A Consent Manager is a registered intermediary that lets a person handle consent for many organisations from one place. Sec. 2(g) of the DPDP Act defines it as a person registered with the Data Protection Board who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform.
It is a role the Act provides for and requires to be registered with the Board. It is not a feature of a website, and not the same thing as the consent banner on one. The sections below cover what it does for the person, what it means for a Data Fiduciary that receives consent through one, and how it differs from the consent software most companies will use.
What the Act says a Consent Manager does
Three sub-sections of Sec. 6 build the role.
- Sec. 6(7): the Data Principal may give, manage, review or withdraw her consent to the Data Fiduciary through a Consent Manager. The verb is "may". It is her choice.
- Sec. 6(8): the Consent Manager is accountable to the Data Principal and acts on her behalf, in the manner and subject to the obligations the Rules prescribe.
- Sec. 6(9): every Consent Manager must be registered with the Board, subject to the technical, operational, financial and other conditions the Rules prescribe.
The point to hold on to is direction. A Data Fiduciary asks for consent; a Consent Manager sits with the person being asked. Rule 4 and the First Schedule then supply the detail Sec. 6(8) and 6(9) left to the Rules.
How it works for a Data Principal
The First Schedule, Part B, item 1, describes the mechanism. A Consent Manager enables a Data Principal using its platform to give consent to processing of her personal data by a Data Fiduciary onboarded onto the platform. She can give it directly to that Data Fiduciary, or through another Data Fiduciary onboarded onto the platform that holds the data with her consent.
The Rules' own illustration involves two banks. A bank, B1, asks the person through the platform for consent to process data in her bank statement. She can give it directly to B1, or she can route it through B2, where she banks, while instructing B2 to send the statement to B1.
The Consent Manager must keep a record of consents given, denied or withdrawn and give her access to it, retained for at least seven years (Part B, items 3 and 4). The data passes through in a way its contents are not readable by the Consent Manager (item 2).
She also keeps a grievance route. Rule 14(3) requires every Data Fiduciary and Consent Manager to publish a grievance response period of no more than ninety days.
How it works for a Data Fiduciary
For a Data Fiduciary, a Consent Manager is a channel through which valid consent can arrive. You need to be onboarded onto the Consent Manager's platform, and your requests then appear on the person's interface.
It changes less than people expect. Sec. 5 still requires a notice to accompany or precede every request for consent, and Sec. 6(1) still sets the standard for what valid consent is. The Consent Manager's record also keeps the notice (Part B, item 3(b)), which helps with Sec. 6(10): where consent is the basis of processing and a question arises in a proceeding, the Data Fiduciary must prove that notice was given and consent obtained. The Act does not say the Consent Manager's record discharges that burden for you, so keep your own as well.
Withdrawal through a Consent Manager is still withdrawal under Sec. 6(4). Sec. 6(6) then requires you to cease processing, and to cause your Data Processors to cease, within a reasonable time. A withdrawal that reaches you by this route has to be honoured the same way as one made in your own interface. See DPDP consent requirements for what valid consent has to contain.
What makes it an intermediary and not a vendor
Part B of the First Schedule requires a Consent Manager to act in a fiduciary capacity towards the Data Principal (item 8) and to avoid conflicts of interest with the Data Fiduciaries it serves (items 9 and 10). The full list of conditions, and how registration, supervision and cancellation work, is in the registration guide.
Rule 4 comes into force on 13 November 2026 (Rule 1(3)), while most duties come into force on 13 May 2027. Rule 4(1) has applicants furnish the particulars and documents the Board publishes on its website, so the process opens once the Board publishes them. This is worth rechecking after 13 November 2026.
A Consent Manager is not a consent management platform
The two get confused because the names overlap.
- A consent management platform (CMP) is software a Data Fiduciary uses itself: notices, consent capture per purpose, withdrawal, records. It is the Fiduciary's tool for meeting its own Sec. 5 and Sec. 6 duties. It needs no registration.
- A Consent Manager is a separate registered entity that works for the Data Principal across several Fiduciaries and is accountable to her under Sec. 6(8).
MyConsent+ is a consent management platform for Data Fiduciaries; it is not a registered Consent Manager. Most organisations need a CMP and nothing else, since using a Consent Manager is optional for the individual and only a Fiduciary that chooses to join one onboards onto its platform. The consent manager module shows what a CMP does, and the Act explained from the start covers where this role fits.