Consent Managers Under the DPDP Act: What Rule 4 Will Require, Once It Takes Effect

A consent manager and a consent management platform sound alike but are fundamentally different things. TrustArc describes a DPDP Act consent manager as a registered third-party intermediary. It must:

• register with the Data Protection Board
• act on behalf of the customer rather than the business
• stay unable to access or store the personal data it handles

A consent management platform, by contrast, is software a business runs for its own consent capture. It needs no regulatory registration and can process consent data as a processor working for the business. For KYCKART’s broader coverage of the framework, see the DPDP Act overview and the compliance timeline pieces.

The Act backs up the first description. Section 2 defines a consent manager as a person registered with the Board who acts as a single point of contact for a customer to give, manage, review and withdraw consent through an accessible, interoperable platform. Once the rules commence, a registered consent manager must also act in a fiduciary capacity toward the customer. It must stay unable to read the personal data it moves.

Once Rule 4 commences, a company will need to meet nine conditions to register. It will then need to meet thirteen ongoing obligations to keep that registration.

To register, the schedule will require the applicant to:

• be a company incorporated in India, with enough technical, operational and financial capacity to do the job
• show sound finances and a net worth of at least ₹2 crore
• have directors and senior managers with a track record of fairness and integrity
• lock the conflict-of-interest rules into its own constitutional documents
• get independent certification that its platform meets data-protection standards the Board will publish (no such published standard exists yet)

Once registered, the obligations schedule will require a consent manager to:

• keep the data it moves unreadable to itself
• keep records of every consent given, denied or withdrawn for at least seven years
• run its own website or app as the main way customers reach it
• avoid conflicts of interest with the businesses it works with
• get Board approval before any change of control

Once in force, Rule 4 sets the process: a company applies, the Board checks whether it meets the conditions, then registers it with public notice or rejects the application with reasons. The Board can later order corrective steps, suspend or cancel a registration, or ask for more information, always after giving the company a chance to respond.

The Act’s own penalty schedule does not name a consent manager directly. AZB & Partners states the practical effect anyway: non-compliance by a consent manager can draw a penalty of up to ₹50 crore, under the Act’s catch-all clause for breaches the Schedule does not name specifically.

Rule 4 does not switch the whole framework on at once. Registration starts roughly six months before customers can actually use one.

Rule 1 of the DPDP Rules, 2025 phases the rules in stages. Reading the government’s commencement notificationagainst the Act’s own text shows only part of the consent-manager framework lands at the one-year mark. The duty to register with the Board starts at the calculated 13 November 2026 date. So does the Board’s power, under Section 27, to act when a registered consent manager breaches its registration conditions. But the provision that actually lets a customer route consent through a registered consent manager waits for the calculated 13 May 2027 date, six months later. So does the Board’s power under Section 27 to act on a customer’s complaint about one. No source cited here states this split directly; it follows from reading the notification’s own lists against the section texts.

No consent manager can register yet regardless of the date, because the Board that runs registrations is not fully staffed. As of the most recent reporting located, the Board had no Chairperson and no Members, though the government had begun the search process. Candour Legal warns that the compliance runway for applicants could compress into whatever window is left once the Board is actually staffed and its standards are published.

No. Using a consent manager will stay optional for your institution, even once the rules commence.

AZB & Partners states that the DPDP Rules do not require data fiduciaries(the banks, NBFCs, insurers and fintechs that collect the data) to use a consent manager. An institution can keep collecting consent directly, as long as it meets the Act’s own notice, consent, withdrawal and record-keeping standards.

Rule 4 and the First Schedule say almost nothing about how a fiduciary would connect to a consent manager if it chose to. There is no prescribed onboarding process, no required data format, and no set timeline for acting on a withdrawal routed through one. What will bind a fiduciary, once the later tranche commences, comes from the Act itself rather than from the consent-manager rules. Section 6 will require a fiduciary to:

• let a customer withdraw consent as easily as they gave it
• stop processing, and make its processors stop, within a reasonable time after a withdrawal
• be able to prove it gave notice and got consent, if the question is ever raised in a proceeding

Read together, the split commencement and the unfinished Board point the same way. The six months between the two calculated dates look like they belong to applicants and the Board, not to institutions deciding whether to route consent through anyone. The provision that would let your customers actually use a consent manager does not start until the later date. No consent manager can register until the Board is fully staffed, so there is nothing to plug into yet.

That gives your institution time rather than urgency. Three things are worth raising with your data-protection or legal team now:

• Direct compliance readiness:whether your existing consent-capture process already meets the Act’s notice, consent, withdrawal and record-keeping standards on its own, since using a consent manager will remain optional.
• Vendor contract safeguards: what your vendor contracts say about what records a consent manager would hand over, in case a consent-manager integration becomes relevant later.
• Calendar monitoring: whether your compliance calendar tracks both the calculated 13 November 2026 and 13 May 2027 dates, since either could shift if the underlying computation is read differently.