A Consent Manager is a Board-registered intermediary that works for the individual, helping them give, review, and withdraw consent across many businesses. A consent management platform is software that works for one business, helping it capture, enforce, and prove consent. Most companies need the platform; very few need to become a Consent Manager.
However, the two terms sound almost identical, and that similarity causes real confusion inside compliance teams, boardrooms and vendor meetings. Therefore, this article separates them cleanly. Along the way, we will explain the legal source of each concept, the Rule 4 conditions, the timeline, and a simple method for deciding what your organisation actually requires. If you want the wider legal background first, read our DPDP consent management guide. Otherwise, read on, and by the end you will know exactly where a DPDP consent management platform fits in your plan.
Why the confusion exists
First of all, both terms contain the words “consent” and “management”. Secondly, vendors in the market use the labels loosely, so a product brochure may promise “consent manager functionality” when it really means a business-side tool. Finally, earlier global privacy laws, particularly the GDPR, popularised the phrase “consent management platform” for cookie banners. As a result, many readers assume the Indian “Consent Manager” is simply the same idea with a local name.
In reality, the DPDP Act creates something quite different. The Indian Consent Manager is a regulated entity with a legal duty to the Data Principal. By contrast, a consent management platform is a tool with no special legal status at all. Consequently, mixing them up can lead a business to chase a registration it does not need, or worse, to skip the software it does.
Short answer in one table
| Consent Manager | Consent management platform (CMP) | |
|---|---|---|
| Who it works for | The Data Principal (the individual) | The Data Fiduciary (the business) |
| Legal status | Registered with the Data Protection Board | No registration; ordinary software |
| Source in the law | Sections 2(g) and 6(7)–(9); Rule 4 | Not named; it is a means to meet Sections 5, 6 and 8 |
| Main job | Give, manage, review and withdraw consent on the individual’s behalf | Capture, store, enforce and prove consent inside one business |
| Number of businesses served | Many | One |
| Who pays | Usually the business or the ecosystem, but accountable to the individual | The business that buys the software |
| Mandatory? | No; entirely optional for businesses | Not named in law, but practically essential |
This comparison already answers most questions. Nevertheless, the details below matter, especially if your business is thinking about registering or integrating.
What is a Consent Manager under the DPDP Act?
Section 2(g) of the Act defines a Consent Manager as a person registered with the Board who acts as a single point of contact. Through an accessible, transparent and interoperable platform, this person enables a Data Principal to give, manage, review and withdraw consent.
Section 6(7) then confirms that the Data Principal may give, manage, review or withdraw consent through a Consent Manager. Furthermore, Section 6(8) states that the Consent Manager is accountable to the Data Principal and acts on her behalf. Finally, Section 6(9) requires every Consent Manager to be registered with the Board under the prescribed conditions.
To picture this, imagine a person who has shared data with a bank, an insurer, a telecom company and three shopping apps. Without a Consent Manager, she must visit each of the six services separately to review or withdraw her choices. With one, she opens a single dashboard and manages all six from one place. In other words, the Consent Manager acts like a trusted remote control for the individual’s data permissions.
Rule 4 and the First Schedule conditions
Rule 4 of the DPDP Rules, 2025, read with the First Schedule, sets the eligibility conditions for registration. In broad terms, an applicant must be an Indian company with a minimum net worth of ₹2 crore. Beyond that, it must show sound financial and operational capacity, a reputation for fairness and integrity, and independent certification of its technical platform and operations.
The main point is that the Board does not hand out this status casually. Instead, it expects a serious, well-capitalised and independent organisation. Because the entity holds sensitive consent records on behalf of many people, regulators want strong assurance about its stability and its controls.
Registration from 13 November 2026
The Consent Manager registration provisions take effect on 13 November 2026, which is earlier than the main consent obligations that start on 13 May 2027. This staggered timing makes sense. Since the Consent Manager ecosystem needs to exist before businesses can integrate with it, the law opens registration first. Consequently, interested companies can apply and prepare while ordinary Data Fiduciaries finish their own preparations.
