Registering as a Consent Manager under the DPDP Act: What Applicants Need to Know

Introduction

From 13 November 2026, companies can apply to the Data Protection DPB of India (“DPB”) to register as Consent Managers. On that date, Rule 4 and the First Schedule of the Digital Personal Data Protection Rules, 2025 (the “Rules”) come into force, together with Section 6(9) of the Digital Personal Data Protection Act, 2023 (the “Act”).

Key Terms

• Data Principal means the individual to whom the personal data relates, as defined in Section 2 of the Act.

• Data Fiduciary means any person who, alone or in conjunction with others, determines the purpose and means of processing personal data.

• Data Processor means any person who processes personal data on behalf of a Data Fiduciary.

• 
  

  MoA and AoA mean the memorandum of association and the articles of association of the respective company.

Who is a Consent Manager?

Section 2(g) of the Act defines “Consent Manager” as a person registered with the DPB, and “who acts as a single point of contact enabling a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform.”

A Consent Manager is an intermediary which is retained by a Data Fiduciary, and is required to act on behalf of the Data Principals. As per Section 6(7) of the Act, a Data Principal may give, manage, review or withdraw consent to a Data Fiduciary through a Consent Manager. The keyword is “may”. Data Fiduciaries are not obliged to use Consent Managers, and can continue to collect consent directly.

Section 6(9) requires every Consent Manager to be registered with the DPB, subject to the conditions prescribed in the Rules.

How to Apply for Registration?

Under Rule 4(1), a person who fulfils the conditions in Part A of the First Schedule may apply to the DPB for registration as a Consent Manager. The application must include the particulars, information and documents that the DPB publishes on its website.

Applicants have to satisfy the conditions laid down in Part A of the First Schedule of the Rules.

Item	Condition	What it means in practice
1.	Company incorporated in India	Sole proprietorships, limited liability partnerships (“LLP”), partnership firms, trusts and foreign companies are not eligible to apply.
2.	Sufficient technical, operational and financial capacity to fulfil its obligations as a Consent Manager	The DPB may look for evidence on each limb, such as technical architecture, staffing and operational processes, and financial resources.
3.	Sound financial condition and general character of management	This is a qualitative test, and the DPB’s inquiry may therefore go beyond document checks.
4.	Net worth of at least ₹2 crore	The Rules define “net worth” as the aggregate value of total assets, reduced by the value of liabilities of the Consent Manager, as appearing in its books of accounts.
5.	Adequate likely volume of business, capital structure and earning prospects	A business plan with credible projections of likely business volumes, the proposed capital structure and expected earnings consistent with the financial capacity and net worth shown under items 2 and 4 can be submitted.
6.	Directors, key managerial personnel and senior management with a general reputation and record of fairness and integrity	Declarations for each director, key managerial personnel and senior management can be submitted along with the application.
7.	MoA and AoA must contain provisions requiring adherence to conflict-of-interest avoidance obligations, and policies and procedures to ensure that adherence. These provisions can be amended only with the DPB’s previous approval.	The MoA and AoA must be amended to include these provisions, before applying.
8.	Proposed operations must be in the interests of Data Principals	The business plan could show how Data Principals stand to benefit.
9.	Independent certification of the platform and of the technical and organisational measures	Certification is against the data protection standards and assurance framework that the DPB will publish on its website from time to time.

The DPB may make such inquiry as it considers fit to satisfy itself that these conditions are met. If satisfied, it registers the applicant, intimates the applicant and publishes the Consent Manager’s particulars on its website. If not, it rejects the application and communicates its reasons to the applicant. The Rules also require the Consent Manager to audit and report to the DPB on its continued fulfilment of the registration conditions.

Obligations of Consent Managers

1.     Website or app and mandatory disclosures

A Consent Manager must develop and maintain a website or app, or both, as the primary means through which Data Principals access its services. It must also publish the following on that website or app, in an easily accessible manner: (a) its promoters, directors, key managerial personnel and senior management; (b) every person who holds more than 2% of its shareholding; (c) every body corporate in which promoters, directors, key managerial personnel or senior management holds more than 2% of the shareholding, as on the first day of the preceding calendar month; and (d) any other information the DPB directs it to disclose in the interests of transparency.

2.     How consent flows through the Consent Manager platform

Consent Managers must enable Data Principals to consent to a Data Fiduciary onboarded on the Consent Manager’s platform either directly or through another Data Fiduciary onboarded on the platform that maintains the Data Principal’s data with her consent.

