Consent Manager integration checklist for Data Fiduciaries

From 13 November 2026, companies can apply to the Data Protection Board to register as Consent Managers (Rule 4 of the DPDP Rules, 2025). Once some are registered, your users may give, review and withdraw their consent to you through one of them instead of through your own website or app (Section 6(7) of the DPDP Act).

Nothing in the Act or the Rules obliges a Data Fiduciary to join a Consent Manager. But if you do, or if your customers start to expect it, the duties to give notice, honour withdrawal and prove consent stay with you. This checklist covers what to put in place.

What changes on 13 November 2026, and what doesn't

Date	What comes into force	What it means for you
13 Nov 2026	Rule 4 and the First Schedule: registration, conditions and obligations of Consent Managers (Rule 1(3)). Section 6(9), the requirement that every Consent Manager be registered with the Board	Applications open. The Board publishes the particulars of each registered Consent Manager on its website (Rule 4(2)(a))
13 May 2027	Rules 3 and 5–16 (Rule 1(4)), and the rest of Section 6 including 6(7)	Your notice, security, rights and grievance duties apply, and so does the Data Principal's right to act through a Consent Manager

So 13 November 2026 is not a deadline for Data Fiduciaries. It is the start of the registration process. The first registered Consent Managers will need an Indian company, a net worth of at least ₹2 crore and an independently certified platform (First Schedule, Part A), so expect them to appear gradually. For the full rollout, see the DPDP Rules 2025 timeline; for the registration conditions, see Consent Manager registration under Rule 4.

How consent reaches you through a Consent Manager

Section 2(g) defines a Consent Manager as a registered person that acts as a single point of contact for a Data Principal to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform. It acts for the individual, not for you (Section 6(8)).

Part B, item 1 of the First Schedule says a Consent Manager must let a person give consent to a Data Fiduciary onboarded onto its platform in one of two ways. The Rules illustrate them with a platform P, a user X and two banks, B1 and B2:

1. Directly. B1 sends X a consent request on P. X gives consent to B1 on P and gives B1 access to her bank statement, which she keeps in her digital locker.
2. Routed through another Data Fiduciary. X banks with B2. She uses P to route her consent through B2 to B1, and instructs B2 to send her statement to B1.

Two other obligations shape how you integrate:

• The Consent Manager cannot read the data. Personal data must be made available or shared so that its contents are not readable by the Consent Manager (Part B, item 2). Plan for the data itself to reach you from the source, with the Consent Manager carrying the consent and the instruction.
• It keeps its own record, for the individual. The Consent Manager records consents given, denied and withdrawn, the notices that came with them, and any sharing of personal data with a transferee Data Fiduciary, and keeps that record for at least seven years (Part B, items 3 and 4). That record serves the Data Principal. It does not replace yours.

The checklist

1. Decide whether to onboard

Nothing in the Act or the Rules obliges you to onboard onto a Consent Manager. Weigh it against how your users already give consent, and whether partners in your sector (for example, banks exchanging statements) are likely to use one. Revisit the decision once registered Consent Managers exist.

2. Check that a Consent Manager is registered

Before you onboard, look the Consent Manager up on the Board's website, where the Board publishes the particulars of every registered Consent Manager (Rule 4(2)(a)). A vendor that calls itself a "Consent Manager" but is not on that list is not one under the DPDP Act.

3. Review its published disclosures

Each Consent Manager must publish its promoters, directors, key managerial personnel and senior management, every shareholder above 2%, and every company in which those people hold more than 2% (Part B, item 11). It must also avoid conflicts of interest with Data Fiduciaries (Part B, items 9 and 10). Check these before you sign up, especially if your group has links to the Consent Manager.

4. Keep your own notice

Every request for consent must be accompanied or preceded by your notice (Section 5(1)). From 13 May 2027, Rule 3 sets what it must contain: an itemised description of the personal data, the specified purposes, and how to withdraw, exercise rights and complain to the Board. Make sure your notice travels with each consent request you send through the Consent Manager, and version it. See the DPDP consent notice checklist.

5. Record every consent yourself

If a question arises in a proceeding, you must prove that notice was given and consent obtained (Section 6(10)). For every consent received through a Consent Manager, keep your own record of:

• who consented (your identifier for the user);
• the purposes and the notice version shown;
• the channel (which Consent Manager, direct or routed);
• the time, and any reference the Consent Manager supplies.

6. Wire withdrawal end to end

A Data Principal may withdraw at any time, as easily as she gave consent (Section 6(4)). When a withdrawal arrives through a Consent Manager, you must stop processing within a reasonable time and make your Data Processors stop too (Section 6(6)). Map every system and processor that uses the data, and test that a withdrawal received from the Consent Manager reaches all of them. Section 6(5) keeps processing done before the withdrawal lawful. See withdrawal of consent under the DPDP Act for erasure and the other steps that follow.

7. Keep rights and grievances working

Users who consent through a Consent Manager keep their rights against you: access, correction, erasure, nomination and grievance redressal (Sections 11 to 14). The Consent Manager must run its own grievance system (Section 13(1)), but that does not replace yours. From 13 May 2027, Rule 14 requires you to publish how to make a rights request and to respond to grievances within a period of no more than 90 days.

8. Secure the connection

You must protect personal data in your possession or under your control, including data processed for you by a Data Processor, with reasonable security safeguards (Section 8(5)). Treat the Consent Manager connection as an external interface: authenticate messages, log them, and limit what each one can change.

9. Watch for the Board's standards

Every Consent Manager's platform must be certified against data protection standards and an assurance framework published by the Board (Part A, item 9(a)). Those standards will likely shape the technical interface you connect to. Track the Board's website for them before you build anything specific.

10. Test the full journey

Before going live, run each path end to end: consent given directly, consent routed through another Data Fiduciary, a review, a withdrawal, a rights request and a grievance. Confirm that your own records prove each step.

Frequently asked questions

Do we have to join a Consent Manager?

Nothing in the Act or the Rules requires it. Section 6(7) gives the Data Principal the option to act through one.

Does the Consent Manager's record prove our consent?

Not on its own. Section 6(10) puts the burden of proof on the Data Fiduciary, so keep your own records.

Do we sign a contract with the Consent Manager?

The Rules do not prescribe one. Onboarding terms are likely, but their content is for you and the Consent Manager to agree.

Where Consentrio fits

Consentrio is a consent management platform for Data Fiduciaries. It is not a registered Consent Manager. It covers the records you keep whichever channel consent arrives through: versioned notices, consent capture through web, mobile and server SDKs, a preference centre for withdrawal, rights and grievance handling, signed notifications to processors, and a tamper-evident audit trail that proves each consent.

For the difference between the two roles, see Consent Manager vs consent management platform.