{"id":374099,"date":"2026-01-30T09:00:19","date_gmt":"2026-01-30T03:30:19","guid":{"rendered":"https:\/\/www.scconline.com\/blog\/?p=374099"},"modified":"2026-01-30T09:17:49","modified_gmt":"2026-01-30T03:47:49","slug":"consent-manager-conundrum-dpdpa-data-fiduciary-data-processor","status":"publish","type":"post","link":"https:\/\/www.scconline.com\/blog\/post\/2026\/01\/30\/consent-manager-conundrum-dpdpa-data-fiduciary-data-processor\/","title":{"rendered":"The Consent Manager Conundrum"},"content":{"rendered":"
\n

There is a lack of clarity on Consent Managers’ role qualification when they are engaged by a third party, that is, if they function as a data fiduciary or data processor when collecting and managing consent for a third party.<\/p>\n

As the Digital Personal Data Protection Act, 2023<\/a> (DPDPA) comes to force in a phased manner, the provisions pertaining to Consent Managers will come to force in one year from the date of publication of the rules in the Official Gazette, 15 November 2025. Though one year appears to be a long time, the time sense of the businesses focusing on achieving preset goals gets distorted, eventually causing the new compliance to be sidelined till the last moment leaving it as an open risk.<\/span><\/p>\n

A Consent Manager<\/span>1<\/sup><\/a> has the duty of collecting and managing consent under DPDPA<\/a><\/span>2<\/sup><\/a>. However, there is a lack of clarity on their role qualification when they are engaged by a third party, that is, if they function as a data fiduciary or data processor when collecting and managing consent for a third party. This article aims to clarify this point by interpreting the legal framework around the nature of the role of Consent Managers in the context of the duty performed by them. In the process, this article will discuss the fundamental process of assessing any data processing activity with the help of an illustration for easier understanding.<\/span><\/p>\n

Context of the data processing activity<\/h2>\n

The foremost step in assessing any data processing activity is to understand the context of that specific data processing activity. Context of data processing activity for any specific activity includes certain essential elements like the purpose for which the personal data is being processed, the kinds of processing activities that the data will undergo, the kinds of personal data categories that are being processed, the stakeholders (parties) involved in the activities along with a few more elements not really pertinent to the scope of this article.<\/p>\n

Each of the elements mentioned above acts as a building block and ultimately reveals the whole context of processing. Data processing activities by institutions involve numerous contexts like processing for providing goods\/services, for marketing, for meeting regulatory requirements, etc. It is important that only one specific data processing activity should be considered when analysing the context, as considering many activities will lead to intertwining of the activities and failure in identifying the correct data flow. Consent Managers are usually one of the stakeholders in the data processing activity, facing the customers.<\/p>\n

The importance of isolating the context can be explained with the following scenario:<\/p>\n

Say Company AB<\/span> has 2000 employees, and its object is to sell books online. The company also employs the services of Company XY<\/span> for disbursing salaries of its employees and Company DE<\/span> to manage consent of its online customers. A diagram below will aid in visualising the activities of Company AB<\/span>.<\/p>\n

\"\"<\/p>\n

For the activity of selling books to customers online, let us assume the data processed is name, address, phone number, email ID and the customer’s consent, where it has been given. In this data flow, there is also a Consent Manager, Company DE<\/span> that manages consent given by the online customers.<\/p>\n

For the other activity of disbursing salaries, employees’ data will be processed by the company and let us assume that name, address, work identification number, time period worked per month, vacations taken, pension details are processed. Company XY<\/span> will process these details to disburse salaries to the employees of Company AB<\/span>.<\/p>\n

It should be appreciated that Company AB<\/span> is doing two separate personal data processing activities depending on the target data principals and the type of data that is processed, etc.—<\/p>\n

(1) selling books to online customers (depicted on the left side) and Company DE<\/span> acting as a Consent Manager; and<\/p>\n

(2) disbursing salaries to its employees (depicted on the right side) by engaging the services of Company XY<\/span> for the disbursement.<\/p>\n

In this illustration the personal data is being processed in two different contexts. For the purpose of understanding the role of the Consent Manager, the focus will be solely on the left side of the diagram that has the Consent Manager in the loop. In real life, the data flow is usually way more complicated than the illustration and will involve many stakeholders and activities. But no matter how complex, if one picks a<\/span> specific activity and maps the data flow, the context for that specific activity becomes apparent. Fixing the context will help in the qualifying roles for the stakeholders which is the next step.<\/span><\/p>\n

There are legal principles applicable even in the context isolation step like purpose specification<\/span>3<\/sup><\/a>, data limitation, however they fall outside the scope the purpose of this article.<\/span><\/p>\n

Role qualification of Consent Manager<\/h2>\n

Now that the context has been isolated, role qualification is the next important step in assessing any personal data processing activity. Simply stated, it is a step that pins the role that each stakeholder takes on in the data processing activity. This is depending on the activity they perform. Three roles with varying obligations and liabilities under the DPDPA<\/a> are data fiduciary, data processor and data principals.<\/p>\n

