DPDP Consent Manager Framework: What Indian Businesses Must Prepare Before the 2026 Rollout
Key Takeaways:
- A consent manager under the DPDP Act, 2023 is an entity registered with the Data Protection Board of India that lets people give, review, and withdraw consent in one place.
- Most businesses are data fiduciaries, meaning they decide why and how personal data is processed. They don’t register as consent managers. They have to work with them.
- The consent manager provisions are expected to start around November 2026, and the main fiduciary duties are expected to follow later.
- The framework you need has five parts: notice, consent capture, a consent record, withdrawal handling, and an audit trail.
- Gaps show up in testing and evidence, so check the systems that hold consent before the first consent manager request arrives.
Picture an Indian lending app with a pre-ticked consent checkbox buried in its sign-up screen. Withdrawing consent means emailing support. One day a user asks to withdraw, through a consent manager that sends the request in a standard format, and the app’s team finds that nobody owns the request, nobody can log it, and no system can stop the processing.
That gap is what the DPDP consent manager rules are about to expose. This guide explains what a consent manager is under the Digital Personal Data Protection Act, 2023 (DPDP Act), who registers as one, and what your business should have in place before the rollout.
What Is a DPDP Consent Manager and Why Does the 2026 Rollout Matter?
A DPDP consent manager is a company registered with the Data Protection Board of India that acts as a single point of contact for a user’s consent. The user can give consent to a business, see what they’ve agreed to, and withdraw it, all through the consent manager platform.
Today, each business runs its own consent screen. A consent manager works like a switchboard: one interface for a user, many businesses behind it.
For you, the consequence is operational. A request can arrive from outside your own app, in a structured format, and you are expected to honour it.
As we understand it, the consent manager provisions begin roughly a year after the DPDP Rules were notified in November 2025, which puts the start around November 2026. The main duties for data fiduciaries are expected to start later, so the two clocks run separately. Confirm both dates in the notifications on the MeitY website before you plan around them.
As we read it, the Act covers digital personal data processed in India, and processing outside India connected to offering goods or services to people in India. Check the Act’s applicability section, or ask counsel, to confirm your processing is in scope.
Also read : DPDP Act vs GDPR: Key Differences Every CTO in India Must Know
Consent Manager vs Consent Banner: What Actually Changes?
A consent banner belongs to you. A consent manager belongs to the user.
A cookie banner or sign-up checkbox is your own tool, built to collect consent on your terms. A consent manager is independent of you and accountable to the person whose data it is. Under the Act, it acts on the user’s behalf, so a banner cannot stand in for one.
That difference has three practical effects:
- Consent can be withdrawn from outside your product, so your systems must accept and act on the request.
- The record of consent needs a form another system can read, not a screenshot of a checkbox.
- Withdrawal has to be as easy as giving consent, so a support-email process that is harder than the original click is likely to fall short.
For a CXO, the exposure is real. The Act lets the Data Protection Board impose financial penalties, and an unprocessed withdrawal is the kind of complaint that can reach it, usually after the person has first tried your own grievance process. The penalty schedule sits in the Act, so read it there.
Who Needs to Register as a Consent Manager?
Almost none of your peers will. Registration is for companies that want to run a consent manager as a business, and the Rules set conditions on who can. As we read them, the applicant must be an Indian company with a minimum net worth, and it must show the technical and operational capability to work independently of the businesses it serves.
So, the question for most Indian businesses is whether they are ready to receive requests from a consent manager. That is where most of the work sits.
A related question is whether you need a data protection officer. As we understand it, the Act makes a DPO mandatory only for Significant Data Fiduciaries, a category the Government designates. Wattlecorp’s guide to DPO vs consent manager in India covers how the two roles differ.
The Five-Part Consent Framework Your Business Should Build
A workable framework needs five parts, and a gap in any one of them breaks the rest. Consent is not the only ground for processing under the Act, which also allows certain legitimate uses, so check which of your processing activities need consent at all.
- A plain-language notice. The Act expects consent to be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. The notice has to say what data you collect and why. If your privacy notice needs a lawyer to read, rewrite it first.
- Consent capture tied to a purpose. One checkbox for “everything” doesn’t meet that standard. Each purpose gets its own choice, and the user can say no to a purpose the service doesn’t need without losing the service. If your users include children, the Act asks for verifiable consent from a parent or guardian, so build that path too.
- A machine-readable consent record. This is the part most teams skip. Each consent needs a timestamp, the purpose, the notice version shown, and the channel. Without it you can’t prove what the user agreed to, and the burden of proof sits with you.
- Withdrawal that stops processing. When a withdrawal arrives, from your own app or from a consent manager, the data has to stop flowing to the systems that used it, including downstream vendors. Map where each consent leads before the first request arrives.
- An audit trail. Log who asked, when, what changed, and when processing stopped. This is what you hand over when someone asks you to show your work. For the wider obligations, see Wattlecorp’s DPDP compliance checklist for India.
Also read : AI Governance for Indian Enterprises: Building Internal Controls Before Key DPDP Obligations Take Effect
Where Consent Frameworks Break in Practice
The policy is rarely the problem. Most failures are technical.
A withdrawal flag gets set in one database and never reaches the marketing tool. A consent record is stored as free text, so nobody can query it. An API that accepts consent updates has no authentication, which means anyone who guesses an identifier can withdraw or grant consent for someone else. That last one is a security finding, and it belongs to your testing scope.
