What a Consent Manager is
- An entity registered with the Data Protection Board, subject to prescribed conditions
- Accountable to the Data Principal, not to the Data Fiduciaries it connects
- A single interface to give, manage, review and withdraw consent
- Required to be interoperable and to keep records of the consents it mediates
Why the design matters
Accountability running to the Data Principal is the important detail. A Consent Manager is not a vendor you engage to make your consent problem smaller; it is a party acting for the individual, which changes how disputes, withdrawals and record-keeping play out.
The model will be familiar to anyone who has worked with Account Aggregators in financial services — a neutral intermediary standing between the person and the institutions holding their data.
What integrating asks of you
- Accept consent artefacts that originate outside your own systems and treat them as authoritative
- Honour withdrawals arriving through the Consent Manager as promptly as ones raised directly
- Map consent to purposes in a way that survives translation between systems
- Keep your own record of what was received and when, and reconcile it
Withdrawal is the hard part
Capturing consent through a new channel is straightforward. Honouring a withdrawal that arrives through it is not, because the withdrawal has to propagate to every downstream system and processor that received data under the original consent, and you need to be able to show it did. Build the propagation and the evidence trail before you need them.
Preparing without over-committing
Registration conditions and operational detail sit with the Rules and the Board, and the ecosystem is still forming. The sensible preparation is architectural rather than speculative: hold consent per purpose rather than per person, keep an append-only record of every grant and withdrawal with the notice version shown, and make withdrawal propagation a first-class capability. That work pays off regardless of how the Consent Manager market develops.
This guide is educational and general in nature — it is not legal advice. Confirm specific obligations against the DPDP Act, 2023, the DPDP Rules, 2025 and any sectoral regulations that apply to you.