Why it is needed

A Consent Manager does not take your obligations away

The DPDP Act makes the Data Fiduciary responsible for compliance, whoever does the processing (section 8(1)). A Consent Manager gives the Data Principal one place to give, review and withdraw consent; your business still has to prove each consent, act on every withdrawal and answer every request within the time allowed. That work happens in your systems, with your customer data, and that is what ConsentRoom is for.

• You must prove every consent

  If a consent is questioned, the burden of proving the notice and the consent is on you (section 6(10)). ConsentRoom keeps each consent with its notice version, channel and evidence, ready to show.

  Act s.6(10)

• Withdrawals must stop processing

  Withdrawing must be as easy as consenting, and once withdrawn you must stop, and make your processors stop, within a reasonable time (sections 6(4), 6(6)). ConsentRoom tells every system at once and tracks the acknowledgement.

  Act s.6(4), 6(6)

• Rights requests and grievances have clocks

  Access, correction, erasure and nomination requests (sections 11 to 14) and grievances need an answer; grievances within 90 days at the outside (rule 14(3)). ConsentRoom runs each one as a case with an owner and a due date.

  Act s.11–14, Rules r.14(3)

• Breaches must be reported in 72 hours

  A personal data breach must be reported to the Board within 72 hours of becoming aware of it (rule 7(2)(b)). ConsentRoom starts the clock, collects the facts and keeps the filing under maker-checker approval.

  Rules r.7(2)(b)

• Logs must be kept for a year

  Personal data, traffic data and logs of processing must be kept for at least one year (rules 6(1)(e), 8(3)), and an erasure notice sent 48 hours before erasure (rule 8(2)). ConsentRoom keeps a tamper-evident audit log and the retention schedule.

  Rules r.6(1)(e), 8(2), 8(3)

• Your customer data should not travel

  The proposed Consent Manager holds only what it needs, with pseudonyms and hashes in place of your customer records. Someone has to hold the link between a consent and the real customer: ConsentRoom does, encrypted, on your side.

  Data minimisation

Know the difference

Consent management software is not a Consent Manager

The two sound alike and are often confused. One is a tool a business uses on its own data. The other is a role created by the DPDP Act, registered with the Data Protection Board and working for the individual.

Know the difference	Consent management softwaresuch as ConsentRoom	Consent Managersuch as myconsentapp, a proposed Consent Manager
What it is	Software a business installs or subscribes to, to run its own consent records	A company that must register with the Data Protection Board of India (section 6(9)). myconsentapp is a proposed Consent Manager and will apply for registration
Works for	The Data Fiduciary that runs it	The Data Principal: accountable to her and acting on her behalf (section 6(8)), in a fiduciary capacity
Who chooses it	The business	The individual: she may give, manage, review or withdraw consent through a Consent Manager (section 6(7))
Rules it follows	Your own policies; no registration	Registration conditions and obligations in the First Schedule of the DPDP Rules, with audits reported to the Board
Covers	One business and its customers	One place for an individual's consents across every business onboarded onto its platform
Records	Your own logs, kept by you	An independent record of consents, notices and sharing, kept for at least seven years
Independence	Part of your business	Must avoid conflicts of interest with Data Fiduciaries, and publish its owners and management
Example	ConsentRoom, CRM consent modules, cookie banners	myconsentapp, a proposed Consent Manager

What it is

Consent management softwareSoftware a business installs or subscribes to, to run its own consent records

Consent ManagerA company that must register with the Data Protection Board of India (section 6(9)). myconsentapp is a proposed Consent Manager and will apply for registration

Works for

Consent management softwareThe Data Fiduciary that runs it

Consent ManagerThe Data Principal: accountable to her and acting on her behalf (section 6(8)), in a fiduciary capacity

Who chooses it

Consent management softwareThe business

Consent ManagerThe individual: she may give, manage, review or withdraw consent through a Consent Manager (section 6(7))

Rules it follows

Consent management softwareYour own policies; no registration

Consent ManagerRegistration conditions and obligations in the First Schedule of the DPDP Rules, with audits reported to the Board

Covers

Consent management softwareOne business and its customers

Consent ManagerOne place for an individual's consents across every business onboarded onto its platform

Records

Consent management softwareYour own logs, kept by you

Consent ManagerAn independent record of consents, notices and sharing, kept for at least seven years

Independence

Consent management softwarePart of your business

Consent ManagerMust avoid conflicts of interest with Data Fiduciaries, and publish its owners and management

Example

Consent management softwareConsentRoom, CRM consent modules, cookie banners

Consent Managermyconsentapp, a proposed Consent Manager

You need both. Software to run your side of consent every day, and readiness for the Consent Manager your customer chooses. ConsentRoom is one such software: an independent tool, separate from myconsentapp.

Use cases

Where ConsentRoom does the work

• Branch and paper consentBanks, NBFCs, insurers

  A customer signs a form at a branch. Staff record it on a tablet in Simple mode, ConsentRoom forwards it to the Consent Manager, and the customer sees it in their dashboard the same day.

• Check before you sendLending, e-commerce, telecom

  Before a marketing campaign or a credit bureau pull, your system asks ConsentRoom "is this customer permitted for this purpose?" and gets an answer in milliseconds from the local mirror. If the mirror is stale, it says "unknown", never "yes".

• A withdrawal reaches every systemRetail, loyalty, D2C

  A customer withdraws marketing consent in the myconsentapp dashboard. ConsentRoom picks it up within 30 seconds, marks the consent withdrawn for every system that checks it, and puts the acknowledgement on the DPO's Today list.

• Access and erasure requestsHospitals, diagnostics, edtech

  A patient asks what data you hold. The request arrives as a case with a due date, is assigned to an analyst, and is answered from ConsentRoom, with every step in the audit log.

• Grievances with a deadlineAny Data Fiduciary

  Grievances from your call centre and from the Consent Manager land in the same queue. SLA clocks warn well before the 90-day outer limit, with an internal target of 30 days.

• Breach responseAny Data Fiduciary

  An incident is logged, the 72-hour clock starts, the DPO drafts the intimation, and a second approver signs it off before it is filed. The register is ready for the Board and for audit.

Download and installation

Runs on your infrastructure in an afternoon

ConsentRoom ships as Docker containers: the app (web interface and APIs), a background worker, and a PostgreSQL 16 database (or point it at your own PostgreSQL server, such as Amazon RDS or Azure Database for PostgreSQL). Your IT team installs it on a server or VM in your data centre or cloud account; nothing about your customers is hosted by us.