The Architecture of Consent: Rethinking the Consent Manager Under the DPDP Act Against the Backdrop of Phase Two Implementation

This article examines the role, registration and obligations of Consent Managers under the DPDP Act and Rules, 2025, ahead of Phase Two implementation.

Rule 4, Digital Personal Data Protection Rules, 2025 is the provision that governs the registration and obligations of a Consent Manager which comes into force on 14 November 2026, exactly one year after the Rules were published in the Official Gazette.¹ As that date approaches, organisations building their compliance architecture under the Digital Personal Data Protection Act, 2023 (the Act) are asking a question that is more basic than it first appears — whether a Consent Manager is something a data fiduciary appoints, something a data principal appoints, or both? Compliance teams routinely default to the first assumption that engaging a consent manager is a vendor decision the data fiduciary makes and controls, in the way it might engage a data processor. That assumption is not supported by the text of the Act or the Rules, and getting it wrong has direct consequences for how an organisation builds its consent architecture ahead of 14 November 2026.

The statutory anchor

Section 2(g) of the Act defines a Consent Manager as “a person registered with the Board, who acts as a single point of contact to enable a data principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform.” The definition rewards a literal reading which shows a Consent Manager as a registered facilitator of an individual’s consent and who undertakes to operate in the interests of data principals. It is not a party to the data fiduciary’s processing, and it is not described anywhere in the Act as an appointee of the data fiduciary or as a link in the fiduciary’s processing chain.

Section 6(7) of the Act confirms that the route is optional and that “the Data principal may give, manage, review or withdraw her consent to the Data Fiduciary through a Consent Manager”. The word “may” is a deliberate legislative choice. A Consent Manager is one available channel for an individual to exercise control over her consent, particularly where multiple data fiduciaries are involved, and is not a mandatory intermediary. A data fiduciary that never onboards a Consent Manager is not, for that reason alone, non-compliant.

Who actually engages a Consent Manager — the data fiduciary, the data principal, or both

Neither the Act nor the Rules use the word “appoint”. A Consent Manager is not appointed by a data fiduciary in the way an auditor or an advocate is engaged, and it is not appointed by a data principal in the way one appoints a power-of-attorney holder. It is, first and foremost, “a person registered with the Board”² and the data fiduciary and the data principal connect to that registered intermediary in two structurally different ways, neither of which amounts to appointing it. Moreover, a Consent Manager is supposed to be a company registered in India.

On the data principal’s side, the choice is hers alone. Section 6(7) is unambiguous that consent is given, managed, reviewed or withdrawn “through a Consent Manager”³ at the data principal’s own election and nothing in the Act gives a data fiduciary the power to designate, restrict, or substitute the Consent Manager an individual chooses to use. This design tracks the Data Empowerment and Protection Architecture framework published by NITI Aayog, the Government of India’s policy think tank, under which the individual selects and can change her Consent Manager and not the institution holding her data, with the intermediary structured to log consent instructions without itself holding or reading the underlying personal data.⁴

On the data fiduciary’s side, the Rules use a different, and more modest, word: “onboarded”. Part B of the First Schedule requires a Consent Manager to enable a data principal to give consent to a data fiduciary “onboarded onto its platform”.⁵ Onboarding is the data fiduciary’s own act of integrating with a Consent Manager’s platform so that data principals using that platform can reach such data fiduciary and this is a technical and commercial step independent of any statutory obligation of a data fiduciary. Nothing in the Act or the Rules compels a data fiduciary to onboard onto any Consent Manager; a data fiduciary that never does so remains free to obtain, record, and honour consent directly, subject to the Act‘s ordinary notice and consent conditions.

The result is a triangular structure and not a bilateral appointment. The data principal decides whether to route her consent through a Consent Manager and also which one. The data fiduciary as well independently decides whether to make itself reachable on that Consent Manager’s platform. The Consent Manager itself answers to neither of them as its registration runs to the Board, and Part B of the First Schedule binds it to act in the data principal’s best interest regardless of which data fiduciaries happen to be onboarded on its platform.⁶ A data fiduciary that treats onboarding as “appointing” a Consent Manager to discharge its own consent obligations misreads this legal architecture onboarding gives it a channel, not a way to delegate its statutory obligations.

