The DPDP Rules 2025 give statutory shape to a figure that did not exist in Indian data law before: the Consent Manager, a registered intermediary through which individuals can give, review and withdraw consent across the businesses that hold their data. Understanding what it must be, and what it is not, is now part of every data fiduciary's architecture.
The Digital Personal Data Protection Act, 2023 introduced the idea of a Consent Manager in a single clause, and the Digital Personal Data Protection Rules, 2025, notified on 13 November 2025, give it operational form. The concept answers a real failure of the consent model as it has existed: individuals grant consent to dozens of organisations through dozens of incompatible interfaces, and then have no practical way to see what they have agreed to or to withdraw it. The Consent Manager is designed to be the single, interoperable point through which a data principal can give, review, manage and withdraw consent across multiple data fiduciaries.
Crucially, the Consent Manager is a regulated entity, not a mere software feature. Under the Rules, it must be a company incorporated in India, must meet a prescribed financial-soundness threshold with a net worth of not less than two crore rupees, and must be registered with the Data Protection Board of India. It is important to use the correct name: the regulator under this regime is the Data Protection Board, and the Consent Manager answers to the Board and is subject to its directions. This is a licensing-style regime, and an entity that wishes to operate as a Consent Manager steps into a defined and supervised role rather than simply launching a product.
The obligations attached to the role are fiduciary in character. The Consent Manager is required to act in the interests of the data principal, to maintain an interoperable platform that allows consent to be managed across fiduciaries, to keep records of consents given and withdrawn, and to avoid conflicts of interest in the conduct of its business. The design intent is that the individual, not the business holding the data, sits at the centre of the consent relationship, with the Consent Manager as a neutral custodian of that relationship rather than a party monetising it. That neutrality is a legal duty, and a breach of it is a regulatory matter.
For ordinary businesses, those that are data fiduciaries rather than aspiring Consent Managers, the significance is different but no less concrete. A data fiduciary will increasingly have to be able to receive, honour and act on consent signals that arrive through a Consent Manager, including, critically, withdrawal signals. A system that can capture consent at the point of collection but cannot process a later withdrawal routed through a Consent Manager is not compliant with the architecture the Rules envisage. The practical requirement is that consent must be as easy to withdraw as it was to give, and the fiduciary's systems must be built to make that true in fact.
The grey area that organisations underestimate is integration readiness. The Consent Manager framework assumes interoperability, and interoperability assumes that fiduciaries have mapped their own consent flows, can expose and consume consent artefacts in a standard way, and can propagate a withdrawal through downstream processing and to data processors acting on their behalf. Many organisations today hold consent as a flag in a database rather than as a living, revocable instruction that moves through their systems and their vendors. Closing that gap is engineering work, not merely policy drafting, and it cannot be done at the moment the first withdrawal arrives.
The disciplined approach is to treat the Consent Manager not as someone else's product but as a fixed point in your own compliance design. For a fiduciary, that means building consent and withdrawal as interoperable, auditable instructions and aligning processor contracts so that withdrawal actually stops downstream processing. For an entity that genuinely intends to operate as a Consent Manager, it means meeting the incorporation, net-worth and registration conditions and standing up a conflict-free, Board-accountable platform. That is the work AMLEGALS structures for both kinds of client, so that consent becomes a system that can be trusted rather than a checkbox that cannot be unchecked.
