Consent managers under DPDP: meaning, how it works in India

A consent manager is an intermediary that sits between the person whose data is used and the companies that use it. The person can open one app or dashboard, see which companies have asked for data and withdraw permission where they wish. The law calls the person the data principal and the company a data fiduciary.

The idea is to save people from clicking consent boxes on every website and app, and to give them a record they can check. The Act describes a consent manager as a person who acts on behalf of the data principal, and says that it is accountable to that person, not to the companies it connects.

The Act, in section 6, lets a data principal give, manage, review or withdraw consent through a consent manager who is registered with the Data Protection Board. It states that the consent manager is accountable to the data principal and acts on the principal's behalf, and that it must follow the manner of registration and obligations set in rules.

The Act does not force any company to use a consent manager. A fiduciary can still collect consent directly. The consent manager is an optional layer, which a user can choose to use.

The DPDP Rules 2025 say a consent manager must apply to the Data Protection Board and meet conditions in the First Schedule. According to law-firm summaries, the main conditions are that the applicant is a company incorporated in India, has sound financial and operational capacity, and has a minimum net worth of ₹2 crore. Its directors, key managers and senior staff must be fit and proper, and its business volume and prospects must look adequate.

The Board can ask questions before it decides, and it can suspend or cancel a registration if the conditions are no longer met. The provisions for consent manager registration start about 12 months after the Rules were notified, so as of November 2026 they are at or just past their start date. Details of the application process may come in later Board notices.

• Applicant: a company incorporated in India.
• Capacity: sound technical, operational and financial strength.
• Net worth: at least ₹2 crore, according to law-firm summaries.
• People: fit and proper directors and senior management.
• Process: apply to the Data Protection Board, which may inquire before registering.

The Rules put continuing duties on a consent manager. It must keep records of consents given, denied or withdrawn, and of notices and certain data sharing, and make them available to the data principal. It must run an interoperable platform, so that a user can deal with many companies in one place, and it must act without conflict with the interests of the principal.

A consent manager is meant to be a neutral channel. It should not use the information it sees for its own gain beyond the service. Summaries mention rules on independence, security and audits. Read the Schedule for the exact text, since duties are detailed.

They are related ideas, but they are different legal systems. An account aggregator is a type of non-bank finance company licensed by the Reserve Bank of India (RBI) to move financial data between banks, lenders and other regulated entities with the customer's consent. A DPDP consent manager is registered with the Data Protection Board and covers consent for personal data in any sector.

A company could in principle do both, but each registration has its own conditions. As of November 2026, no source consulted for this guide explained in detail how the two regimes will interact, so founders should wait for further guidance or take legal advice.

Every company that processes personal data in India will need a way to record consent, and many users will want one dashboard for it. A consent manager can sell to users for free and earn from fees paid by fiduciaries, or from related services such as audit trails and compliance dashboards. This is similar to the business model of account aggregators, which charge the institutions that use the data.

The business has hurdles. It must reach scale, because a dashboard that few companies join is not useful. It must also earn trust, because the data it holds is sensitive. Because the law makes use optional, adoption depends on regulators, large platforms and the cost savings for fiduciaries.

A user would sign up with a consent manager, link the companies they deal with and see a list of the permissions given. When a new app asks for data, the request would appear on the dashboard, and the user can approve, refuse or set limits. If the user later changes their mind, a single action withdraws consent, and the consent manager passes the withdrawal to the company.

The company then has to stop using the data for that purpose, unless another legal basis allows it. The consent manager keeps a record of what was asked, what was agreed and when. This log helps both sides, since the company can show proof of consent and the user can see proof of what was shared.

For users, the main risk is trust. The consent manager sees a map of who holds their data, which is sensitive in itself. The Rules therefore stress independence, security and clear records. A user should check who owns the consent manager and how it earns its money.

For companies, the risks are integration cost and duplicated work. A company may still need its own consent records, since it remains responsible under the Act. Using a consent manager does not move that responsibility away. Whether the extra layer reduces cost depends on how many users adopt it.

A headline that says a company will become a consent manager is not the same as saying it is registered. Look for confirmation from the Data Protection Board, and check the dates, since provisions began in phases. A news story about a pilot is not a launch.

This guide is general information and not legal advice. Registration conditions and the Board's procedures can change, so check the current notifications or take professional advice.