What is a Consent Manager, and why does India need them?

Most data protection laws stop at saying that companies need your consent. India’s DPDP Act goes one step further and creates a new kind of organisation whose only job is to help you manage that consent: the Consent Manager.

The problem it solves

Think about how many companies hold your data: banks, insurers, telecom operators, shopping apps, hospitals, schools. Each one asks for consent in its own way, on its own screen, buried in its own settings. Even if you wanted to review what you have agreed to, there is no single place to look, and withdrawing usually means hunting through menus or writing emails.

The result is that consent becomes a formality. The law can say withdrawal must be easy, but in practice it is not.

What a Consent Manager does

A Consent Manager is a single, accessible, transparent and interoperable platform through which you can:

• give consent to companies;
• review every consent you have given, in one place;
• manage it, changing what you agreed to;
• withdraw it, with the company notified automatically.

Crucially, a Consent Manager acts on your behalf. It is accountable to you, not to the companies that ask for your data.

How they are regulated

Consent Managers must be registered with the Data Protection Board of India and meet conditions set out in the DPDP Rules. These include being a company incorporated in India with sound finances, having its platform independently certified, avoiding conflicts of interest with the companies it works with, and keeping consent records for at least seven years.

A Consent Manager also must not be able to read the personal data that is shared between you and a company. It manages the consent, not the data.

Why it matters for businesses

For a business, a Consent Manager is infrastructure. Instead of building consent flows, notices in multiple languages, audit trails and withdrawal handling from scratch, it can integrate once and get:

• itemised notices that meet the Act’s requirements;
• records that stand up to an audit, because they are kept by an independent party;
• withdrawals delivered automatically, so they are never missed.

Using a Consent Manager is not mandatory for businesses, but if a person chooses to give or withdraw consent through one, the business must honour it.

How myconsentapp approaches it

myconsentapp is a proposed Consent Manager: we will apply to the Board when registration opens on 13 November 2026. Every consent event is signed with a key that never leaves secure hardware and linked into a tamper-evident chain, so anyone holding a receipt can verify it independently. Personal data is stored only in India. And it is free for individuals.

As soon as the Board grants registration, we will publish its details. Learn more about how we protect data, or see how businesses integrate.