Glossary
What is a Consent Manager under DPDP?
A Consent Manager lets a Data Principal handle consent through one platform. It must be registered with the Data Protection Board.
Definition
Under s.2 of the DPDP Act, 2023, a Consent Manager is a person registered with the Board who acts as a single point of contact to let a Data Principal give, manage, review and withdraw consent through an accessible, transparent and interoperable platform. Registration under Rule 4 starts on 13 November 2026; the conditions include being a company incorporated in India with a net worth of not less than ₹2 crore. As of 4 November 2026, the application form has not been published.
What it means
A Data Principal may give, manage, review or withdraw consent through a Consent Manager (s.6(7)); consenting directly to the Data Fiduciary remains possible. The Consent Manager is accountable to the Data Principal (s.6(8)) and must be registered with the Board (s.6(9)).
Rule 4 sets registration and obligations, with conditions in Part A of the First Schedule. The Board can suspend or cancel a registration after a hearing.
Where it appears in the Act and Rules
| Provision | What it says |
|---|---|
| s.2 | Defines the Consent Manager |
| s.6(7) | A Data Principal may act through a Consent Manager |
| s.6(8) | Accountable to the Data Principal |
| s.6(9) | Registered with the Board |
| s.13(3) | Its grievance redressal is exhausted before the Board |
| Rule 4, First Schedule | Registration; conditions include a company incorporated in India with a net worth of not less than ₹2 crore |
| Rule 14(3) | Publishes a grievance response period of at most 90 days |
Common misconceptions
- “Every Data Fiduciary must use a Consent Manager.” No. Under s.6(7) a Data Principal may use one.
- “Consent software makes you a Consent Manager.” A Consent Manager is a person registered with the Board under Rule 4.
- “Applications are open.” Rule 4 starts on 13 November 2026, and the application form has not been published yet.
Related terms
Free, specific, informed, unconditional and unambiguous, with a clear affirmative action (s.6).
Data PrincipalThe individual the personal data relates to (s.2).
Data Protection BoardThe Board established under s.18; no members appointed yet.
Grievance redressalThe fiduciary's complaint process, used before the Board (s.13).
In TruePrivacy
TruePrivacy is not a Consent Manager. It is software a Data Fiduciary uses to run its own consent management: purposes, a consent record per person and purpose, an event log of every grant and withdrawal, and consent receipts. See Consent Manager vs CMP for the difference.
When can a company register as a Consent Manager?
Rule 4 starts on 13 November 2026. As of 4 November 2026, the application form has not been published.
Do I need a Consent Manager to collect consent?
No. Under s.6(7) a Data Principal may use a Consent Manager, and consent given directly to the Data Fiduciary remains possible.
What net worth does a Consent Manager need?
Part A of the First Schedule to the Rules requires a net worth of not less than ₹2 crore, among other conditions such as being a company incorporated in India.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin