FAQ
Consent Manager FAQ
Who a Consent Manager is, when registration starts, and what it means for Data Fiduciaries that collect consent themselves.
Short answer
A Consent Manager is a person registered with the Data Protection Board who acts as a single point of contact to let a Data Principal give, manage, review and withdraw consent through an accessible, transparent and interoperable platform (s.2). Registration under Rule 4 starts on 13 November 2026; conditions in the First Schedule include being a company incorporated in India with a net worth of not less than ₹2 crore. As of 4 November 2026, the application form has not been published and no Board members have been appointed.
Data Fiduciary and Consent Manager compared
| Data Fiduciary | Consent Manager | |
|---|---|---|
| Role | Determines the purpose and means of processing (s.2) | Single point of contact for a Data Principal to give, manage, review and withdraw consent (s.2) |
| Consent duty | Must prove notice and consent (s.6(10)) | Accountable to the Data Principal (s.6(8)) |
| Registration | Not covered by Rule 4 | Registered with the Board (s.6(9), Rule 4) |
| Grievance period | Published, at most 90 days (Rule 14(3)) | Published, at most 90 days (Rule 14(3)) |
| Start date | Core obligations from 13 May 2027 | Registration from 13 November 2026 |
All questions
Educational, not legal advice.
What is a Consent Manager under DPDP?
A person registered with the Board who acts as a single point of contact to let a Data Principal give, manage, review and withdraw consent through an accessible, transparent and interoperable platform (s.2). See the Consent Manager glossary entry.
When does Consent Manager registration start?
Rule 4 commences on 13 November 2026, one year after the Rules were published. See the DPDP timeline.
Has the application form been published?
No, not as of 4 November 2026. Prepare the eligibility evidence, but wait for the official form before filing.
Who can become a Consent Manager?
Part A of the First Schedule to the Rules sets the conditions, which include being a company incorporated in India and having a net worth of not less than ₹2 crore. Read the full conditions under Rule 4 with counsel.
Who registers Consent Managers while the Board has no members?
The Act requires registration with the Board (s.6(9)). As of 4 November 2026, no Board members have been appointed and the application form has not been published.
Must every Data Fiduciary work with a Consent Manager?
No. Under s.6(7) a Data Principal may act through a Consent Manager; consenting directly to the Data Fiduciary remains possible.
Who is a Consent Manager accountable to?
To the Data Principal (s.6(8)).
Can the Board cancel a Consent Manager's registration?
Yes. Under Rule 4, the Board can suspend or cancel a registration after giving a hearing.
Do Consent Managers handle grievances?
Yes. Rule 14(3) requires each Data Fiduciary and Consent Manager to publish a grievance response period of not more than 90 days, and s.13(3) requires a Data Principal to exhaust that redressal before approaching the Board.
Is TruePrivacy a Consent Manager?
No. TruePrivacy is software a Data Fiduciary uses to run its own consent management; it is not registered as a Consent Manager. See Consent Manager vs CMP.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin