The Consent Manager framework under Rule 4 creates a new category of regulated entity — an interoperable platform that manages consent on behalf of Data Principals across Data Fiduciaries. AMLEGALS advises entities on registration, platform design, fiduciary obligations and Board compliance.
The Consent Manager is a concept unique to the Indian data protection framework. Unlike the GDPR, which has no equivalent intermediary, the DPDPA creates a regulated platform that sits between Data Principals and Data Fiduciaries, enabling individuals to manage consent across multiple service providers through a single interface. The framework draws from the Account Aggregator model in financial services (RBI’s NBFC-AA framework) — a fiduciary intermediary that facilitates data flow without accessing the data itself.
AMLEGALS advises entities seeking to enter the Consent Manager space on the full lifecycle: corporate structuring (the entity must be an Indian company, not controlled by a Data Fiduciary), net-worth certification (₹2 crore minimum), Board registration application, platform design (interoperability, consent-transaction audit trail, Data Principal interface, Data Fiduciary API integration), ongoing compliance obligations and Board reporting. The practice also advises Data Fiduciaries on integrating with registered Consent Managers, including API design, real-time consent synchronisation and consent-withdrawal workflow.
Structuring the entity to meet registration eligibility — Indian incorporation, independence from Data Fiduciaries, minimum net worth certification.
Preparing and filing the Consent Manager registration application with the Data Protection Board under Rule 4.
Advising on platform architecture — interoperability standards, consent-transaction audit trail, Data Principal interface and Data Fiduciary API integration.
Building the internal governance framework: data-access restrictions, anti-profiling controls, consent-data segregation and conflict-of-interest policies.
Advising Data Fiduciaries on integrating with Consent Managers: API design, real-time consent synchronisation and withdrawal workflows.
Establishing the reporting, audit and compliance framework for ongoing Board obligations post-registration.
A Consent Manager is an entity registered with the Data Protection Board under Rule 4 of the DPDP Rules 2025. It acts as a single point of contact for a Data Principal to give, manage, review and withdraw consent across multiple Data Fiduciaries through an accessible, transparent and interoperable platform. The Consent Manager is accountable to the Data Principal and must act in the Data Principal’s interest, not the Data Fiduciary’s.
Rule 4 and the Consent Manager provisions of the DPDP Rules 2025 commence on 13 November 2026. From that date, entities seeking to operate as Consent Managers must apply for registration with the Data Protection Board.
An entity seeking registration as a Consent Manager must: be a company incorporated in India, have a minimum net worth of ₹2 crore (as certified by a practising chartered accountant), not be a Data Fiduciary or an entity controlled by a Data Fiduciary, demonstrate the technical capability to operate an interoperable consent-management platform and comply with the conditions prescribed by the Board.
A registered Consent Manager must: enable Data Principals to give, manage, review and withdraw consent through a single platform, maintain an auditable record of every consent transaction, operate on an interoperable basis (the platform must work across Data Fiduciaries and not create lock-in), not access the personal data passing through its platform for its own purposes, not engage in profiling or targeted advertising using consent data, and report to the Board as prescribed.
Data Fiduciaries must integrate with registered Consent Managers to enable Data Principals to manage consent through the Consent Manager’s platform. This requires API integration, real-time consent status synchronisation and the ability to honour consent withdrawal received through a Consent Manager as if received directly from the Data Principal. The integration timeline follows the 13 November 2026 commencement.
No. No engagement is treated as accepted until conflicts, scope and terms are confirmed in writing.
Share the platform concept for a confidential assessment of Consent Manager registration requirements.