent Manager’s record as conclusive proof of consent, or only as evidence. Whether a Consent Manager, which holds identifiers and consent records, is itself a Data Fiduciary for that limited data; the better view is that it is. And what technical standard the Board will set for interoperability, which cannot be known until the Board exists. The contract terms above are written to hold whichever way each is answered.
This note is published for general information. It states the position as understood on the date shown and is not legal advice. It does not create a lawyer–client relationship and is not an invitation to engage the firm.
