Section 6 and Rule 4
Consent Managers under the DPDP Act and Rule 4
A Consent Manager is a person registered with the Board that lets people give, manage, review and withdraw consent from one place. Here is what the Act and Rule 4 say, and what it means for fiduciaries.
Short answer
A Consent Manager is a person registered with the Data Protection Board that acts as a single point of contact for a Data Principal to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform (s.2). A Data Principal may act through a Consent Manager (s.6(7)), which is accountable to the Data Principal (s.6(8)) and must be registered with the Board (s.6(9)). Registration under Rule 4 starts on 13 November 2026, but the application form has not been published and the Board has no members yet.
What the Act says about Consent Managers
| Provision | What it says |
|---|---|
| s.2 (definition) | A person registered with the Board who acts as a single point of contact to let a Data Principal give, manage, review and withdraw consent through an accessible, transparent and interoperable platform |
| s.6(7) | A Data Principal may give, manage, review or withdraw consent through a Consent Manager |
| s.6(8) | The Consent Manager is accountable to the Data Principal |
| s.6(9) | Every Consent Manager must be registered with the Board |
| s.13(3) | A Data Principal must exhaust the Consent Manager's grievance redressal before approaching the Board |
| Rule 4 | Registration and obligations of Consent Managers, from 13 November 2026 |
| Rule 14(3) | Each Consent Manager publishes a grievance response period of no more than 90 days |
The word “may” in s.6(7) matters. Using a Consent Manager is the Data Principal's choice; consenting directly to the Data Fiduciary remains possible.
A Data Fiduciary that only collects consent for its own processing is not a Consent Manager. The s.6(8) and s.6(9) duties, and Rule 4, apply to those who register to act for Data Principals.
Who can register under Rule 4
Registration is with the Data Protection Board under Rule 4, which starts on 13 November 2026 (Rule 1). The conditions in Part A of the First Schedule include:
- being a company incorporated in India; and
- a net worth of not less than ₹2 crore.
Part A has other conditions too, so read the Schedule in full. Once registered, a Consent Manager has continuing obligations under Rule 4, and the Board can suspend or cancel its registration after giving it a hearing. Detail for applicants is on Rule 4: Consent Manager registration.
Consent Manager or consent management software?
| Question | Registered Consent Manager | Consent management software |
|---|---|---|
| What it is | A person defined in s.2 and registered under s.6(9) and Rule 4 | A tool a Data Fiduciary uses to meet its own s.5 and s.6 duties |
| Who it works for | The Data Principal, to whom it is accountable (s.6(8)) | The Data Fiduciary, which stays responsible for its own consents |
| Registration with the Board | Required (s.6(9)) | Not a Consent Manager, so Rule 4 registration does not arise |
| Grievances | Runs its own grievance redressal, with a published response period of no more than 90 days | Handled through the fiduciary's own grievance redressal (s.8(10)) |
| Who can be one | A company incorporated in India that meets the First Schedule conditions, including net worth of not less than ₹2 crore | Any Data Fiduciary can run its own |
The Consent Manager vs CMP guide goes further into the difference.
What Data Fiduciaries should plan for
- Keep your own consent flow. Direct consent remains possible under s.6(7), so you do not have to wait for Consent Managers.
- Expect a second route. Once Consent Managers are registered, some people may give or withdraw consent through one.
- Keep proof either way. Where consent is the basis for processing, the fiduciary must prove notice and consent (s.6(10)).
- Act on every withdrawal. Whatever the route, stop processing within a reasonable time and have processors stop too (s.6(6)).
The Consent Manager application form has not been published and the Board has no members. No one can be registered before Rule 4 starts on 13 November 2026, so treat any “apply now” claim with care.
How TruePrivacy helps
TruePrivacy is consent management software for Data Fiduciaries, not a registered Consent Manager. Consent management keeps a consent record per person and purpose, an event log of every grant, withdrawal, rejection and update, and consent receipts: the evidence s.6(10) asks for.
See how TruePrivacy approaches Consent Managers, and the Consent Manager FAQ for common questions.
Is a Consent Manager mandatory under DPDP?
No. A Data Principal may act through a Consent Manager (s.6(7)); consenting directly to the Data Fiduciary remains possible.
When can a company register as a Consent Manager?
Rule 4 starts on 13 November 2026. As of 4 November 2026 the application form had not been published and the Board had no members.
What net worth does a Consent Manager need?
Not less than ₹2 crore. This is one of the conditions in Part A of the First Schedule, which also require a company incorporated in India.
Is a cookie banner tool a Consent Manager?
No. A Consent Manager is a person registered with the Board under s.6(9) and Rule 4. A banner or consent tool run by a fiduciary is software for its own consents.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin