Consent manager A registered platform that lets a person give and withdraw consent in one place.
Short answer. A consent manager is a person registered with the Data Protection Board of India who acts as a single point of contact for a data principal to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform. The definition is in section 2(g) of the Digital Personal Data Protection Act, 2023; section 6(7) to 6(9) let people manage consent through one and require it to be registered. The DPDP Rules, 2025 set the conditions: the applicant must be a company incorporated in India with a net worth of at least ₹2 crore, and it must share data in a way that it cannot read. Rule 4, on registration, comes into force one year after the Rules were published. Most offices will meet consent managers as a fiduciary receiving consent, not as one. This is general information, not legal advice.
01
Conditions for registration
Part A of the First Schedule to the DPDP Rules, 2025 lists the conditions an applicant must meet, including these:
The applicant is a company incorporated in India.
It has sufficient technical, operational and financial capacity.
Its net worth is not less than two crore rupees.
Its directors, key managerial personnel and senior management have a reputation for fairness and integrity.
Its platform is independently certified as consistent with the data protection standards the Board publishes.
Its proposed operations are in the interests of data principals.
02
Obligations once registered
Obligation
First Schedule, Part B
Detail
Cannot read the data
Item 2
Data must be made available or shared so that its contents are not readable by the consent manager.
Keep a record
Items 3 and 4
Consents given, denied or withdrawn, the notices, and data sharing, kept at least seven years and given to the person in machine-readable form on request.
No sub-contracting
Item 6
It may not sub-contract or assign its obligations under the Act and the Rules.
Fiduciary capacity
Item 8
It acts in a fiduciary capacity towards the data principal.
No conflicts of interest
Items 9 and 10
It avoids conflicts with data fiduciaries, including through its directors and key managerial personnel.
Audit
Item 12
It reports the outcome of audits of its controls and conditions to the Board.
03
How it works: the Rules’ own example
The worked example in Part B describes a platform P run by a consent manager. Bank B1 asks X, through P, for consent to process her bank account statement. X can give consent to B1 directly, or route it through her own bank B2 and instruct B2 to send the statement to B1. Either way, P records the consent but cannot read the statement.
For an office, the practical effect is that a client may give or withdraw consent through such a platform, and the office, as data fiduciary, must act on a withdrawal. Section 6(6) requires it to stop processing within a reasonable time and to make its data processors stop too, unless a law requires or allows the processing to continue.
04
Timing and status
Rule 4 comes into force one year after the DPDP Rules, 2025 were published in the Gazette dated 13 November 2025 (rule 1(3)). Under rule 4(2) the Board publishes the particulars of each registered consent manager on its website, so check there for registrations as of October 2026. The Board can suspend or cancel a registration under rule 4(5).
This page is general information, not legal advice. Ask a lawyer how the law applies to your office.
05
Questions people ask
Does my office have to use a consent manager?
No. Section 6(7) says a data principal may give or withdraw consent through a consent manager; it is an option for the person, not a duty for the fiduciary.
Can a consent manager see the documents it routes?
No. Item 2 of Part B of the First Schedule requires sharing to be done so that the contents are not readable by the consent manager.
Can a foreign company be a consent manager?
No. The first condition in Part A of the First Schedule is that the applicant is a company incorporated in India.
Who supervises consent managers?
The Data Protection Board. It registers them, can inquire into their breaches under section 27(1)(c) and (d), and can suspend or cancel a registration under rule 4(5).
06
What is not real yet
No sealed ANVE unit exists; every image of the appliance on this site is a labelled render. The software runs today on a development machine. No customers yet, no certifications, no delivery date, and the final price is not announced.
Reservations are ₹999 in India or US$12 elsewhere, refundable in full until you confirm an order in writing (terms). Offices that cannot use cloud AI can apply to be one of ten design partners.
