A Consent Manager is an entity registered with the Data Protection Board that gives individuals one place to give, manage, review and withdraw their consent across organisations. As we read the Act, using one is an option for individuals, not something your business must buy. It is also different from a cookie banner on your own website.
- Consent Manager registration is scheduled to start around 13 November 2026.
- It is a separate role from your own consent notice or cookie banner.
- Your duties as a Data Fiduciary stay with you, whichever tools you use.
What the Act says
Section 2 of the Act defines a Consent Manager as a person registered with the Board who acts as a single point of contact to enable an individual to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform. The Rules set out how an entity registers and what it must do, and that part of the Rules is scheduled to take effect one year after the 13 November 2025 notification.
The Act and Rules come into force in phases. Under the 13 November 2025 notifications, the provisions that set up the Data Protection Board took effect on publication, consent-manager registration (Rule 4) follows after one year (around 13 November 2026), and most substantive duties for businesses are scheduled for eighteen months after publication, which is 13 May 2027. In January 2026 MeitY discussed shortening the 18-month period for some obligations. In the sources we checked on 3 November 2026 we found no notification doing so, but dates can change, so confirm against the Gazette before relying on one.
Consent Manager vs consent banner
| Consent Manager | Your own banner or notice | |
|---|---|---|
| Who runs it | An entity registered with the Board | Your organisation, or a tool you use |
| Who it serves | The individual, across many organisations | Your visitors and customers, for your own site |
| Role | Acts for the individual in managing consent | Records and honours consent you ask for |
| Must you use one? | No, as we read the Act | You still need a clear notice and a way to withdraw |
What it means for a small business
- Keep giving a clear notice where you collect data. A Consent Manager does not replace it.
- Be ready to honour consent choices that reach you through a Consent Manager once the system is running.
- Make withdrawing consent as easy as giving it, and record it.
- Watch for updates from MeitY and the Board on how registered Consent Managers will work with businesses.
What to do now
- Review your consent notices and withdrawal routes.
- List where you record consent today.
- Check the official pages for the Consent Manager framework when it opens.
Frequently asked questions
Do I have to join a Consent Manager?
As we read the Act, no. It is a service individuals may use. Your obligations as a Data Fiduciary apply regardless.
Can my business become a Consent Manager?
Only an entity that meets the conditions in the Rules and registers with the Board. That is a significant undertaking and not something most small businesses would do.
Sources
- MeitY: Digital Personal Data Protection Act, 2023
- MeitY: DPDP Rules, 2025 publication page
- Gazette: G.S.R. 846(E), DPDP Rules, 13 November 2025
Reviewed 3 November 2026. This is general information, not legal advice. Dates and details can change, so check the official sources.