What is a Consent Manager under DPDP?

A Consent Manager is a registered intermediary that enables data principals to give, manage, review, and withdraw consent across multiple data fiduciaries through a single platform.

Is Consent Manager registration mandatory?

Registration is mandatory only for entities that provide consent management services to other data fiduciaries — not for organisations managing their own internal consent.

What are the technical requirements for Consent Managers?

The DPDP Rules 2025 specify technical and security standards for Consent Managers including interoperability, audit trails, and secure consent storage.

Quick Answer: A Data Fiduciary under the DPDP Act 2023 must: obtain specific, informed, freely given and unambiguous consent before processing personal data; provide a clear privacy notice; implement reasonable security safeguards; respond to Data Principal rights requests (access, correction, erasure, nomination); notify the Data Protection Board of personal data breaches within prescribed timelines; and appoint a Grievance Officer. Additional obligations apply to Significant Data Fiduciaries. This checker maps your current status against all obligations.

Data Fiduciary Obligations Checker — DPDP Act 2023

Are you meeting every obligation as a Data Fiduciary under India's DPDP Act 2023? Check your status across all 7 obligation areas in 3 minutes.

Check your Data Fiduciary status

Do you collect consent before processing personal data?

Do you have a DPDP-compliant Privacy Notice?

Do you have a documented Breach Response procedure?

Do you have a Grievance Officer appointed and published?

Can you respond to Data Principal requests (access, correction, erasure)?

Full Data Fiduciary obligations under DPDP Act 2023

S.5 — Notice: clear, accessible notice of purpose, data types, rights and contact before or at consent
S.6 — Consent: specific, informed, freely given, unambiguous — separate from T&Cs, withdrawable
S.7 — Legitimate uses: lawful bases beyond consent (state functions, emergencies, employment)
S.8 — Security safeguards: reasonable technical and organisational measures proportionate to risk
S.8 — Breach notification: report to Data Protection Board + affected Data Principals (timelines in Rules 2025)
S.9 — Children's data: no processing of minors' data without verifiable parental consent
S.10 — SDF obligations (if designated): DPO appointment, DPIA, data localisation, audit
S.11–14 — Data Principal rights: access, correction, erasure, nomination, grievance response within 30 days
S.13 — Grievance Officer: named individual, contact published, respond within 30 days

What happens if a Data Fiduciary fails to meet its obligations?

The DPDP Act prescribes financial penalties of up to ₹50 crore for failures in security safeguards, up to ₹200 crore for non-compliance with child data obligations, and up to ₹250 crore for systemic or significant failures. The Data Protection Board of India can investigate on complaint or suo motu, require remediation, and impose penalties. Repeated violations can trigger enhanced scrutiny.

Beyond penalties, a breach or public complaint can damage client relationships, trigger contract terminations (especially with enterprise buyers who now include DPDP compliance in vendor questionnaires), and affect regulatory licences in sectors like healthcare and fintech.

Significant Data Fiduciary: additional obligations

Companies designated as Significant Data Fiduciaries (SDFs) by the Central Government face additional obligations: appointing a Data Protection Officer (DPO) based in India, conducting Data Protection Impact Assessments (DPIAs), engaging an independent Data Auditor, and potentially observing data localisation requirements. SDF designation is expected to be based on volume, sensitivity and systemic risk — companies processing data of 10 lakh+ individuals or handling sensitive data categories should plan for SDF designation.

Get your personalised Data Fiduciary obligations map (free)

A section-by-section PDF mapping every DPDP Act obligation to a practical action, with evidence requirements and timelines.

Frequently Asked Questions

Who is a Data Fiduciary under the DPDP Act?+

Any person or entity that determines the purpose and means of processing personal data of individuals in India. This includes virtually every Indian company that handles customer, employee or vendor personal data digitally.

What is the difference between a Data Fiduciary and a Data Processor?+

A Data Fiduciary decides what data to collect and why. A Data Processor processes data on the Fiduciary's behalf (e.g., a cloud provider, payroll vendor). The Fiduciary is primarily accountable; Processors have contractual obligations and their own breach notification duties.

Do all Data Fiduciaries need a DPO?+

No. Only Significant Data Fiduciaries (designated by the Central Government) must appoint a Data Protection Officer. All other Data Fiduciaries must appoint a Grievance Officer — a lower bar.

Every Sunday

The Sunday DPDP Brief

One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.

No spam. Unsubscribe with one click, anytime.