By Vikrant Rana, Anuradha Gandhi , Isha Sharma, and Rishabh Gupta
With the Consent Manager Framework set to become operational on November 13, 2026, organizations must assess whether they will facilitate consent through a registered Consent Manager or continue managing consent independently.
Introduction
With the phased implementation of the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 (DPDP Rules) underway, organizations handling digital personal data in India are approaching an important regulatory milestone.
PHASE1 On November 13, 2025, Constitution of the Data Protection Board and the definitions under the Act
PHASE 2 On November 13, 2026, Rule 4 of the DPDP Rules, governing the registration and obligations of Consent Managers, will come into force that directly affects data processing operations across sectors
PHASE 3. On May 13, 2027, Integration and Operational Readiness
Scope and Definition
Consent Manager” means a intermediary registered with the Board, who acts as a single point of contact to enable a Data Principal/individuals to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform rather than having to interact separately with every organization processing their personal data
The introduction of the Consent Manager framework is a significant development in India’s digital protection landscape.
For organizations, however, the approaching deadline raises an important operation question: Should they engage a registered Consent Manager to facilitate consent management, or should they establish and maintain their own consent management mechanisms?
The DPDP Act recognizes both possibilities. Section 6(7) of the Act provides that a Data Principal may exercise consent related choices through a Consent Manager. The provision does not make engagement of a Consent Manager mandatory for every Data Fiduciary.
Consequently, organizations need to assess their existing consent architecture, business requirements, technology capabilities and compliance readiness to determine the appropriate approach.
Importantly, the November 2026 milestone should not be mistaken for the deadline for all Data Fiduciary obligations. The principal operational provisions under the DPDP Rules, including those relating to notices, security safeguards, breach notifications and other Data Fiduciary obligations, are scheduled to commence on May 13, 2027. Organizations should use the intervening period to prepare their compliance infrastructure rather than wait until the later deadline.
Consent Manager Framework
Section 2(g) of the Act defines a Consent Manager as a person registered with the Data Protection Board (Board), who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform.
A Consent Manager essentially facilitates the interaction between Data Principals and Data Fiduciaries in relation to consent decisions. The framework is intended to strengthen individual control over personal data, improve transparency and facilitate a more structured approach to consent management.
For Data Fiduciaries, this introduces an additional mechanism for facilitating consent-related interactions. However, the decision to engage a Consent Manager remains an organizational choice, subject to the rights of Data Principals under the.
Practical implications of engaging a Consent Manager
Organizations intending to facilitate consent through a registered Consent Manager should begin preparing for the integration of such platforms into their existing data processing and consent management systems.
The following steps should be considered:
- Identify Consent Managers registered with the Board and assess their suitability before entering into any arrangement.
- The organization should also assess whether the Consent Manager’s platform can accommodate the nature, volume and complexity of its consent-related transactions.
- Organizations should assess whether their existing websites, mobile applications, customer management systems and databases can communicate effectively with the Consent Manager platform. This may require developing secure APIs and integration protocols, establishing authentication and verification mechanism, establishing secure transmission of consent-related instructions, establishing mechanisms for receiving and acting upon consent modifications and withdrawals, ensuring that consent-related records can be retrieved and reconciled.
Consent manager role and obligations
The consent manager obligations in Part B of the first schedule then apply to it in addition to its obligations as a Data fiduciary. The Part B of first schedule prescribes the following obligations:
- Maintenance of an interoperable platform that shall enable a Data principal to give consent to the processing of their personal data
- The consent manager shall maintain a record of consent given/withdrawn; Notices preceding requests for consent as well as records of sharing of personal data with Data fiduciary.
- Retain records shall be maintained for at least a minimum of seven years.
- It shall undertake reasonable security safeguards to prevent personal data breach.
- Ensure transparency and take measures to prevent conflict of interest.
- It shall have in place effective audit mechanism to review technical and organizational safeguards and compliance with the act/rules
Integration of the Data Fiduciary functions managing consent
So, for the organizations who choose to manage consent themselves, the compliance deadline shifts from May 2027 to upcoming 13 November 2026 when the consent related provisions come into force. Such organizations become both Data Fiduciary and consent manager for their data principals. They must independently establish systems and processes that enable individuals to exercise their consent-related choices and ensure that consent is obtained and managed in accordance with the law
Data fiduciaries will need to undertake data mapping exercises to map data whether supported by consent and the applicable notices. The problem area will apply to the legacy data which has been processed before the coming in force of this act
For fiduciaries manner of recording consent as well providing infrastructure to withdraw consent becomes operational. Organization shall undertake further audit mechanism as well as imposing audit trails for technical controls and safeguards for either inhouse consent management system or outsourced consent management systems to stay within the compliance parameter.
The mandatory requirements of managing consent
- Organizations should undertake an assessment of their existing consent collection mechanisms across websites, applications, customer portals, registration forms and other digital interfaces.
- Existing consent practices should be reviewed to identify bundled consent requests, unclear consent language, pre-ticked boxes and mechanisms that do not provide individuals with meaningful control over their choices.
- Establishing an internal consent management system that maintains a consolidated record of consent-related transactions
- Organizations should ensure that withdrawal mechanisms are readily accessible and not unnecessarily complicated.
- Implementation of appropriate technical and organizational safeguards.
- Review of privacy notices and consent interfaces to ensure they are in compliance with the provisions of the DPDP Act and applicable rules.
May 2027 Compliance Milestone
While the November 2026 deadline primarily concerns the registration and obligations of Consent Managers, organizations should not limit their compliance efforts to consent management alone.
The next significant milestone is May 13, 2027 when the principal operational obligations under the DPDP Rules are scheduled to come into force.
These include requirements concerning:
- Notice to Data Principals under Rule 3
- Reasonable security safeguards under Rule 6
- Personal Data breach notification under Rule 7
- Data retention and erasure under Rule 8
- Publication of contact information under Rule 9
- Verifiable parental consent and processing of children’s personal data under Rule 10
- Additional obligations applicable to Significant Data Fiduciaries under Rule 13.
The key is to ensure that consent is not merely collected, but is effectively managed, demonstrable and capable of being acted upon throughout the data processing lifecyle.