The burden of proof does not move

This separation discussed above carries a direct enforcement consequence. As Section 6(10) places the burden of proving valid consent squarely on the data fiduciary. If consent is the basis for processing, and the question is raised in a proceeding, “the Data Fiduciary shall be obliged to prove that a notice was given by her to the Data Principal and consent was given by such Data principal to the Data Fiduciary in accordance with the provisions of this Act and the rules made thereunder”.⁷ The involvement of a Consent Manager does not shift this burden, mere engaging or onboarding one does not delegate the fiduciary’s own evidentiary obligation. In practice, regulatory scrutiny is therefore likely to turn less on through whom or how consent was captured and more on whether its withdrawal was honoured across every system that relied on it.

The 2025 Rules: What registration will actually require

The Digital Personal Data Protection Rules, 2025 supply the operational detail the Act leaves to delegated legislation. Rule 4 requires every Consent Manager to register with the Data Protection Board and to comply with the conditions set out in Part B of the First Schedule.⁸ Rule 4 itself is not yet in force and it commences on 14 November 2026 which means that, as matters presently stand, no entity can yet hold a valid registration as a Consent Manager under these Rules. That timing is precisely why the underlying obligations, and the onboarding structure described above, deserve close reading now, before the registration window opens and commercial pressure to onboard a Consent Manager begins.

Neutrality by design

Part B requires a Consent Manager to enable a data principal to give consent to a data fiduciary onboarded onto its platform either directly, or through another onboarded data fiduciary that already holds the relevant personal data. In both structures, the Consent Manager’s function is to carry consent instructions, not to access the personal data those instructions relate to. The Schedule makes this explicit: the manner in which personal data is made available or shared must ensure that its contents are not readable by the Consent Manager.⁹ A Consent Manager that can read the data it is meant only to gate is not, in substance, performing the role the Rules describe.

Records, retention, and the data principal’s access

The Schedule imposes a single record-keeping obligation with three distinct components. For each data principal on its platform, a Consent Manager must maintain records of her consents given, denied, or withdrawn; the notices preceding or accompanying each consent request; and instances of her personal data being shared with a transferee data fiduciary, i.e., the data fiduciary her data is transferred to under that consent, as distinct from the data fiduciary that originally held it. The Schedule does not itself define “transferee data fiduciary”; this is the natural reading within Part B’s onboarding structure, not a defined term.¹⁰ The right of access runs to all three components together: the data principal may access these records at any time, and the Consent Manager must, on her request and in accordance with its terms of service, make the information in them available to her in machine-readable form.¹¹ Each Consent Manager must retain these records for a minimum of seven years and such retention period is extendable if the data principal and the Consent Manager agree to a longer period, or if any other law requires one. The Schedule fixes this floor without separately specifying the date from which the seven years is counted.¹²

Operational and security conditions

Operationally, a Consent Manager must deliver its services through a website or application, may not subcontract or assign its statutory obligations, and must implement reasonable security safeguards against personal data breaches.¹³ These conditions keep the consent infrastructure and accountability for its security inside the registered entity. A Consent Manager cannot outsource the function that justifies its registration.

A fiduciary duty to the individual, not the platform

The most consequential condition is that a Consent Manager must act in a fiduciary capacity toward the data principal and in her best interest, independent of any commercial alignment with the data fiduciaries operating on its platform. The Schedule reinforces this with conflict-of-interest safeguards: a Consent Manager must avoid conflicts with data fiduciaries arising through its promoters, Directors, key managerial personnel, and senior management, and must ensure that none of them holds an interest or relationship capable of compromising that neutrality.¹⁴

Transparency, audit, and Board oversight

The Schedule further requires public disclosure of a Consent Manager’s ownership and management, an effective audit mechanism to review its technical and organisational controls, and periodic reporting of audit outcomes to the Board. Even a change in control of a Consent Manager requires the Board’s prior approval.¹⁵ Read together, these conditions describe a regulated, independent intermediary and not a vendor appointed by data fiduciary to substitute for the fiduciary’s own consent governance.

What does not change

None of this shifts the Act‘s allocation of accountability. A Consent Manager facilitates consent; it does not transfer responsibility for lawful processing, and it does not stand between a data fiduciary and the Board when consent is challenged. Nor is it appointed by either side in a way that lets one control the other’s obligations through it: a data principal’s selection of a Consent Manager does not bind any data fiduciary beyond what that fiduciary has itself chosen to onboard for, and a data fiduciary’s onboarding does not make the Consent Manager its agent. For organisations preparing for 14 November 2026, the practical task is not to select a Consent Manager and treat that selection as compliance. It is to first make sure that consent governance including consent notice, granularity, withdrawal mechanics, and the ability to prove all of it is sound within the organisation’s own systems and data flows. A Consent Manager can make that governance more transparent to the individual. It cannot substitute for it.