A Consent Manager is a company registered with the Data Protection Board of India that gives a person one place to give, manage, review and withdraw consent across the businesses they deal with. Rule 4 of the Digital Personal Data Protection Rules, 2025 says how a company registers. Under Rule 1(3) it comes into force one year after the Gazette publication of 13 November 2025, which is 13 November 2026.
This explainer is built from the notified Rules as published in the Gazette of India (G.S.R. 846(E)), specifically Rules 1, 4, 6 and 7 and the First Schedule. It does not cover the rest of the Rules, and it is not legal advice. The Board's own application forms and standards were not available to us, and several things below depend on them.
What a Consent Manager is
The government describes Consent Managers as entities that help individuals manage their permissions, and says they must be Indian companies. In practice a Consent Manager runs a platform on which a person can see every consent they have given, give a new one, or withdraw one, instead of dealing with each business separately.
The Rules illustrate it with a bank example. A person uses the platform to give a bank their consent to receive her account statement, either directly from her digital locker or routed through the bank that holds it. The Consent Manager moves the consent, but may not be able to read the data that passes between the two businesses.
When it takes effect
The Rules did not start on one day. Rule 1 sets three dates, all counted from the date of publication in the Gazette. That date is 13 November 2025: the Gazette issue line reads Thursday, 13 November 2025, and the notification is dated the same day. The government's own summary of the Rules says they were notified on 14 November 2025, and the electronic copy's Gazette reference also carries 14112025. That is why sources disagree by a day. We count from the Gazette date.
| Provisions | When they come into force | Counted from 13 Nov 2025 |
|---|---|---|
| Rules 1, 2 and 17 to 21: short title, definitions, and the Data Protection Board's appointments, pay, meetings, digital operation and staff | On publication | 13 November 2025 |
| Rule 4: registration and obligations of Consent Managers | One year after publication | 13 November 2026 |
| Rules 3, 5 to 16, 22 and 23: the rules on what businesses must do, including notice, security safeguards, breach intimation and verifiable consent for children | Eighteen months after publication | 13 May 2027 |
Who can register as a Consent Manager
Rule 4(1) lets a person who meets the conditions in Part A of the First Schedule apply to the Board. The conditions, in our words:
- The applicant is a company incorporated in India.
- It has the technical, operational and financial capacity to meet its obligations.
- Its financial condition and the general character of its management are sound.
- Its net worth is not less than two crore rupees. The Schedule defines net worth as total assets less liabilities as shown in the books of account.
- Its likely business volume, capital structure and earning prospects are adequate.
- Its directors, key managerial personnel and senior management have a general reputation and record of fairness and integrity.
- Its memorandum and articles of association require the conflict-of-interest obligations to be followed, with adherence policies in place, and can be amended only with the Board's prior approval.
- Its proposed operations are in the interests of Data Principals.
- It is independently certified that its platform is consistent with the data protection standards and assurance framework the Board publishes, and that technical and organisational measures are in place to adhere to them and to meet its duty to publish information about its owners.
How registration works
- The applicant applies to the Board, furnishing the particulars and documents the Board publishes on its website for the purpose (Rule 4(1)).
- The Board may make whatever inquiry it considers fit to satisfy itself that Part A is met (Rule 4(2)).
- If satisfied, it registers the applicant and publishes the particulars of the Consent Manager on its website. If not, it rejects the application and gives its reasons (Rule 4(2)).
- The registered Consent Manager carries the obligations in Part B of the First Schedule (Rule 4(3)).
- If the Board thinks a Consent Manager is not adhering to the conditions and obligations, it may, after giving an opportunity of being heard, tell it so and direct it to take measures to adhere (Rule 4(4)).
- Where it is necessary in the interests of Data Principals, the Board may, after a hearing and by a reasoned written order, suspend or cancel the registration and give directions to protect Data Principals (Rule 4(5)). It can also require the Consent Manager to furnish information (Rule 4(6)).
