A Consent Manager is a registered intermediary that lets a person handle consent for many organisations from one place. This page covers how that works day to day, for the person and for the Data Fiduciary asking for consent. For the definition in Sec. 2(g), what the role is not, and the Rule 4 conditions in outline, see the glossary entry Consent Manager.
Three sub-sections of Sec. 6 sit behind everything below. Sec. 6(7) makes use of a Consent Manager the Data Principal's choice ("may"), Sec. 6(8) makes it accountable to her and has it act on her behalf, and Sec. 6(9) requires registration with the Board. The direction is the point: a Data Fiduciary asks for consent, and a Consent Manager sits with the person being asked.
How it works for a Data Principal
The First Schedule, Part B, item 1, describes the mechanism. A Consent Manager enables a Data Principal using its platform to give consent to processing of her personal data by a Data Fiduciary onboarded onto the platform. She can give it directly to that Data Fiduciary, or through another Data Fiduciary onboarded onto the platform that holds the data with her consent.
The Rules' own illustration involves two banks. A bank, B1, asks the person through the platform for consent to process data in her bank statement. She can give it directly to B1, or she can route it through B2, where she banks, while instructing B2 to send the statement to B1.
The Consent Manager must keep a record of consents given, denied or withdrawn and give her access to it, retained for at least seven years (Part B, items 3 and 4). The data passes through in a way its contents are not readable by the Consent Manager (item 2).
She also keeps a grievance route. Rule 14(3) requires every Data Fiduciary and Consent Manager to publish a grievance response period of no more than ninety days.
How it works for a Data Fiduciary
For a Data Fiduciary, a Consent Manager is a channel through which valid consent can arrive. You need to be onboarded onto the Consent Manager's platform, and your requests then appear on the person's interface.
It changes less than people expect. Sec. 5 still requires a notice to accompany or precede every request for consent, and Sec. 6(1) still sets the standard for what valid consent is. The Consent Manager's record also keeps the notice (Part B, item 3(b)), which helps with Sec. 6(10): where consent is the basis of processing and a question arises in a proceeding, the Data Fiduciary must prove that notice was given and consent obtained. The Act does not say the Consent Manager's record discharges that burden for you, so keep your own as well.
Withdrawal through a Consent Manager is still withdrawal under Sec. 6(4). Sec. 6(6) then requires you to cease processing, and to cause your Data Processors to cease, within a reasonable time. A withdrawal that reaches you by this route has to be honoured the same way as one made in your own interface. See DPDP consent requirements for what valid consent has to contain.
Registration and timing
Registration conditions, supervision and cancellation are covered in the registration guide, not repeated here.
Rule 4 comes into force on 13 November 2026 (Rule 1(3)), while most duties come into force on 13 May 2027. Rule 4(1) has applicants furnish the particulars and documents the Board publishes on its website, so the process opens once the Board publishes them. This is worth rechecking after 13 November 2026.
A Consent Manager is not a consent management platform
The two get confused because the names overlap.
- A consent management platform (CMP) is software a Data Fiduciary uses itself: notices, consent capture per purpose, withdrawal, records. It is the Fiduciary's tool for meeting its own Sec. 5 and Sec. 6 duties. It needs no registration.
- A Consent Manager is a separate registered entity that works for the Data Principal across several Fiduciaries and is accountable to her under Sec. 6(8).
MyConsent+ is a consent management platform for Data Fiduciaries; it is not a registered Consent Manager. Most organisations need a CMP and nothing else, since using a Consent Manager is optional for the individual and only a Fiduciary that chooses to join one onboards onto its platform. The consent manager module shows what a CMP does, and the Act explained from the start covers where this role fits.