Essentially role qualification helps in pinpointing the data fiduciary, data processors and data principal in the data flow. As the data processing activities can get very complicated, sometimes involving multiple data fiduciaries and processors, independent or joint, this step clearly sets the legal perimeter of operation along with laying out their rights and obligations.<\/p>\n

Identifying data principal<\/h2>\n

For discussing the roles of stakeholder, the left side activity in the illustration may be considered, as the ultimate goal is to understand the role of a Consent Manager. Section 2(j<\/span>)<\/span><\/a><\/span> DPDPA<\/a> defines data principals as<\/span> “…means the individual to whom the personal data relates and where such individual…”.4<\/sup><\/a><\/p>\n

It is self-explanatory that the persons to whom the personal data belong are data principals and, in our illustration, the online customers are data principals. There is hard-and-fast rule as to which roles must be identified first, but identifying data principals is the easiest of all and gives an overview on the extra-territorial application of Indian law and other laws to be considered.<\/p>\n

Identifying data fiduciary\/controller<\/h2>\n

After identifying the data principals the next step is to identify data fiduciary or data fiduciaries, if there are more. The DPDPA<\/a> defines this term under Section 2(i<\/span>)<\/span><\/a><\/span>5<\/sup><\/a> as someone that determined the “purpose and means of processing”. It may be a legal or natural person.<\/span><\/p>\n

This language has been borrowed from General Data Protection Regulation, 2018 (GDPR)6<\/sup><\/a>. Article 4(7) defines “Controller” as—<\/p>\n

…means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;<\/p>\n

The European Data Protection Board (EDPB)7<\/sup><\/a> published guideline — “Guidelines 07\/2020 on the Concepts of Controller and Processor in the GDPR” which helps in interpreting the terms “means and purpose”8<\/sup><\/a>. The authority explains that the party that determines the “why” and the “how” of the data processing activity meaning “why is the activity taking place or to what for” and “how is the objective achieved” will fall under the category of controller.9<\/sup><\/a> There should exist a supervisory\/constructive control or a “level of influence”10<\/sup><\/a> over the data processing activity.<\/p>\n

This is important as the authorities anticipate that processors sometime have room for making technical decisions when they are engaged by the controllers\/data fiduciaries which may give an impression as if the processors determine the “means” of processing and take up the role of controllers. However, in such cases the “purpose” of processing will determine the controller\/data fiduciary. As the data fiduciary\/controller may lack the knowhow for implementing the technical requirements for achieving their goals, this room for making decision is given to the processors. If the Controller decided to engage a data processor for its technical specialisation, it might seem like the processor controls the “means” of the assignment, but it does not. In such cases where a processor is engaged by the controller, the person who determines the “purpose” is the controller.<\/p>\n

In a fairly recent case law, C-683\/2111<\/sup><\/a>, the European Court of Justice (EUCJ) discussed the role of a controller in the context of data processing activity and its liabilities. The facts of the case in brief are — during the COVID<\/span>-19 Pandemic, Minister for Health of the Republic of Lithuania [Nacionalinis Visuomen\u0117s Sveikatos Centras (NVSC)] wanted to commission a mobile application for tracking the infected persons in Lithuania. UAB “IT sprendimai s\u0117kmei” (ITSS), a technology-based company, was shortlisted and selected for developing the app. NVSC gave instructions to ITSS for developing the application and a confidential policy was agreed between both the parties which styled both the parties as controllers. After the app was developed it was made available to the Lithuanian public via Google Play Store. The application processed the ID number, geographical coordinates (latitude and longitude), country, city, municipality, postcode, street name, building number, surname, first name, personal identification number, telephone number and address of its users (Lithuanians).<\/p>\n

NVSC had the intention of procuring the app from ITSS, but the transaction did not go through due to financial reasons. The Lithuanian Data Protection Authority imposed fine on NVSC on the ground that they were the controllers of the data and the personal data collected through the app was not handled properly as the project was abandoned. Among other grounds, NVSC argued that it did not qualify as a controller because it did not even receive the data that was processed by the mobile application and there was no contract with ITSS. The EUCJ held that existence or non-existence of contract was not essential for determining controller’s role. Anyone that exerts influence over processing of personal data and participates in determination of means and purpose will become a controller.12<\/sup><\/a> In this case, the app was commissioned by NVSC to keep track of COVID-19 infected persons and it also issued instructions to ITSS on how the app should be developed.13<\/sup><\/a> Hence, NVSC will qualify as a controller even if it did not receive the personal data.14<\/sup><\/a><\/p>\n

Applying the same test to the illustration under consideration, personal data of the data principals (online customers) is processed for selling books to online customers by Company AB<\/span>. So, the purpose of processing data is determined by Company AB<\/span> as it is for its own benefit. Hence, in this illustration Company AB<\/span> is a data fiduciary\/controller. The role of Company DE<\/span> still remains to be assessed and assigned. This company is a Consent Manager and it manages consent of the online customers that purchase book from Company AB<\/span>.<\/p>\n

