Consent Managers under the DPDP Act

A Consent Manager is a person registered with the Data Protection Board of India who helps an individual control consent for the processing of personal data. Under Section 2(g) of the Digital Personal Data Protection Act, 2023, it enables a Data Principal to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform.

Core functions

The Consent Manager provides a common interface between the Data Principal and entities seeking to process personal data.

• It acts as a single point of contact through which the Data Principal can give consent.
• It enables the Data Principal to manage and review previously granted consents across participating platforms.
• It allows consent to be withdrawn through the same accessible interface.
• Its platform must be accessible, transparent and interoperable, allowing consent choices to operate across different systems.

Accountability and regulatory status

Under Section 6(8), the Consent Manager is accountable to the Data Principal and must act on her behalf, subject to prescribed conditions.

• Every Consent Manager must be registered with the Data Protection Board of India and satisfy prescribed technical, operational, financial and other conditions.
• Using a Consent Manager does not dilute the statutory standard of consent, which must remain free, specific, informed, unconditional and unambiguous.
• After withdrawal, the Data Fiduciary must stop processing and cause its processors to stop within a reasonable time, unless continued processing is legally authorised or required.
• Withdrawal does not affect the lawfulness of processing undertaken before consent was withdrawn.