It is important to remember, though, that this early date applies only to registration. It does not oblige any business to adopt a Consent Manager. Instead, it simply opens the door for those who want to build one.
Obligations after registration
Once registered, a Consent Manager carries several continuing duties. Among them, the following stand out:
- Act in the interest of the Data Principal. The entity must avoid any conflict of interest with the Data Fiduciaries it deals with, including its directors, key managers and shareholders.
- Keep consent records for seven years. Registered Consent Managers must retain the records of consents given, denied or withdrawn, together with related notices, for at least seven years.
- Offer an interoperable platform. The platform must let Data Principals and Data Fiduciaries exchange consent information smoothly and transparently.
- Protect the data it handles. It must apply strong security safeguards, since it sits at the centre of many consent relationships.
- Remain accountable to the Board. The Board can act against a Consent Manager that breaches the conditions of registration.
Taken together, these duties show why the role is demanding. Therefore, most Data Fiduciaries will prefer to integrate with a Consent Manager rather than become one.
What is a consent management platform?
A consent management platform, often shortened to CMP, belongs to a very different category. It is software that a single business runs to handle its own consent obligations. The DPDP Act does not mention the term anywhere. Nevertheless, the duties in Sections 5, 6 and 8 are impossible to meet at scale without something that behaves like one.
In practice, a CMP typically performs the following jobs:
- Captures consent at every touchpoint, such as websites, mobile apps, branches and call centres, using a clear affirmative action like a tick, tap or OTP.
- Stores each consent as a separate record, linked to the customer, the purpose, the notice version and the timestamp.
- Manages notices and purposes, including versions and language variants.
- Enforces consent at runtime, so that downstream systems check permission before using data.
- Handles withdrawal, passing it to every connected system and processor.
- Produces evidence, so that the business can satisfy Section 6(10) when asked to prove consent.
- Supports rights and grievances, including access, correction and erasure requests.
Because a CMP serves only one business, it does not need a Board registration. It also does not act on the individual’s behalf. Instead, it works for the organisation that deployed it, which in legal terms remains the Data Fiduciary and stays fully responsible for compliance.
Side-by-side comparison in depth
Now that both concepts are clear, let us compare them across five dimensions that matter most to a compliance leader.
| Dimension | Consent Manager | CMP |
|---|---|---|
| Role | Intermediary acting for the individual across many businesses | Internal tool acting for one business |
| Registration | Mandatory with the Board before operating (Rule 4) | None required |
| Who pays | Often funded through the ecosystem, yet accountable to the individual | The business pays a software licence or builds it |
| Liability | Accountable to the Data Principal and answerable to the Board for its registration conditions | The Data Fiduciary remains responsible for compliance, whatever tools it uses |
| Data access | Holds consent records and mediates communication, with strict independence rules | Holds consent records and often interacts directly with business systems |
Several points flow from this table. To begin with, hiring a vendor never moves legal responsibility away from the business. Likewise, using a Consent Manager does not remove the fiduciary’s own duty to give notice, honour withdrawals and keep proof. Both tools help, but neither replaces accountability.
Can a business use both?
Yes, and many businesses eventually will. The two concepts fit together neatly, provided the integration is designed carefully. A typical flow looks like this:
- The Data Principal opens a Consent Manager dashboard and chooses to withdraw marketing consent for a specific company.
- The Consent Manager sends that instruction to the company through the interoperable platform.
- The company’s CMP receives it, updates the consent record, and timestamps the change.
- The CMP then pushes the withdrawal to the CRM, the email tool, the ad platform and every relevant Data Processor.
- Finally, the CMP stores proof of the whole sequence for future audits.
In this arrangement, the Consent Manager is the front door for the individual, while the CMP is the control room inside the business. Without the second, the first cannot achieve anything, because a withdrawal that never reaches your systems changes nothing in practice.
In addition, businesses that deal with banks and lenders will notice how this resembles other consent frameworks already in use in India. For example, financial services teams may already be comfortable with consent-driven data sharing. If that describes your sector, see how we have mapped requirements for banks and fintech companies.