Identifying data processor<\/h2>\n

The DPDPA<\/a> defined data processors in Section 2(k<\/span>)<\/span><\/a> as “ ‘data processor’ means any person who processes personal data on behalf of a data fiduciary”. The definition of a processor under the DPDPA<\/a> is similar to GDPR definition of processor in Article 4(8) which states “ ‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Controller”. The EDPB guideline discussed above “Guidelines 07\/2020” lays down two conditions<\/span>15<\/sup><\/a> required for a processor—<\/span><\/p>\n

(1) should be a separate entity in relation to a processor; and<\/p>\n

(2) should process personal data on behalf of the controller.<\/p>\n

The first condition is the processor should be a body independent of the controller (data fiduciary). For the second condition, the guideline goes on to describe the words “on behalf of” to mean serving someone else’s interest under instructions.<\/span>16<\/sup><\/a> It means the processor should act under the instructions of and for the benefit of the controller. It also states that the processor may process the personal data under the influence or control of the Controller. It would also mean that the data processing does not happen for their own purpose.<\/span>17<\/sup><\/a><\/span><\/p>\n

In the case previously discussed for understanding the role of controller, the EUCJ also implicitly held that ITSS<\/span> will only qualify as a processor even though mobile app was developed by it and the data processing activity was managed by it as it acted only under the instructions\/influence of NVSC.<\/span>18<\/sup><\/a><\/span> <\/span><\/p>\n

Inference on Consent Manager’s role<\/h2>\n

A Consent Manager can be understood as an agent possessing technical skills. Often times, Consent Managers are engaged to utilise the technical skills they possess that might be lacking in the data fiduciary. A Consent Manager acts as an agent of the data fiduciary when collecting the data\/consent, but also uses independent discretion and technical skills to determine the “means” to collect data\/consent. Data fiduciary being the “principal” is liable to the customers for the acts of Consent Managers.<\/span>19<\/sup><\/a><\/p>\n

Applying these tests to the role performed by Company DE<\/span>, it can be understood that this company collects and manages consent for benefit of Company AB<\/span> for the purpose of selling books online. More insight into the role of Consent Manager can be gleaned from Section 6(7)<\/a> DPDPA<\/a> which states, “The data principal may give, manage, review or withdraw her consent to the data fiduciary through a Consent Manager.” This literally reads that the consent is given to the data fiduciary through an intermediate third party, the Consent Manager. In our illustration the Company DE<\/span> does not determine the “purpose”. The purpose is determined by Company AB<\/span>. The consent collection must never be understood disjunctive from the underlying purpose of processing data which is for Company AB<\/span>‘s online book sale. Hence, Company DE<\/span> as a Consent Manager acts under the instructions of Company AB<\/span> though Company DE<\/span> has the freedom or room of operation on the deployment of the consent mechanism.<\/p>\n

Therefore, in view of the authors, a Consent Manager when collecting and managing consent for a defined purpose of a third-party data fiduciary will only act as a data processor and not a data fiduciary.<\/p>\n

Consent Manager as a data fiduciary<\/h2>\n

It is possible that in some data processing contexts, the Consent Manager may take on the role of a data fiduciary\/controller. If the means and purpose of processing data are determined by the Consent Manager, then they enter the shoes of a data fiduciary\/controller. Say, a Consent Manager company will be a data fiduciary\/controller when processing personal data of its own employees since the processing activity is to meet its own objectives\/purposes. In the illustration shown above, Company DE<\/span> has employees working for it. When processing the data of its own employees for disbursement of salaries, Company DE<\/span> becomes the data fiduciary\/controller. If it engages another company (Company GH<\/span>) for the said purpose, then Company GH<\/span> becomes the processor.<\/p>\n

Conclusion<\/h2>\n

Before processing personal data for any activity, it is crucial to perform an assessment of the data processing activity to determine and qualify the roles of all the stakeholders in the flow. As law imposes most of the obligations on data fiduciaries, default in compliance of the DPDPA<\/a> by data processors may be legally saddled on the data fiduciaries. Therefore, activity scoping and identifying the context, is the first important step in assessing all processes which also pave the way for role qualification of the stakeholders involved. When a data fiduciary engages the services of a third-party Consent Manager for managing consent of their customer, it must be remembered that the Consent Manager acts on behalf of the data fiduciary\/controller and will only qualify as a data processor. A Consent Manager can also be a data fiduciary depending on the context of data processing activity.<\/p>\n<\/div>\n\n

*Privacy Legal Counsel at Philips, Amsterdam, The Netherlands. Author can be reached at: hemanthsudha@gmail.com<\/a>.<\/span><\/strong><\/p>\n

**Advocate, practising at High Courts of Madras and Andhra Pradesh; Partner, M\/s Nomos Solutions. Author can be reached at: pattabhi.pramodh@gmail.com<\/a>.<\/span><\/strong><\/p>\n

