Concept
Consent Manager
A person registered with the Board who gives individuals a single point of contact to give, manage, review and withdraw their consent through an accessible, transparent and interoperable platform. Registration rests on section 6(9) of the Act and Rule 4, which applies the conditions and obligations in the First Schedule. Both commence on 13 November 2026, a date computed from the notifications, so treat it as interpretation until officially confirmed. The duty under section 6(8) to act on the individual's behalf follows on a computed 13 May 2027, on the same basis.
“Consent Manager” means a person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform
Read section 2 of the Act, where this term is defined →Rule 4 of the DPDP Rules 2025 →
What the definition covers
Plain English
Section 2(g) defines a Consent Manager as a person registered with the Board who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform. Section 6(7) lets a Data Principal give, manage, review or withdraw her consent to a Data Fiduciary through a Consent Manager. Section 6(8) makes the Consent Manager accountable to the Data Principal and requires it to act on her behalf in the manner and subject to the obligations prescribed, and section 6(9) requires every Consent Manager to be registered with the Board in the manner and subject to the technical, operational, financial and other conditions prescribed. The definition has been in force since 13 November 2025. Section 6(9) commences on 13 November 2026 under paragraph (b) of the commencement notification, and sections 6(7) and 6(8) on 13 May 2027 under paragraph (c); both dates are computed, so treat them as interpretation until officially confirmed.
Articles that use this term
- Consent Manager registration under DPDP: 9 conditions and 13 obligations →
- Do you need to register as a Consent Manager? Rule 4 and who it applies to →
- DPDP Rules 2025 corrigendum G.S.R. 892(E): all 8 corrections →
- DPDP vs GDPR: key differences for Indian businesses (2026) →
- DPDP consent requirements: what section 6 actually demands →
- DPDP grievance redressal: what Rule 14(3) says about 90 days →
- Data Principal rights under the DPDP Act: sections 11 to 14 →
- DPDP data retention and erasure: Rule 8 and the 2 minimum floors →
- What must a DPDP privacy notice contain? Section 5 and Rule 3 →
Sources cited on this page
- [1]The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(g), p. 2. Published 11 August 2023. Official source ↗ · Official requirement · Verified 17 August 2026In force since 13 November 2025Also cited on this page · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026
- [2]The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 6(7), p. 6. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Phased commencement; it commences in 2 parts: sub section (9) on the computed date 13 November 2026, which is interpretation until officially confirmed, then the rest on the computed date 13 May 2027, which is interpretation until officially confirmed
The Data Principal may give, manage, review or withdraw her consent to the Data Fiduciary through a Consent Manager.
- [3]The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 6(8), p. 6. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Phased commencement; it commences in 2 parts: sub section (9) on the computed date 13 November 2026, which is interpretation until officially confirmed, then the rest on the computed date 13 May 2027, which is interpretation until officially confirmed
The Consent Manager shall be accountable to the Data Principal and shall act on her behalf in such manner and subject to such obligations as may be prescribed.
- [4]The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 6(9), p. 6. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Phased commencement; it commences in 2 parts: sub section (9) on the computed date 13 November 2026, which is interpretation until officially confirmed, then the rest on the computed date 13 May 2027, which is interpretation until officially confirmed
Every Consent Manager shall be registered with the Board in such manner and subject to such technical, operational, financial and other conditions as may be prescribed.
- [5]Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (a), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Document status: published; in effect per its own terms
the date of publication of this notification in the Official Gazette as the date on which the provisions of sub-section (2) of section 1, section 2
- [6]Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (b), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 23 October 2026Document status: published; in effect per its own terms
one year from the date of publication of this gazette on which the provisions of sub-section (9) of section 6 and clause (d) of sub-section (1) of section 27 of the said Act shall come into force.
- [7]Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 23 October 2026Document status: published; in effect per its own terms
eighteen months from the date of publication of this gazette, on which the provision of sections 3 to 5, sub-sections (1) to (8) and (10) of section 6,sections 7 to 10, sections 11 to 17, section 27 except clause (d) of sub-section (1) of the said section, sections 28 to 34, 36, 37 and sub-section (2) of section 44 of the said Act shall come into force.