India's Consent Managers: Unpacking the DPDPA Rules
The landscape of data privacy in India has fundamentally shifted with the full operationalization of the Digital Personal Data Protection Act, 2023 (DPDPA) and the subsequent notification of the DPDP Rules, 2025. A cornerstone innovation introduced by this framework, and a key differentiator from many global regimes like the GDPR, is the concept of the Consent Manager. These entities, envisioned under DPDPA Section 6(7) and 6(8), are poised to redefine how individuals interact with their personal data, acting as a crucial intermediary for managing consent. As of late 2026, with the Rules providing much-needed clarity, Indian businesses must grasp the implications for their data processing activities and the emerging ecosystem.
The Evolving Landscape of Consent Management in India
The DPDP Act mandates that a Data Principal’s consent must be free, specific, informed, unconditional, and unambiguous, clearly indicating their agreement to process personal data for a specified purpose (DPDPA Section 6(1)). Consent Managers are designed to operationalize this principle, serving as a single point of digital interaction for individuals to grant, manage, review, and withdraw their consent. The DPDP Rules, 2025, are expected to detail the technical, operational, and governance standards for these entities. Drawing inspiration from the Reserve Bank of India’s (RBI) Account Aggregator framework, Consent Managers are likely to be regulated fiduciaries, requiring registration or certification by the Data Protection Board of India (DPBI) or a designated authority. Their core function is to provide a transparent, auditable mechanism for consent, empowering Data Principals to exercise their rights under DPDPA Section 13 (right to withdraw consent) and DPDPA Section 14 (right to grievance redressal). This moves beyond mere checkboxes, offering a dynamic, real-time control panel for personal data permissions.
Business Models and Regulatory Scrutiny
The business models for Consent Managers are anticipated to be diverse. They could charge Data Fiduciaries for streamlining consent acquisition, ensuring compliance, and providing robust audit trails. Alternatively, they might offer premium services to Data Principals, such as advanced consent dashboards, data portability tools, or insights into data usage patterns. The DPDP Rules, 2025, are expected to lay down stringent requirements for their operation, encompassing data security standards, interoperability protocols, and dispute resolution mechanisms. For instance, the Rules will likely mandate specific technical specifications for API integrations, ensuring seamless communication between Consent Managers and Data Fiduciaries, similar to the standards set by the RBI for Account Aggregators. Furthermore, the DPBI, under its powers outlined in DPDPA Section 18, will likely oversee the registration, auditing, and enforcement against Consent Managers, ensuring they adhere to their fiduciary duties towards Data Principals. This regulatory oversight is critical to building trust and ensuring the integrity of the consent ecosystem.
Navigating the Liability Matrix
A critical aspect for both Data Fiduciaries and Consent Managers is understanding the allocation of liability. Under the DPDPA, the Data Fiduciary remains primarily responsible for ensuring compliance with the Act, including obtaining valid consent (DPDPA Section 6(1)). However, Consent Managers, by virtue of their specific role, will also bear significant responsibilities. The DPDP Rules, 2025, are expected to clarify that Consent Managers are liable for any non-compliance with their prescribed duties, such as failing to accurately record consent, not facilitating timely withdrawal, or breaching the security of the consent data they manage. Penalties for such breaches could be substantial, as outlined in DPDPA Section 24, which allows for fines up to INR 250 crores for certain violations. Unlike the GDPR’s clear controller-processor distinction, where a processor typically acts on the controller’s instructions, an Indian Consent Manager holds a unique position as a fiduciary to the Data Principal. This means they have an independent duty of care, and their liability will stem from their failure to uphold this duty, even if the Data Fiduciary is also found liable for related breaches.
Open Questions and Future Challenges
Despite the clarity brought by the DPDP Rules, several open questions persist. The interoperability standards across different Consent Managers and various sectoral applications (e.g., healthcare, finance, e-commerce) will be crucial for a truly seamless experience. Will there be a single, unified standard, or will sectoral regulators like IRDAI or SEBI issue their own specific guidelines for Consent Managers operating in their domains? User adoption and awareness also remain significant challenges; educating the vast Indian populace about this new mechanism will require sustained effort. Furthermore, the cost implications for small and medium-sized enterprises (SMEs) to integrate with Consent Managers and adapt their existing consent processes need careful consideration to avoid creating barriers to compliance. The DPBI’s role in harmonizing these various aspects and ensuring equitable access and enforcement will be pivotal.
Practical takeaway: Indian businesses, especially GCs and DPOs, must proactively assess their current consent acquisition and management processes. Engage with the emerging Consent Manager ecosystem, understand the technical integration requirements, and evaluate potential partners. Prepare for a shift from passive consent to an active, dynamic consent management paradigm. Monitoring DPBI guidelines and any sector-specific norms will be crucial to ensure ongoing compliance and leverage the benefits of a streamlined, transparent consent framework.