1.<\/a> DPDPA<\/a>.<\/span> ,. “Consent Manager” means a person registered with the Board, who acts as a single point of contact to enable a data principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform. . “Consent Manager” means a person registered with the Board, who acts as a single point of contact to enable a data principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform.<\/span><\/p>\n

2.<\/a> DPDPA<\/a>.<\/span>, S. The data principal may give, manage, review or withdraw her consent to the data fiduciary through a Consent Manager. 6(7)<\/a>. The data principal may give, manage, review or withdraw her consent to the data fiduciary through a Consent Manager.<\/span><\/p>\n

3.<\/a> DPDPA<\/a><\/span>, S. 6(1)<\/a><\/span>. The consent given by the data principal shall be free, specific, informed, unconditional and unambiguous with a clear affirmative action, and shall signify an agreement to the processing of her personal data for the specified purpose and be limited to such personal data as is necessary for such specified purpose.<\/span><\/p>\n

4.<\/a> DPDPA<\/a>, S. 2(j<\/span>)<\/span><\/a>. “Data principal” means the individual to whom the personal data relates and where such individual is—<\/p>\n

(i<\/span>) a child, includes the parents or lawful guardian of such a child;<\/p>\n

(ii<\/span>) a person with disability, includes her lawful guardian, acting on her behalf;<\/p>\n

5.<\/a> “Data fiduciary” means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data.<\/p>\n

6.<\/a> Regulation (EU) 2016\/679 of the European Parliament and of the Council of 27-4-2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data, and Repealing Directive 95\/46\/EC (General Data Protection Regulation), available at <https:\/\/gdpr-info.eu\/art-4-gdpr\/<\/a><\/span>>.<\/p>\n

7.<\/a> European statutory body established by GDPR for consistent application of GDPR, cooperation between Member States and enforcement, available at <https:\/\/www.edpb.europa.eu\/about-edpb\/who-we-are\/european-data-protection-board_en<\/a><\/span>>.<\/p>\n

8.<\/a> Guidelines 07\/2020 on the Concepts of Controller and Processor in the GDPR (7-7-2021), p. 14, available at <https:\/\/www.edpb.europa.eu\/system\/files\/2023-10\/EDPB_guidelines_202007_controllerprocessor_final_en.pdf<\/a>>.<\/p>\n

9.<\/a> Guidelines 07\/2020 on the Concepts of Controller and Processor in the GDPR (7-7-2021), para 34, available at <https:\/\/www.edpb.europa.eu\/system\/files\/2023-10\/EDPB_guidelines_202007_controllerprocessor_final_en.pdf<\/a>>.<\/p>\n

10.<\/a> Guidelines 07\/2020 on the Concepts of Controller and Processor in the GDPR (7-7-2021), para 37 available at <https:\/\/www.edpb.europa.eu\/system\/files\/2023-10\/EDPB_guidelines_202007_controllerprocessor_final_en.pdf<\/a>>.<\/p>\n

11.<\/a> Nacionalinis visuomen\u0117s sveikatos centras prie Sveikatos apsaugos ministerijos<\/span> v. Valstybin\u0117 duomen\u0173 apsaugos inspekcija<\/span>, Case C-683\/21, judgment dated 5-12-2023 available at <https:\/\/curia.europa.eu\/juris\/document\/document.jsf?text=&docid=280324&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=7438261<\/a>>.<\/p>\n

12.<\/a> Nacionalinis visuomen\u0117s sveikatos centras prie Sveikatos apsaugos ministerijos v. Valstybin\u0117 duomen\u0173 apsaugos inspekcija<\/span>, Case C-683\/21, judgment dated 5-12-2023, para 30, available at <https:\/\/curia.europa.eu\/juris\/document\/document.jsf?text=&docid=280324&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=7438261<\/a>>.<\/p>\n

13.<\/a> Nacionalinis visuomen\u0117s sveikatos centras prie Sveikatos apsaugos ministerijos<\/span> v. Valstybin\u0117 duomen\u0173 apsaugos inspekcija<\/span>, Case C-683\/21, judgment dated 5-12-2023, para 32, available at <https:\/\/curia.europa.eu\/juris\/document\/document.jsf?text=&docid=280324&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=7438261<\/a>>.<\/p>\n

14.<\/a> Nacionalinis visuomen\u0117s sveikatos centras prie Sveikatos apsaugos ministerijos<\/span> v. Valstybin\u0117 duomen\u0173 apsaugos inspekcija<\/span>, Case C-683\/21, judgment dated 5-12-2023, paras 35, 36 and 38, available at <https:\/\/curia.europa.eu\/juris\/document\/document.jsf?text=&docid=280324&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=7438261<\/a>>.<\/p>\n

15.<\/a> Guidelines 07\/2020 on the Concepts of Controller and Processor in the GDPR (7-7-2021), p. 25, para 76, available at <https:\/\/www.edpb.europa.eu\/system\/files\/2023-10\/EDPB_guidelines_202007_controllerprocessor_final_en.pdf<\/a>>.<\/p>\n