Which one do you need? A simple decision guide
To decide quickly, ask yourself three questions in order.
Question 1: Do I collect personal data from people in India? If yes, you are a Data Fiduciary and you need a way to capture, enforce and prove consent. That means a CMP, or an equivalent system you build yourself.
Question 2: Do I want to offer a consent dashboard to individuals across many other businesses? If yes, you may consider applying to become a Consent Manager. If no, stop here; you do not need registration.
Question 3: Do my customers or partners use Consent Managers? If yes, plan to integrate with them. Your CMP should be able to receive their requests and act on them.
By business type, the picture usually looks like this:
- Banks, NBFCs and insurers: need a CMP; may integrate with Consent Managers; unlikely to become one.
- Ecommerce and SaaS companies: need a CMP; integration with Consent Managers is optional.
- Edtech, schools and hospitals: need a CMP with strong parental consent and children’s data controls.
- Startups: need a lightweight but provable CMP from day one, because retrofitting later is costly.
- Technology companies planning a neutral intermediary product: assess Rule 4 eligibility, since this is the only group for whom registration is relevant.
Common misunderstandings
Before concluding, let us clear up four myths that appear frequently.
- Myth: “We must register as a Consent Manager to be compliant.” Reality: registration is only for entities that want to act as intermediaries for individuals.
- Myth: “A Consent Manager removes our obligations.” Reality: the Data Fiduciary still owes notice, enforcement and proof.
- Myth: “A cookie banner is our CMP.” Reality: a banner covers website trackers only, whereas DPDP consent spans every purpose and channel.
- Myth: “The CMP market is regulated like Consent Managers.” Reality: CMP vendors are ordinary software providers, so you must check their quality yourself.
The last myth deserves extra attention. Since nobody certifies CMP vendors on your behalf, your own due diligence becomes the safeguard. Accordingly, evaluate security, withdrawal sync, audit logs and language support carefully before signing.
How SecureCMS fits in
SecureCMS is built for the business side of this picture. It collects consent through OTP on email, SMS and WhatsApp, manages purposes with a data catalogue, handles withdrawal and modification, and enforces revocation across connected systems through APIs and SDKs. In addition, it automates data principal rights requests, escalates grievances to the DPO, and records blockchain-backed audit logs for proof.
Want to see how it works with your systems? Book a SecureCMS demo
Frequently asked questions
Is registration mandatory for my company?
No. Only an entity that wishes to operate as a Consent Manager must register with the Data Protection Board. A company that handles its own customers’ data needs a consent management platform, not registration.
Can a bank be its own Consent Manager?
In principle, a Consent Manager must act for the individual and avoid conflicts of interest with the Data Fiduciaries it works with. A bank managing consent solely for its own customers would therefore sit uneasily with that requirement. A bank is better placed to run a CMP and integrate with independent Consent Managers.
Is an Account Aggregator a Consent Manager?
Not automatically. Account Aggregators operate under a separate financial-sector framework. Although the idea of consent-based sharing is similar, an Account Aggregator would need to meet the DPDP Rules and register with the Board if it wished to act as a Consent Manager. Please check the latest official guidance for your case.
Who is liable for a wrong consent record?
The Data Fiduciary stays responsible for complying with the Act, even when it relies on a vendor or a Consent Manager. Contracts can allocate costs between parties, but they cannot move the legal duty away from the fiduciary.
Final thoughts
In summary, the difference is easy to remember. A Consent Manager belongs to the individual, while a consent management platform belongs to the business. One is a regulated role that few organisations will pursue; the other is an everyday operational necessity for almost everyone. Therefore, unless you plan to build a neutral intermediary, focus your time and budget on the platform, connect it to every system that touches personal data, and make sure it can talk to Consent Managers when they arrive. For the full legal context, return to our DPDP consent management guide.
This article summarises the law for general information and is not legal advice. Please consult a qualified legal professional for your specific situation.