What a Consent Manager must do
Part B of the First Schedule lists the obligations. In our words:
- Let a Data Principal give consent through its platform to a Data Fiduciary, either directly or through another Data Fiduciary on the platform that holds the data with her consent.
- Make sure personal data passing through it is not readable by the Consent Manager.
- Keep a record of consents given, denied or withdrawn, of the notices that came with consent requests, and of data shared with a receiving Data Fiduciary.
- Give the Data Principal access to that record, provide it in machine-readable form on request, and keep it for at least seven years, or longer if agreed or required by law.
- Provide a website or app as the primary way a Data Principal uses the service.
- Not sub-contract or assign any of its obligations under the Act and the Rules.
- Take reasonable security safeguards to prevent a personal data breach.
- Act in a fiduciary capacity towards the Data Principal.
- Avoid conflicts of interest with Data Fiduciaries, including through its promoters, directors, key managerial personnel and senior management.
- Publish who its promoters, directors, key managerial personnel and senior management are, who holds more than two per cent of its shares, and every company in which any of those individuals holds more than two per cent, as on the first day of the preceding calendar month. The Board may direct further disclosure in the interests of transparency.
- Have audit mechanisms for its controls, its continued fulfilment of the registration conditions and its compliance, and report the outcome to the Board.
- Not let control of the company change hands by sale, merger or otherwise without the Board's prior approval.
What it means for a business that collects consent
Nothing in Rules 1, 4, 6, 7 or the First Schedule, which are the parts we read, makes a business adopt a Consent Manager. Section 6(7) of the Act lets a person give, manage, review or withdraw consent through a Consent Manager. Section 6(8) makes the Consent Manager accountable to her and has it act on her behalf, and section 6(9) requires every Consent Manager to be registered with the Board. So the sensible question is whether your own consent records could work with a platform like this. Read section 6 of the Act, and the rest of the Rules, before you decide what you must do.
That also means 13 November 2026 is not a compliance deadline for an ordinary business. Under Rule 4(1) it is the day from which a company that meets the conditions may apply to the Board to be registered.
The timing matters more than the technology. Rule 4 starts on 13 November 2026. The rules that govern what businesses do with consent notices, safeguards, breach reporting and rights requests start on 13 May 2027. Rule 4 does not bring those forward.
- Keep a record of every consent: who, when, which purpose, which notice they saw, and any withdrawal. A Consent Manager platform has to keep exactly this, so a business that cannot produce it will find integration hard.
- Make withdrawal as easy as giving consent, and make sure a withdrawal reaches every system that holds the data.
- Check that consent notices are standalone, clear and specific to a purpose, which is how the government summarises the notice rule. Rule 3 applies from 13 May 2027.
- Ask whether your systems could receive a consent decision from a platform you do not run, and act on it.
- Watch the Board's website for the application procedure, the standards for certification and the list of registered Consent Managers. We have not seen them.
A common mistake: the 72-hour breach clock
Many summaries state the personal data breach reporting timeline as a current obligation. Rule 7 does say that a Data Fiduciary must tell the Board without delay, and give detailed information within seventy-two hours of becoming aware of a breach, or a longer period the Board allows on a written request. It must also tell each affected Data Principal without delay.
But Rule 7 is in the group that comes into force eighteen months after publication. Under Rule 1(4) that is 13 May 2027. The same applies to the security safeguards in Rule 6. Build the procedure now. It is not yet a rule you can be held to under these Rules.
References
- Digital Personal Data Protection Rules, 2025, Gazette of India Extraordinary, G.S.R. 846(E), 13 November 2025 (Ministry of Electronics and Information Technology)
- Government notifies DPDP Rules to empower citizens and protect privacy, Press Information Bureau, 14 November 2025
- Digital Personal Data Protection Act, 2023 (Ministry of Electronics and Information Technology)
This is general guidance for engineers and managers, not legal advice. Obligations depend on your sector, your contracts and the rules in force on the day, so confirm the current position with your counsel and the regulator before relying on it.