16.<\/a> Guidelines 07\/2020 on the Concepts of Controller and Processor in the GDPR (7-7-2021), p. 26, para 80, available at <https:\/\/www.edpb.europa.eu\/system\/files\/2023-10\/EDPB_guidelines_202007_controllerprocessor_final_en.pdf<\/a>>.<\/p>\n

17.<\/a> Guidelines 07\/2020 on the Concepts of Controller and Processor in the GDPR (7-7-2021), p. 26, para 81, available at <https:\/\/www.edpb.europa.eu\/system\/files\/2023-10\/EDPB_guidelines_202007_controllerprocessor_final_en.pdf<\/a>>.<\/p>\n

18.<\/a> Nacionalinis visuomen\u0117s sveikatos centras prie Sveikatos apsaugos ministerijos<\/span> v. Valstybin\u0117 duomen\u0173 apsaugos inspekcija<\/span>, Case C-683\/21, judgment dated 5-12-2023, para 38, available at <https:\/\/curia.europa.eu\/juris\/document\/document.jsf?text=&docid=280324&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=7438261<\/a>>.<\/p>\n

19.<\/a> Versha Engg. (P) Ltd<\/span>. v. Vijay Traders<\/span>, 1982 SCC OnLine Guj 68<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

by K.P. Hemanth Kumar* and K. Pattabhi**<\/p>\n","protected":false},"author":67011,"featured_media":374143,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[20271],"tags":[97715,97714,97716,97718,60240,93391,95780,97717,97719],"class_list":["post-374099","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-experts_corner","tag-consent-management-india","tag-consent-manager-dpdpa","tag-data-fiduciary-vs-data-processor","tag-data-protection-law-india","tag-digital-personal-data-protection-act-2023","tag-dpdp-act-compliance","tag-personal-data-processing-india","tag-role-of-consent-managers","tag-scc-data-protection-analysis"],"yoast_head":"\nThe Consent Manager Conundrum under DPDP Act, 2023 | SCC Times<\/title>\n<meta name=\"description\" content=\"An analysis of Consent Managers under the DPDP Act, 2023, examining their legal role as data fiduciaries or data processors.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.scconline.com\/blog\/post\/2026\/01\/30\/consent-manager-conundrum-dpdpa-data-fiduciary-data-processor\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"The Consent Manager Conundrum\" \/>\n<meta property=\"og:description\" content=\"An analysis of Consent Managers under the DPDP Act, 2023, examining their legal role as data fiduciaries or data processors.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.scconline.com\/blog\/post\/2026\/01\/30\/consent-manager-conundrum-dpdpa-data-fiduciary-data-processor\/\" \/>\n<meta property=\"og:site_name\" content=\"SCC Times\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/scc.online\/\" \/>\n<meta property=\"article:published_time\" content=\"2026-01-30T03:30:19+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-01-30T03:47:49+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.scconline.com\/blog\/wp-content\/uploads\/2026\/01\/Consent-Manager-under-DPDP-Act.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"886\" \/>\n\t<meta property=\"og:image:height\" content=\"590\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Editor\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:title\" content=\"The Consent Manager Conundrum\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Editor\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"15 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.scconline.com\/blog\/post\/2026\/01\/30\/consent-manager-conundrum-dpdpa-data-fiduciary-data-processor\/\",\"url\":\"https:\/\/www.scconline.com\/blog\/post\/2026\/01\/30\/consent-manager-conundrum-dpdpa-data-fiduciary-data-processor\/\",\"name\":\"The Consent Manager Conundrum under DPDP Act, 2023 | SCC Times\",\"isPartOf\":{\"@id\":\"https:\/\/www.scconline.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.scconline.com\/blog\/post\/2026\/01\/30\/consent-manager-conundrum-dpdpa-data-fiduciary-data-processor\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.scconline.com\/blog\/post\/2026\/01\/30\/consent-manager-conundrum-dpdpa-data-fiduciary-data-processor\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.scconline.com\/blog\/wp-content\/uploads\/2026\/01\/Consent-Manager-under-DPDP-Act.webp\",\"datePublished\":\"2026-01-30T03:30:19+00:00\",\"dateModified\":\"2026-01-30T03:47:49+00:00\",\"author\":{\"@id\":\"https:\/\/www.scconline.com\/blog\/#\/schema\/person\/84e42bab48238baf12c7e33b3d9761fe\"},\"description\":\"An analysis of Consent Managers under the DPDP Act, 2023, examining their legal role as data fiduciaries or data processors.