DPDPA's Consent Managers: Business Models, Liabilities, and Open Questions for India Inc.

October 08, 2026. India’s Digital Personal Data Protection Act, 2023 (DPDPA), along with the Digital Personal Data Protection Rules, 2025 (DPDP Rules), is now firmly embedded in the nation’s digital landscape. Among its most distinctive innovations is the explicit recognition and framework for ‘Consent Managers’ – a pivotal concept that promises to redefine how individuals manage their digital consent. This mechanism, outlined in DPDPA Section 6(7), empowers Data Principals to manage, review, and withdraw consent through a single, accountable entity, marking a significant departure from fragmented consent experiences.

The Evolving Business Model of Consent Managers

The DPDPA envisions Consent Managers as trusted intermediaries, acting on behalf of Data Principals to provide, manage, and withdraw consent given to Data Fiduciaries. This creates a fertile ground for new business models. At their core, Consent Managers will offer a centralised dashboard for Data Principals, enabling granular control over their personal data. Services will likely include consent dashboards, automated consent revocation mechanisms, and detailed audit trails of consent interactions. Revenue streams could emerge from subscription models for Data Fiduciaries seeking streamlined compliance and verified consent, or from offering premium services to Data Principals for enhanced control and insights.

The Indian regulatory environment is no stranger to such intermediary models; the RBI-regulated Account Aggregator framework, which facilitates consent-based data sharing in the financial sector, serves as a significant precedent. This familiarity could accelerate the adoption and integration of DPDPA Consent Managers across various sectors, from healthcare to e-commerce. The DPDP Rules, 2025, specifically Rule 10, outline the certification and registration requirements for these entities, ensuring a baseline of trustworthiness and operational capability.

Navigating Liabilities and Responsibilities

The DPDPA clearly delineates the roles, but the interplay of liabilities between Data Fiduciaries and Consent Managers requires careful consideration.

Consent Manager’s Liability: As per DPDPA Section 6(7), a Consent Manager is an entity “acting on behalf of a Data Principal.” This implies a fiduciary duty to the Data Principal. The DPDP Rules, 2025, particularly Rule 15, detail specific responsibilities, including ensuring the integrity and security of consent records, promptly acting on Data Principal instructions, and maintaining transparent logs. Failure to adhere to these duties, or any negligence in managing consent, could expose Consent Managers to significant penalties under DPDPA Chapter VII. Their role is not merely technical; it carries a substantial legal and ethical obligation to safeguard the Data Principal’s autonomy.

Data Fiduciary’s Liability: Despite the introduction of Consent Managers, the primary responsibility for obtaining valid consent and ensuring DPDPA compliance ultimately rests with the Data Fiduciary (DPDPA Chapter IV). A Data Fiduciary cannot simply outsource its liability. It must still ensure that the consent obtained via a Consent Manager meets the DPDPA’s stringent requirements, including being free, specific, informed, unconditional, and unambiguous (DPDPA Section 6(1)). Data Fiduciaries will need to conduct due diligence when selecting and integrating with Consent Managers, verifying their certification status (DPDP Rules, 2025, Rule 10) and adherence to technical standards (DPDP Rules, 2025, Rule 11). While a Consent Manager facilitates the process, the Data Fiduciary remains accountable for any processing activity based on that consent. This contrasts somewhat with the GDPR, which, while not explicitly defining ‘Consent Managers,’ places a similar ultimate burden on the data controller to demonstrate valid consent.

Open Questions and Future Directions

While the DPDPA and DPDP Rules lay a robust foundation, several questions remain for the evolving Consent Manager ecosystem:

• Standardisation and Interoperability: How will different Consent Managers interact with each other and with Data Fiduciaries? The DPDP Rules, 2025, Rule 12, mandates technical standards for interoperability, but practical implementation across diverse platforms will be a complex undertaking. Seamless integration is crucial for a truly unified consent experience for Data Principals.
• Sectoral Specificity: Beyond the DPDPA Board, will sectoral regulators like RBI, SEBI, and IRDAI issue specific guidelines for Consent Managers operating in their respective domains? Given the sensitive nature of financial, securities, and insurance data, additional safeguards and compliance frameworks might be necessary, as hinted by DPDP Rules, 2025, Rule 20.
• Trust and Adoption: Building widespread trust in Consent Managers will be paramount. What mechanisms will be in place to ensure their neutrality and prevent conflicts of interest? Public awareness campaigns and robust grievance redressal mechanisms will be vital for fostering adoption, especially among less digitally savvy populations.
• Security and Resilience: Consent Managers will hold highly sensitive information – the consent preferences of millions. The DPDP Rules, 2025, Rule 11, outlines stringent security safeguards, but continuous vigilance and adaptation to evolving cyber threats will be critical to prevent breaches that could undermine the entire framework.

Practical Takeaway

For Indian businesses, General Counsels, and Data Protection Officers, the advent of Consent Managers is not merely a compliance hurdle but an opportunity to build trust and streamline data governance. Businesses must proactively evaluate and onboard certified Consent Managers, ensuring their chosen partners adhere to all DPDPA and DPDP Rules requirements. It is crucial to remember that while Consent Managers manage the process of consent, the Data Fiduciary retains ultimate accountability for lawful data processing. Integrating with Consent Managers requires careful technical planning, robust contractual agreements, and a clear understanding of shared and individual responsibilities to navigate India’s evolving data privacy landscape successfully. Staying abreast of future clarifications from the DPDPA Board and sectoral regulators will be key to sustained compliance.