Consent Manager FAQs

A Consent Manager is a person registered with the Data Protection Board of India to enable a Data Principal to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform. It acts on the individual’s behalf and is accountable to that individual.

No. A website’s own consent interface is not, by itself, a registered Consent Manager. The statutory role depends on registration by the Board under section 6(9) and Rule 4.

The framework allows a Data Principal to manage consent through a registered Consent Manager’s platform, including consent given directly to an onboarded Data Fiduciary or routed through another onboarded Data Fiduciary. The Rules illustrate these routes; their availability in a particular service depends on its actual platform and onboarding.

No general requirement to register every Data Fiduciary as a Consent Manager appears in section 6(9) or Rule 4. Registration is for an entity seeking to perform the distinct Consent Manager role. A Data Fiduciary must separately assess its own applicable duties as they commence.

The Gazette notification and Rule 1 set this phase at one year after publication on 13 November 2025, giving a calculated commencement date of 13 November 2026. Section 6(9), section 27(1)(d) and Rule 4 are in this group. Most other operational provisions are in the eighteen-month phase, calculated as 13 May 2027.

An applicant that satisfies Part A of the First Schedule may apply to the Board under Rule 4. The applicant must be a company incorporated in India and meet the Schedule’s technical, operational, financial, governance and independent-certification conditions. The Board decides whether those conditions are met.

Part A of the First Schedule sets a minimum net worth of ₹2 crore for the applicant. The Schedule defines net worth by reference to assets less liabilities in the Consent Manager’s books of account. This is a condition for this regulated role, not a general requirement for Data Fiduciaries.

Part A calls for independent certification against the Board-published data-protection standards and assurance framework, and for appropriate technical and organisational measures. It also requires constitutional provisions and policies addressing the conflict-of-interest obligations in Part B. Applicants should check the Board’s current published framework before relying on a particular certification route.

No. Under Rule 4, the Board may inquire into the application. It registers an applicant if satisfied, or rejects it and communicates the reasons if not satisfied. DPCI does not register or approve Consent Managers.

Rule 4 requires the particulars, information and documents that the Board publishes for this purpose. The statutory conditions point to evidence of incorporation, governance, financial and operational capacity, technical architecture, conflict management and independent platform certification. The exact portal checklist, format and upload limits are administrative instructions: verify them on the Board’s current application portal before submitting.

An applicant should use the Board’s current published registration process and its official portal. The supplied portal screenshots describe identity verification, document upload, acknowledgement and status tracking, but those interface steps can change. DPCI does not accept applications, track their status or issue registration IDs.

Yes. Rule 4 permits the Board to make the inquiry it considers fit to satisfy itself about the Part A conditions. Applicants should respond to any official request through the process specified by the Board.

Part B requires a platform that enables consent management while ensuring the contents of personal data made available or shared are not readable by the Consent Manager. It must use reasonable security safeguards and act in a fiduciary capacity toward the Data Principal.

The platform must record consents given, denied or withdrawn; notices linked to consent requests; and relevant sharing with a transferee Data Fiduciary. It must give the individual access to the record and, on request under its terms, make the information available in machine-readable form. Part B specifies retention for at least seven years, subject to a longer agreed or legally required period.

Part B says a Consent Manager must not subcontract or assign performance of its obligations under the Act and Rules. An applicant should assess its operating model against that exact restriction rather than assuming ordinary vendor outsourcing rules apply.

Part B requires measures to avoid conflicts with Data Fiduciaries and conflicts involving directors, key personnel and senior management. It also requires specified ownership and management disclosures, effective audit mechanisms and prior Board approval before control of the company is transferred.

Rule 4 allows the Board, after an opportunity to be heard, to direct corrective measures. Where necessary in the interests of Data Principals, it may suspend or cancel registration by a reasoned order and give protective directions. Section 27(1)(d) addresses inquiry into a breach of a condition of registration; other inquiry and penalty provisions have a separate commencement schedule.

Part B makes the Consent Manager accountable to the Data Principal. The broader grievance and rights provisions in section 13 and Rule 14, and the related Board complaint process, are in the eighteen-month commencement group calculated as 13 May 2027. Do not read the general Rule 14 response-period provision as already commenced merely because Rule 4 has commenced.