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.scconline.com\/blog\/post\/2026\/01\/30\/consent-manager-conundrum-dpdpa-data-fiduciary-data-processor\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.scconline.com\/blog\/post\/2026\/01\/30\/consent-manager-conundrum-dpdpa-data-fiduciary-data-processor\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.scconline.com\/blog\/post\/2026\/01\/30\/consent-manager-conundrum-dpdpa-data-fiduciary-data-processor\/#primaryimage\",\"url\":\"https:\/\/www.scconline.com\/blog\/wp-content\/uploads\/2026\/01\/Consent-Manager-under-DPDP-Act.webp\",\"contentUrl\":\"https:\/\/www.scconline.com\/blog\/wp-content\/uploads\/2026\/01\/Consent-Manager-under-DPDP-Act.webp\",\"width\":886,\"height\":590,\"caption\":\"Consent Manager under DPDP Act\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.scconline.com\/blog\/post\/2026\/01\/30\/consent-manager-conundrum-dpdpa-data-fiduciary-data-processor\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.scconline.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"The Consent Manager Conundrum\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.scconline.com\/blog\/#website\",\"url\":\"https:\/\/www.scconline.com\/blog\/\",\"name\":\"SCC Times\",\"description\":\"Bringing you the Best Analytical Legal News\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.scconline.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.scconline.com\/blog\/#\/schema\/person\/84e42bab48238baf12c7e33b3d9761fe\",\"name\":\"Editor\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.scconline.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/34e366be721c41333586de05faa13743195f5b142dcd7a015c6fabd2389521d0?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/34e366be721c41333586de05faa13743195f5b142dcd7a015c6fabd2389521d0?s=96&d=mm&r=g\",\"caption\":\"Editor\"},\"url\":\"https:\/\/www.scconline.com\/blog\/post\/author\/editor_4\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"The Consent Manager Conundrum under DPDP Act, 2023 | SCC Times","description":"An analysis of Consent Managers under the DPDP Act, 2023, examining their legal role as data fiduciaries or data processors.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.scconline.com\/blog\/post\/2026\/01\/30\/consent-manager-conundrum-dpdpa-data-fiduciary-data-processor\/","og_locale":"en_US","og_type":"article","og_title":"The Consent Manager Conundrum","og_description":"An analysis of Consent Managers under the DPDP Act, 2023, examining their legal role as data fiduciaries or data processors.","og_url":"https:\/\/www.scconline.com\/blog\/post\/2026\/01\/30\/consent-manager-conundrum-dpdpa-data-fiduciary-data-processor\/","og_site_name":"SCC Times","article_publisher":"https:\/\/www.facebook.com\/scc.online\/","article_published_time":"2026-01-30T03:30:19+00:00","article_modified_time":"2026-01-30T03:47:49+00:00","og_image":[{"width":886,"height":590,"url":"https:\/\/www.scconline.com\/blog\/wp-content\/uploads\/2026\/01\/Consent-Manager-under-DPDP-Act.jpg","type":"image\/jpeg"}],"author":"Editor","twitter_card":"summary_large_image","twitter_title":"The Consent Manager Conundrum","twitter_misc":{"Written by":"Editor","Est. reading time":"15 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.scconline.com\/blog\/post\/2026\/01\/30\/consent-manager-conundrum-dpdpa-data-fiduciary-data-processor\/","url":"https:\/\/www.scconline.com\/blog\/post\/2026\/01\/30\/consent-manager-conundrum-dpdpa-data-fiduciary-data-processor\/","name":"The Consent Manager Conundrum under DPDP Act, 2023 | SCC Times","isPartOf":{"@id":"https:\/\/www.scconline.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.scconline.com\/blog\/post\/2026\/01\/30\/consent-manager-conundrum-dpdpa-data-fiduciary-data-processor\/#primaryimage"},"image":{"@id":"https:\/\/www.scconline.com\/blog\/post\/2026\/01\/30\/consent-manager-conundrum-dpdpa-data-fiduciary-data-processor\/#primaryimage"},"thumbnailUrl":"https:\/\/www.scconline.com\/blog\/wp-content\/uploads\/2026\/01\/Consent-Manager-under-DPDP-Act.webp","datePublished":"2026-01-30T03:30:19+00:00","dateModified":"2026-01-30T03:47:49+00:00","author":{"@id":"https:\/\/www.scconline.com\/blog\/#\/schema\/person\/84e42bab48238baf12c7e33b3d9761fe"},"description":"An analysis of Consent Managers under the DPDP Act, 2023, examining their legal role as data fiduciaries or data processors.","breadcrumb":{"@id":"https:\/\/www.scconline.com\/blog\/post\/2026\/01\/30\/consent-manager-conundrum-dpdpa-data-fiduciary-data-processor\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.scconline.com\/blog\/post\/2026\/01\/30\/consent-manager-conundrum-dpdpa-data-fiduciary-data-processor\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.scconline.com\/blog\/post\/2026\/01\/30\/consent-manager-conundrum-dpdpa-data-fiduciary-data-processor\/#primaryimage","url":"https:\/\/www.scconline.com\/blog\/wp-content\/uploads\/2026\/01\/Consent-Manager-under-DPDP-Act.webp","contentUrl":"https:\/\/www.scconline.com\/blog\/wp-content\/uploads\/2026\/01\/Consent-Manager-under-DPDP-Act.webp","width":886,"height":590,"caption":"Consent Manager under DPDP Act"},{"@type":"BreadcrumbList","@id":"https:\/\/www.scconline.com\/blog\/post\/2026\/01\/30\/consent-manager-conundrum-dpdpa-data-fiduciary-data-processor\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.scconline.com\/blog\/"},{"@type":"ListItem","position":2,"name":"The Consent Manager Conundrum"}]},{"@type":"WebSite","@id":"https:\/\/www.scconline.com\/blog\/#website","url":"https:\/\/www.scconline.com\/blog\/","name":"SCC Times","description":"Bringing you the Best Analytical Legal News","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.scconline.