Consent manager under the DPDP Act: what it is, and what changes on 13 November 2026
A consent manager is a company registered with the Data Protection Board that lets a person give, review and withdraw consent across many businesses from one place. Registration opens on 13 November 2026. If your customers use one, your systems must accept consent and withdrawals that arrive through it.
Today, if you want to see which companies hold your data and what you agreed to, you have to visit each one. A consent manager changes that. It is one dashboard where a person can see every consent they have given, and take any of them back.
India's DPDP Act created the role in 2023. The rule that brings it to life, Rule 4 of the DPDP Rules, 2025, applies from 13 November 2026. This guide explains what a consent manager is, who can become one, and what a business needs to change.
What a consent manager is
Section 2(g) of the Act defines a consent manager as a person registered with the Data Protection Board who acts as a single point of contact. It lets a person, called the Data Principal, give, manage, review and withdraw consent through a platform that is accessible, transparent and works with other systems.
Three things set it apart from a normal cookie banner or consent tool:
- It works for the person, not the business. Section 6(8) makes it accountable to the Data Principal and says it acts on their behalf.
- It must be registered. Only companies registered with the Data Protection Board can act as one.
- It spans many businesses. One person, one dashboard, every company they have shared data with.
How consent flows through one
The key date
Consent managers arrive six months before most business duties apply. That gap is deliberate: it gives the platforms time to register and connect before companies must honour every consent and withdrawal in full.
Who can become a consent manager
The First Schedule to the DPDP Rules sets the conditions. In short, an applicant must:
- be a company incorporated in India;
- have a net worth of at least ₹2 crore;
- have enough technical, operational and financial capacity to run the platform;
- run a platform that is independently certified and can work with the systems of the businesses it connects to.
Once registered, it must act in a fiduciary role towards the people it serves, avoid conflicts of interest with the businesses it connects to, keep records of the consents given and withdrawn, show those records to the person, and not hand its work to someone else.
What it means for your business
You do not have to become a consent manager. Most companies never will. But if your customers choose to use one, you must be able to work with it. That has four practical effects.
- Accept consent from outside. A consent can now arrive through a third party, not only your own form or app.
- Act on withdrawal quickly. Under Section 6, withdrawing must be as easy as giving, and you must stop processing within a reasonable time once consent is withdrawn. Your vendors must stop too.
- Tie every use to a purpose. Consent is given for a specific purpose. Your systems must know which data was collected for which purpose, so one withdrawal switches off the right things.
- Keep the proof. If a person or the Board asks, you must show what was agreed, when, and what you did after a withdrawal.
The hard part is inside your walls
Receiving a withdrawal is easy. Acting on it is not. A customer's data often sits in a CRM, a billing system, a marketing tool, a data warehouse and a few spreadsheets. If those systems do not agree on who the customer is, a withdrawal reaches one of them and misses the rest.
That is a data silos problem first and a consent problem second. The fix is to match each person across systems, so one consent record points to every copy of their data. Our guide to entity resolution explains how that matching works.
A short readiness check
- Can you list every system that uses data collected under consent?
- Does each record know the purpose it was collected for?
- When a person withdraws, how many systems are updated, and how long does it take?
- Can you prove, a year later, what happened after that withdrawal?
If any answer is "not sure", start with the DPDP compliance checklist.
Where Samvrik fits
Smelter matches each person across your systems inside your own environment, so a consent or a withdrawal reaches every copy of their data. Assembler applies the rule, such as "stop using this data for marketing", and logs every action it takes, so the proof is there when someone asks. See how Smelter works.
Sources: Digital Personal Data Protection Act, 2023, Sections 2(g) and 6; Digital Personal Data Protection Rules, 2025, Rule 4 and First Schedule (notified 13 Nov 2025). Plain summary, not legal advice.
Common questions
What is a consent manager under the DPDP Act?
A company registered with the Data Protection Board that gives people one place to give, manage, review and withdraw their consent across many businesses. It acts on behalf of the person, not the business.
When can consent managers start working?
Rule 4 of the DPDP Rules, 2025, which covers consent managers, applies from 13 November 2026, one year after the Rules were notified.
Who can register as a consent manager?
A company incorporated in India with a net worth of at least ₹2 crore, enough technical, operational and financial capacity, and an independently certified platform that can work with other systems.
Do businesses have to use a consent manager?
No. It is the person's choice. But if a customer gives or withdraws consent through a registered consent manager, the business must honour it.
What happens when someone withdraws consent?
The business must stop processing that person's data for that purpose within a reasonable time, and make sure its processors stop too, unless another law requires the data to be kept.