DPDP enforcement deadline: May 2027Rules notified Nov 2025Penalty exposure up to ₹250 Cr
⚡ DPDP Act enforcement begins May 2026 — Check your readiness score
Quick Answer: A Consent Manager under the DPDP Act 2023 is a registered intermediary that enables individuals to give, manage, review and withdraw consent to multiple Data Fiduciaries through a single platform. Consent Managers must be registered with the Data Protection Board, maintain a user-accessible consent dashboard, and are accountable to Data Principals. Most businesses are Data Fiduciaries — not Consent Managers — but companies building consent management platforms, identity aggregators, or Account Aggregator-style services may need to register.

Consent Manager Under the DPDP Act — Do You Need to Register?

The DPDP Act 2023 creates a new category: the Consent Manager. Find out if your business needs to register, what it involves, and how to prepare.

Do I need to register as a Consent Manager?

Consent Manager obligations under DPDP Act 2023

Consent Manager vs Consent Management Platform (CMP)

These are different things. A Consent Manager under the DPDP Act is a registered intermediary that holds a user's consent choices and acts on their behalf across multiple services — similar to the Account Aggregator model in finance. A Consent Management Platform (CMP) is a technology tool (like OneTrust or CookiePro) that companies use to manage their own cookie and consent collection. Most Indian companies need the latter; only a small category of intermediary platforms will need to register as Consent Managers.

When will Consent Manager registration open?

The Consent Manager registration framework is being specified in the DPDP Rules 2025, which were notified in November 2025. The Data Protection Board of India is expected to begin accepting Consent Manager applications once the DPB is constituted, which is anticipated in 2026. Companies planning to operate as Consent Managers should begin preparing their architecture, documentation and eligibility assessment now.

Get the Consent Manager readiness checklist (free)

A prep checklist for companies exploring Consent Manager registration: technical requirements, governance, and what the DPB will likely assess.

Frequently Asked Questions

Can a company be both a Data Fiduciary and a Consent Manager?+
The DPDP Act does not prohibit this, but regulators are likely to scrutinise conflicts of interest. A company that both uses personal data for its own purposes and manages users' consent across other platforms will face heightened accountability obligations.
Is consent manager registration mandatory for fintech Account Aggregators?+
NBFC-Account Aggregators are regulated by RBI under a separate framework. The relationship between the DPDP Act Consent Manager category and the RBI AA framework is still being clarified. If you operate an AA licence, monitor both frameworks.
What happens if I operate as an unregistered Consent Manager?+
Operating without registration when required would be a violation of the DPDP Act, potentially treated as processing personal data without lawful basis — penalty exposure up to ₹250 crore.

Related Tools

Consent Manager Eligibility CheckerDPDP Applicability CheckerData Fiduciary ObligationsConsent Notice BuilderDPDP for Fintech
Every Sunday

The Sunday DPDP Brief

One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.

No spam. Unsubscribe with one click, anytime.

Related tools & reading
CRM Data Protection Readiness GuideData Breach Log TrackerData Fiduciary vs Data Processor Under DPDP IndiaProgrammatic Advertising & DPDP Compliance Guide (…See all Reference & Checklists tools →📝 Does DPDP Apply to B2b Companies📝 Questions for DPDP Consultant