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.scconline.com\/blog\/#\/schema\/person\/84e42bab48238baf12c7e33b3d9761fe","name":"Editor","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.scconline.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/34e366be721c41333586de05faa13743195f5b142dcd7a015c6fabd2389521d0?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/34e366be721c41333586de05faa13743195f5b142dcd7a015c6fabd2389521d0?s=96&d=mm&r=g","caption":"Editor"},"url":"https:\/\/www.scconline.com\/blog\/post\/author\/editor_4\/"}]}},"jetpack_featured_media_url":"https:\/\/www.scconline.com\/blog\/wp-content\/uploads\/2026\/01\/Consent-Manager-under-DPDP-Act.webp","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":299221,"url":"https:\/\/www.scconline.com\/blog\/post\/2023\/08\/12\/digital-personal-data-protection-bill-2023-receives-presidents-assent\/","url_meta":{"origin":374099,"position":0},"title":"Digital Personal Data Protection Bill, 2023 receives President’s assent","author":"Bhumika Indulia","date":"August 12, 2023","format":false,"excerpt":"The object of the Act is to provide for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process such personal data for lawful purposes and for matters connected therewith or incidental thereto.","rel":"","context":"In "Legislation Updates"","block_context":{"text":"Legislation Updates","link":"https:\/\/www.scconline.com\/blog\/post\/category\/legislationupdates\/"},"img":{"alt_text":"digital personal data protection act 2023","src":"https:\/\/i0.wp.com\/www.scconline.com\/blog\/wp-content\/uploads\/2023\/08\/digital-personal-data-protection-act-2023.webp?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.scconline.com\/blog\/wp-content\/uploads\/2023\/08\/digital-personal-data-protection-act-2023.webp?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.scconline.com\/blog\/wp-content\/uploads\/2023\/08\/digital-personal-data-protection-act-2023.webp?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.scconline.com\/blog\/wp-content\/uploads\/2023\/08\/digital-personal-data-protection-act-2023.webp?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":361360,"url":"https:\/\/www.scconline.com\/blog\/post\/2025\/09\/24\/joint-fiduciaries-under-the-dpdpa-the-invisible-risk-in-indias-financial-data-ecosystems\/","url_meta":{"origin":374099,"position":1},"title":"Joint Fiduciaries under the DPDPA: The Invisible Risk in India’s Financial Data Ecosystems","author":"Editor","date":"September 24, 2025","format":false,"excerpt":"by Shobit Goel*","rel":"","context":"In "Op Eds"","block_context":{"text":"Op Eds","link":"https:\/\/www.scconline.com\/blog\/post\/category\/op-ed\/legal-analysis\/"},"img":{"alt_text":"Joint Fiduciaries","src":"https:\/\/i0.wp.com\/www.scconline.com\/blog\/wp-content\/uploads\/2025\/09\/Joint-Fiduciaries.webp?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.scconline.com\/blog\/wp-content\/uploads\/2025\/09\/Joint-Fiduciaries.webp?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.scconline.com\/blog\/wp-content\/uploads\/2025\/09\/Joint-Fiduciaries.webp?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.scconline.com\/blog\/wp-content\/uploads\/2025\/09\/Joint-Fiduciaries.webp?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":340157,"url":"https:\/\/www.scconline.com\/blog\/post\/2025\/01\/31\/significant-actions-that-websites-must-take-to-be-compliant-with-indias-digital-personal-data-protection-act-2023\/","url_meta":{"origin":374099,"position":2},"title":"Significant Actions that Websites must Take to be Compliant with India’s Digital Personal Data Protection Act, 2023","author":"Bhumika Indulia","date":"January 31, 2025","format":false,"excerpt":"by Rishiraj Saha*","rel":"","context":"In "Op Eds"","block_context":{"text":"Op Eds","link":"https:\/\/www.scconline.com\/blog\/post\/category\/op-ed\/legal-analysis\/"},"img":{"alt_text":"India's Digital Personal Data Protection","src":"https:\/\/i0.wp.com\/www.scconline.com\/blog\/wp-content\/uploads\/2025\/01\/Indias-Digital-Personal-Data-Protection.webp?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.scconline.com\/blog\/wp-content\/uploads\/2025\/01\/Indias-Digital-Personal-Data-Protection.webp?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.scconline.com\/blog\/wp-content\/uploads\/2025\/01\/Indias-Digital-Personal-Data-Protection.webp?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.scconline.com\/blog\/wp-content\/uploads\/2025\/01\/Indias-Digital-Personal-Data-Protection.webp?