Wattlecorp has worked on the security testing of a consent management platform that serves millions of website integrations. It triaged and validated the reports coming into the platform’s global bug bounty programme, and ran black-box and grey-box testing with configuration reviews of its cloud, application server, and network.
That platform serves GDPR, CCPA and LGPD compliance, a different category from the DPDP consent manager this guide describes. The point carries over: a system that holds consent holds sensitive records, so test it like one.
Three checks are enough to start:
- Test the withdrawal path end to end, from request to the last downstream system.
- Test who can read and change consent records, including through your APIs.
- Check that the log can answer “who changed this consent and when” without anyone reconstructing it from memory.
How to Prepare Before the Rollout
You don’t need a big programme. You need an order of work.
Start by listing every place you collect personal data and every system it flows to. That map is the base for everything else, because you can’t withdraw consent from a system you don’t know holds the data. Include vendors in it, and the third-party vendor risk assessment for DPDP guide shows how.
Then fix the notice and the capture screens, build the consent record, and wire withdrawal through to every downstream system. Test it the way an attacker or an auditor would, and keep the evidence. A gap analysis against the Act’s requirements shows what’s left, and it costs far less before a complaint than after one.
Get Your Consent Framework Ready Before the Rollout
Go back to the lending app. Its team couldn’t process one withdrawal because the consent record, the owner, and the downstream switch-off all had gaps. Wattlecorp tests the systems where those gaps show up, from penetration testing of the applications that hold consent to reviewing the data flows behind them.
If you want a clear picture of where your consent workflows stand before the consent manager provisions start, talk to Wattlecorp about data privacy consulting in India.
DPDP Consent Manager FAQs
1. What is a consent manager under the DPDP Act?
A consent manager is an entity registered with the Data Protection Board of India that lets a user give, manage, review, and withdraw consent through one interface. It is accountable to the user and acts on their behalf, not on behalf of the businesses collecting the data.
2. Do all Indian businesses need to register as DPDP consent managers?
No. Registration is only for entities that want to operate as a consent manager. Most businesses are data fiduciaries and need to be ready to receive and honour consent requests from one.
3. When do the DPDP consent manager requirements take effect?
As we understand it, the provisions on registering and operating consent managers start about a year after the Rules were notified. The main data fiduciary duties are expected later. Check both dates against the official notifications.
4. What should businesses include in a DPDP-compliant consent management framework?
A plain-language notice, purpose-specific consent capture, a machine-readable consent record, withdrawal that reaches every downstream system, and an audit trail. A gap in one weakens the others.
5. How can businesses prepare their applications and consent workflows for DPDP compliance?
Map where personal data is collected and where it flows, rebuild the notice and capture screens, store consent as structured records, and test the withdrawal path end to end. Keep evidence of the tests.
Cloud Security Audit for Indian Government Digital Initiatives: MeitY Empanelment Requirements
Key Takeaways: MeitY empanelment is how MeitY approves cloud service offerings for government use. As we understand it, it applies to the cloud offering, not to an auditor. MeitY empanelment and empanelment by the Indian Computer Emergency Response Team (CERT-In) are different things with different subjects. Assessors look at security controls, data handling and evidence, […]
DPDP Consent Manager Framework: What Indian Businesses Must Prepare Before the 2026 Rollout
Key Takeaways: A consent manager under the DPDP Act, 2023 is an entity registered with the Data Protection Board of India that lets people give, review, and withdraw consent in one place. Most businesses are data fiduciaries, meaning they decide why and how personal data is processed. They don’t register as consent managers. They have […]
Server Hardening for Indian FinTech Cloud Infrastructure: RBI Outsourcing and Data Localisation Rules
Key Takeaways: RBI doesn’t publish a single server hardening standard for every FinTech. Hardening gets judged through its outsourcing, data localisation, and IT governance expectations. Moving workloads to a cloud provider moves the hosting, not the accountability. The regulated entity still owns the evidence. Data localisation for payment data changes server design: region pinning and […]
Mobile Application Penetration Testing for Saudi Government Apps: CITC and NCA Security Standards
Key Takeaways: Mobile app penetration testing Saudi Arabia helps government entities identify client-side vulnerabilities and backend API weaknesses that could either expose sensitive citizen information or enable unauthorized actions. Testing should consider evaluating the entire transaction, i.e., mobile client interface and local storage through network transport to server-side APIs, identity verification, and backend authorization. Even […]
DevSecOps for Indian Government: Meeting CERT-In Audit RequirementsÂ
Key Takeaways: CERT-In’s guidelines for application security advise integrating security throughout the Software Development Life Cycle (SDLC) than relying only on post-development audits. DevSecOps helps streamline CERT-In compliance India by moving security from a last-mile bottleneck to an automated, continuous process within the SDLC. Supporting CERT-In-aligned application security involves building a complete security lifecycle that […]
DIFC AI and Automated Processing Regulation: Full Enforcement Guide for Dubai Financial FirmsÂ
Key Takeaways: Regulation 10 of the DIFC Data Protection Regulations applies to any DIFC entity deploying an automated system that processes personal data, including AI tools bought off the shelf from a vendor. The regulation splits responsibility between two defined roles, deployer and operator, and most financial firms are deployers even when they did not […]