3.     The data-blind requirement

Consent Managers are required to ensure that the manner of making available or sharing the personal data is such that its contents are not readable by them.

4.     Maintain records

Consent Managers must maintain on their platform a record of (a) consents given, denied or withdrawn, (b) notices preceding or accompanying requests for consent, and (c) the sharing of the Data Principal’s personal data with a transferee Data Fiduciary.

Consent Managers must:

a.     give the Data Principal access to that record;

b.     on her request, and in accordance with its terms of service, make the information in the record available to her in machine-readable form; and

c.     maintain the record for at least seven years, or for any longer period that the Data Principal and the Consent Manager agree or that the law requires.

5.     Act in a fiduciary capacity

Consent Managers are required to act in a fiduciary capacity in relation to the Data Principal. 

6.     Conflict of Interest

Consent Managers must avoid conflict of interest with Data Fiduciaries, including in respect of their promoters and key managerial personnel. They must have measures in place to ensure that no conflict of interest arises on account of its directors, key managerial personnel and senior management holding a directorship, financial interest, employment or beneficial ownership in Data Fiduciaries, or having a material pecuniary relationship with them.

7.     Change of control

Control of a registered Consent Manager cannot be transferred by sale, merger or otherwise without the DPB’s previous approval. The transfer is also subject to any conditions the DPB specifies.

8.        No sub-contracting or assignment

A Consent Manager must not sub-contract or assign the performance of any of its obligations under the Act and the Rules.

9.        Reasonable security safeguards

A Consent Manager must take reasonable security safeguards to prevent personal data breach.

Potential Issues to Consider Before Registering

1.        Conflicts arising from the Consent Manager’s own directors, key managerial personnel and senior management. 

The Rules require Consent Managers to have measures to ensure that no conflict arises from its own directors, key managerial personnel, or senior management holding a directorship, financial interest, employment or beneficial ownership in a Data Fiduciary, or having a material pecuniary relationship with one. The Rules do not expressly bar a Data Fiduciary, Data Processor or a company in their group, from applying for the registration. However, where the applicant’s promoters, directors, key managerial personnel or senior management also hold any such role or interest in a Data Fiduciary, the conflict provisions discussed above are likely to be engaged.

2.        Consent Manager also acting as a Data Processor for a Data Fiduciary. 

The Rules do not expressly prohibit a Consent Manager from also providing services as a Data Processor to a Data Fiduciary, whether or not that Data Fiduciary is onboarded on its platform. However, such an arrangement may need to be assessed against the provisions relating to avoidance of conflict of interest. A Consent Manager acts in a fiduciary capacity towards the Data Principal, whereas a Data Processor acts on the instructions of, and for the commercial benefit of, the Data Fiduciary that engages it. The two roles may therefore pull in different directions, for example where the Data Fiduciary is paid by, or is a significant source of revenue for, the Consent Manager and also requests consent through its platform.

3.        Fundraising and change of control. 

As per the Rules, control of the Consent Manager cannot be transferred by sale, merger or otherwise without the DPB’s previous approval. “Control” has the same meaning as under the Companies Act, 2013, i.e., it includes the right to appoint a majority of the directors, or to control the management or policy decisions, whether exercised by one person or by persons acting in concert, directly or indirectly, including through shareholding, management rights, shareholders’ agreements or voting agreements, or in any other manner. The impact of this condition on future fundraises needs to be carefully considered. A minority investment that does not provide investors with rights amounting to control may not need the DPB’s approval, but investor rights such as board appointment, veto or voting arrangements may need to be assessed against this definition, and any approval required may need to be built into the transaction timeline.

4.        Public disclosure of shareholders and management. 

The Rules requires the Consent Manager to publish details of its promoters, directors, key managerial personnel and senior management, and of every person holding more than 2% of its shares. Shareholders and management may need to be told in advance that this information will be public.

5.        Maintaining net worth after registration.

A net worth of at least ₹2 crore is a condition of registration, and the Rules requires audit mechanisms to review and report to the DPB on continued fulfilment of the registration conditions. The net worth may therefore need to be maintained after registration.

Conclusion

Registration as a Consent Manager is open only to companies that meet the conditions in Part A of the First Schedule, and registration brings continuing obligations under Part B. The conflict-of-interest provisions, the DPB’s prior approval for a change of control and the public disclosure of management and significant shareholders may shape how an applicant is structured, funded and governed. Prospective applicants may assess their ownership, group structure, vendor arrangements and any existing data processing activities at an early stage.