Updated · RuleFix by Vinkura
What a Consent Manager is
A Consent Manager is a company registered with the Data Protection Board that gives people one place to give, manage, review and withdraw consent across the services they use. It acts on the person's behalf and must not be able to read the personal data it carries consent for.
Rule 4: from about 13 November 2026
- Must be a company incorporated in India with a net worth of at least ₹2 crore, and meet the First Schedule's technical, operational and financial conditions.
- Registers with the Data Protection Board and keeps records of consents given, reviewed and withdrawn.
- Must avoid conflicts of interest with the Data Fiduciaries it works with.
Designing consent that works with one
- Model consent per purpose, with the notice version the person saw.
- Expose withdrawal through an API and act on it promptly, including in downstream processors.
- Keep an append-only history: grants, changes and withdrawals, each timestamped.
- Never ship consent state only to the browser; record it server-side.
This guide explains engineering work, not legal advice. Dates are counted from the Rules' notification on 13 November 2025; confirm them against the official Gazette text and your counsel, as MeitY may amend the timeline.
FAQ
When do DPDP Consent Manager rules apply?
Rule 4 applies 12 months after the Rules were notified, so from about 13 November 2026.
Do I have to use a Consent Manager?
No. The Act lets people use one, and a Data Fiduciary must honour consent given through one, but you can collect consent directly.
