Who we are, and who we are not
We are a proposed Consent Manager. We are not your consultants.
The DPDP Act creates two very different roles around your business. Consultants and lawyers advise you on what the Act asks of you. A Consent Manager is the registered platform through which people give, review and withdraw their consent to you. We are a proposed Consent Manager: the second role, not the first.
What we are
A Consent Manager is a role defined in the Act itself: “a person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform”.
-
A proposed Consent Manager
One place where a person can give, review and withdraw the consents they have given to every business onboarded onto our platform, including yours.
Act s. 2(g), s. 6(7) and 6(9)
-
On the side of the individual
The law makes a Consent Manager accountable to the Data Principal and requires it to act on her behalf, in a fiduciary capacity. That neutrality is what makes the consent records we keep worth trusting, for you as well.
Act s. 6(8); Rules, First Schedule, Part B item 8
-
A platform and APIs you can build on
There is a lot of discussion about Consent Managers and very few working systems. We are building the real thing in the open: consent requests, notices, signed receipts, withdrawals, webhooks to you and your processors, and an API sandbox, so you can develop against it now.
-
The keeper of the consent record
We record every consent given, denied or withdrawn, the notice shown with each request and every sharing of data between businesses, and keep that record for at least seven years.
Rules, First Schedule, Part B items 3 and 4
-
Blind to the data itself
Where personal data moves between businesses on our platform, it moves in a way we cannot read. We hold the consent, not your customers’ data.
Rules, First Schedule, Part B item 2
-
Independent of every business we serve
A Consent Manager must avoid conflicts of interest with Data Fiduciaries and publish who owns and runs it. We will publish our promoters, directors and shareholders above two per cent on this site.
Rules, First Schedule, Part B items 9 to 11
What we are not
Being clear about this protects you. If you need advice, you need an adviser, and the advice should come from someone with no stake in which platform you choose.
-
Not your DPDP consultant or lawyer
We do not run gap assessments, tell you what the Act requires of your business, decide your purposes or lawful basis, draft your privacy policy or represent you before the Board. That is your consultant’s and lawyer’s work, and we are happy to work alongside them. Very often, using a Consent Manager is what they will recommend.
-
Not on your side against your customers
Our duty runs to the individual. We cannot hide a withdrawal, delay it, or make it harder to withdraw than it was to consent, for any business.
Act s. 6(4) and 6(8)
-
Not a replacement for your own duties
Onboarding onto a Consent Manager does not move your obligations to us. You still give the notice, limit processing to the stated purpose, protect the data, report breaches, erase data when it is no longer needed and answer grievances.
Act s. 5, 6 and 8
-
Not your Data Processor
We do not process your customers’ data on your behalf. We carry their consent and its withdrawal to you, and keep the record of it.
Act s. 2(k)
-
Not registered yet
Until the Board registers us, we are a proposed Consent Manager, and we say so everywhere we describe ourselves.
Act s. 2(i)
You, as a business, are a Data Fiduciary
Anyone who decides why and how personal data is processed is a Data Fiduciary. If you collect your customers’ or users’ personal data in digital form, that is almost certainly you.
-
People may come to you through a Consent Manager
The Act gives every individual the option to give, manage, review or withdraw their consent to you through a Consent Manager. The choice is theirs, not yours.
Act s. 6(7)
-
Consents and withdrawals then reach you through it
A Consent Manager carries a person’s consent to the businesses onboarded onto its platform. Being onboarded is how you stay ready to receive consents, and withdrawals, from the people who choose to use one.
Rules, First Schedule, Part B item 1
-
A withdrawal must actually stop the processing
When consent is withdrawn you must, within a reasonable time, stop processing that person’s data and make your Data Processors stop too. Our webhooks tell you and each linked processor, and record when each of you confirmed.
Act s. 6(6)
-
You must be able to prove the consent
If consent is questioned, the burden of proving that notice was given and consent was obtained lies on you. A signed, independently verifiable record from a Consent Manager is strong evidence.
Act s. 6(10)
Can a Data Fiduciary be its own Consent Manager?
No.
A business cannot act as the registered Consent Manager for the consents people give to that same business. The Act does not say so in one sentence; it follows from what a Consent Manager is and the conditions it must meet to be registered.
-
It must act for the individual
A Consent Manager is accountable to the Data Principal, acts on her behalf and acts in a fiduciary capacity towards her. A business asking for consent sits on the other side of that same request, so it cannot also be the one acting for the person answering it.
Act s. 6(8); Rules, First Schedule, Part B item 8
-
It must avoid conflict of interest with Data Fiduciaries
The Rules require a Consent Manager to avoid conflict of interest with Data Fiduciaries, including their promoters and key managerial personnel. A business being its own Consent Manager is that conflict in its purest form.
Rules, First Schedule, Part B item 9
-
Its people cannot be tied to Data Fiduciaries
Its directors, key managerial personnel and senior management must not hold a directorship, financial interest, employment or beneficial ownership in Data Fiduciaries, or have a material pecuniary relationship with them. That also rules out a Consent Manager run by your group company or your promoters.
Rules, First Schedule, Part B item 10
-
Independence is written into its constitution
Its memorandum and articles of association must require these conflict rules, and can be amended only with the Board’s approval. Its shareholders above two per cent must be published, and control cannot change hands without the Board’s approval.
Rules, First Schedule, Part A item 7; Part B items 11 and 13
-
It serves many businesses, not one
The Act describes a single point of contact through an interoperable platform, and the Rules describe consent flowing to Data Fiduciaries onboarded onto it. The role only makes sense as a neutral platform between people and many businesses.
Act s. 2(g); Rules, First Schedule, Part B item 1
Who does what
A simplified view. Your adviser will tell you exactly what applies to your business.
| Task | You (Data Fiduciary) | Your consultant or lawyer | myconsentapp (proposed Consent Manager) |
|---|---|---|---|
| Work out what the Act requires of your business | Decides | Advises | — |
| Decide purposes and the data each one needs | Decides | Advises | — |
| Write the notice shown to people | Owns | Reviews | Shows it, in 22 languages, and records which version was seen |
| Carry consent and withdrawals between the person and you | Receives and acts | — | Carries, on the person’s behalf |
| Keep the consent record for at least seven years | Keeps its own | — | Keeps it, signed and verifiable |
| Stop processing after a withdrawal | Stops, with its processors | — | Notifies and tracks confirmation |
| Report a personal data breach | Reports to the Board and to people | Advises | Reports its own breaches |
| Answer grievances | About its own processing | — | About its own platform |
Where we are today
13 November 2025
DPDP Rules 2025 published
Rules 1, 2 and 17 to 21, including the Data Protection Board, come into force.
13 November 2026
Consent Manager registration opens
Rule 4 comes into force. We apply to the Board for registration.
13 May 2027
Main obligations apply
Notice, security, breach intimation, retention, rights and grievance rules come into force for every Data Fiduciary.
Dates follow rule 1 of the DPDP Rules 2025. Registration is decided by the Board.
We look forward to working with you
Build your consent flows on our APIs now, so you are ready when the obligations apply. Bring your consultant along: we will happily walk both of you through how it works.
This page explains our role. It is not legal advice.