What is a Consent Manager under DPDP?

A Consent Manager is a registered intermediary that enables data principals to give, manage, review, and withdraw consent across multiple data fiduciaries through a single platform.

Is Consent Manager registration mandatory?

Registration is mandatory only for entities that provide consent management services to other data fiduciaries — not for organisations managing their own internal consent.

What are the technical requirements for Consent Managers?

The DPDP Rules 2025 specify technical and security standards for Consent Managers including interoperability, audit trails, and secure consent storage.

Quick Answer: A Data Processor under the DPDP Act 2023 processes personal data on behalf of a Data Fiduciary under a contract. Processors must: implement reasonable security safeguards, notify the Data Fiduciary of personal data breaches promptly, process data only per the Fiduciary's instructions, and maintain records as required. The Fiduciary (your client) remains accountable to the Data Protection Board, but your contract (Data Processing Agreement) determines your liability exposure.

Data Processor Obligations Under the DPDP Act 2023 — Are You Compliant?

If you process personal data on behalf of another company, you are a Data Processor. Here is what the DPDP Act requires of you — and what your contracts must say.

Check your Data Processor compliance

Do you process personal data on behalf of other companies (clients)?

Do your client contracts include a Data Processing Agreement (DPA)?

Do you have a documented breach notification process?

Do you have sub-processors (vendors you use to process client data)?

Data Processor obligations under DPDP Act 2023

Process personal data only per the Data Fiduciary's instructions (S.8(3))
Implement reasonable security safeguards to protect the personal data you process
Notify the Data Fiduciary promptly upon discovering a personal data breach (Rules 2025)
Maintain records of processing activities as required by the Fiduciary's DPA
Ensure sub-processors are contractually bound to the same standards
Delete or return personal data on contract termination per DPA instructions
Do not use client personal data for your own purposes (strictly purpose-limited)
Make available all information necessary to demonstrate compliance (audit rights in DPA)

What must a Data Processing Agreement (DPA) include under the DPDP Act?

The DPDP Act does not prescribe a standard DPA format, but a compliant DPA must at minimum: define the scope and purpose of processing, specify what personal data is being processed, set out security standards required of the Processor, include breach notification timelines and escalation paths, address sub-processor authorisation, specify data deletion/return obligations, and include audit rights for the Fiduciary.

NitiBharat's Vendor DPA Review service audits your existing contracts and provides a model DPA clause library for use with clients and vendors.

BPO and KPO companies: you are Data Processors

India's BPO and KPO sector processes personal data on behalf of clients worldwide — customer records, HR data, financial data, health information. Under the DPDP Act, every engagement where you process Indian personal data on a client's behalf triggers Data Processor obligations. The good news: if you already comply with GDPR Article 28 (processor requirements), you have a strong foundation — but DPDP-specific breach timelines and DPA requirements will still need updating.

Get the model Data Processing Agreement checklist (free)

A clause-by-clause DPA checklist for Data Processors under the DPDP Act 2023, with what each clause must cover and common drafting gaps.

Frequently Asked Questions

Is a Data Processor liable for a data breach?+

The primary liability under the DPDP Act falls on the Data Fiduciary. However, if a breach occurs due to the Processor's negligence and the DPA includes breach notification and security obligations, the Fiduciary can seek indemnification from the Processor. Processors can also be investigated by the DPB if they contribute to a systemic breach.

Do Data Processors need to appoint a Grievance Officer?+

Grievance Officers are required for Data Fiduciaries. Data Processors do not have a direct obligation to appoint one under the DPDP Act — but your client contracts (DPAs) may require an escalation contact, which serves a similar function.

Can a company be both a Data Fiduciary and a Data Processor?+

Yes, and many Indian companies are both. For example, an IT services firm processes its own employee and vendor data as a Fiduciary, while also processing client customer data as a Processor. Both sets of obligations apply simultaneously.

Every Sunday

The Sunday DPDP Brief

One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.

No spam. Unsubscribe with one click, anytime.