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":334964,"url":"https:\/\/www.scconline.com\/blog\/post\/2024\/11\/13\/unravelling-consent-under-the-digital-personal-data-protection-act-2023-a-barrier-to-data-principal-rights\/","url_meta":{"origin":374099,"position":3},"title":"Unravelling \u201cConsent\u201d under the Digital Personal Data Protection Act, 2023 \u2014 A Barrier to Data Principal Rights","author":"Bhumika Indulia","date":"November 13, 2024","format":false,"excerpt":"by Gaurav Thote*","rel":"","context":"In "Op Eds"","block_context":{"text":"Op Eds","link":"https:\/\/www.scconline.com\/blog\/post\/category\/op-ed\/legal-analysis\/"},"img":{"alt_text":"Digital Personal Data Protection Act 2023","src":"https:\/\/i0.wp.com\/www.scconline.com\/blog\/wp-content\/uploads\/2024\/11\/Digital-Personal-Data-Protection-Act-2023.webp?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.scconline.com\/blog\/wp-content\/uploads\/2024\/11\/Digital-Personal-Data-Protection-Act-2023.webp?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.scconline.com\/blog\/wp-content\/uploads\/2024\/11\/Digital-Personal-Data-Protection-Act-2023.webp?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.scconline.com\/blog\/wp-content\/uploads\/2024\/11\/Digital-Personal-Data-Protection-Act-2023.webp?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":377216,"url":"https:\/\/www.scconline.com\/blog\/post\/2026\/03\/03\/informed-consent-medico-legal-data-privacy-dpdpa\/","url_meta":{"origin":374099,"position":4},"title":"Informed Consent \u2014 An Analysis from Medico-Legal and Data Privacy Perspectives","author":"Editor","date":"March 3, 2026","format":false,"excerpt":"by Aman Varma*","rel":"","context":"In "Op Eds"","block_context":{"text":"Op Eds","link":"https:\/\/www.scconline.com\/blog\/post\/category\/op-ed\/legal-analysis\/"},"img":{"alt_text":"Informed Consent Clinical Trials DPDPA","src":"https:\/\/i0.wp.com\/www.scconline.com\/blog\/wp-content\/uploads\/2026\/03\/Informed-Consent-Clinical-Trials-DPDPA.webp?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.scconline.com\/blog\/wp-content\/uploads\/2026\/03\/Informed-Consent-Clinical-Trials-DPDPA.webp?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.scconline.com\/blog\/wp-content\/uploads\/2026\/03\/Informed-Consent-Clinical-Trials-DPDPA.webp?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.scconline.com\/blog\/wp-content\/uploads\/2026\/03\/Informed-Consent-Clinical-Trials-DPDPA.webp?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":299820,"url":"https:\/\/www.scconline.com\/blog\/post\/2023\/08\/22\/indias-digital-personal-data-protection-act-2023-impact-on-hospitality-sector\/","url_meta":{"origin":374099,"position":5},"title":"India’s Digital Personal Data Protection Act, 2023 \u2014 Impact on Hospitality Sector","author":"Bhumika Indulia","date":"August 22, 2023","format":false,"excerpt":"by Supratim Chakraborty\u2020 and Himeli Chatterjee\u2020\u2020 Cite as: 2023 SCC OnLine Blog Exp 68","rel":"","context":"In "Experts Corner"","block_context":{"text":"Experts Corner","link":"https:\/\/www.scconline.com\/blog\/post\/category\/experts_corner\/"},"img":{"alt_text":"india digital personal data protection act 2023","src":"https:\/\/i0.wp.com\/www.scconline.com\/blog\/wp-content\/uploads\/2023\/08\/india-digital-personal-data-protection-act-2023.webp?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.scconline.com\/blog\/wp-content\/uploads\/2023\/08\/india-digital-personal-data-protection-act-2023.webp?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.scconline.com\/blog\/wp-content\/uploads\/2023\/08\/india-digital-personal-data-protection-act-2023.webp?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.scconline.com\/blog\/wp-content\/uploads\/2023\/08\/india-digital-personal-data-protection-act-2023.webp?resize=700%2C400&ssl=1 2x"},"classes":[]}],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/www.scconline.com\/blog\/wp-json\/wp\/v2\/posts\/374099","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.scconline.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.scconline.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.scconline.com\/blog\/wp-json\/wp\/v2\/users\/67011"}],"replies":[{"embeddable":true,"href":"https:\/\/www.scconline.com\/blog\/wp-json\/wp\/v2\/comments?post=374099"}],"version-history":[{"count":0,"href":"https:\/\/www.scconline.com\/blog\/wp-json\/wp\/v2\/posts\/374099\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.scconline.com\/blog\/wp-json\/wp\/v2\/media\/374143"}],"wp:attachment":[{"href":"https:\/\/www.scconline.com\/blog\/wp-json\/wp\/v2\/media?parent=374099"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.scconline.com\/blog\/wp-json\/wp\/v2\/categories?post=374099"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.scconline.com\/blog\/wp-json\/wp\/v2\/tags?post=374099"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}