What is a Consent Manager under the DPDP Act?
Section 6 of the Digital Personal Data Protection Act, 2023 defines a Consent Manager as a person registered with the Data Protection Board of India who acts as a single point of contact for a Data Principal to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform.
The key point is that a Consent Manager works for the individual. It sits between people and the many organisations they share data with, so a customer can see and control all of their consents in one place. Consent Managers must register with the Board and avoid conflicts of interest with the businesses they connect to.
Rule 4 and the First Schedule of the DPDP Rules set the registration and operating conditions, including eligibility as an Indian company, financial and technical capacity, interoperability and a minimum net worth of ₹2 crore.
Registration is not a claim a software vendor can make based on product features. The registration provisions commence on 13 November 2026, with the details of actual applications governed by the Board's process.
What is a consent management platform?
A consent management platform (CMP) is software that a business uses to meet its own obligations as a Data Fiduciary. It captures consent on your websites, apps and forms, stores proof of each consent, shows notices, handles withdrawals and passes those decisions to the systems that process personal data.
A CMP works for the business. It does not need to be registered with the Data Protection Board, because it is the tool you use to run your own compliance. The term itself does not mean the vendor or its customer has been registered by the Board as a Consent Manager.
For example, an online retailer might use a CMP to separate optional promotional communications from order-related processing, record each customer's decisions and pass updated preferences to its marketing system.
The difference at a glance
| Question | Registered Consent Manager | Consent management platform |
|---|---|---|
| What is it? | A statutory role | A software or technology category |
| Who does it act for? | The Data Principal | The Data Fiduciary (the business using the software) |
| Is Board registration required? | Yes | No |
| Scope | A person's consents across many businesses | The consents your business collects |
| Core purpose | Let individuals manage consent through the registered service | Help organisations run consent and privacy workflows |
| Interoperability | Subject to prescribed conditions | Depends on design and implementation |
| Accountability | To the Data Principal and the Board | Your business stays accountable for its own processing, whichever route consent arrives through |
| Who needs one? | Very few businesses will become Consent Managers | Almost every Data Fiduciary needs a reliable way to manage consent |
| Does buying one confer registration? | Not applicable | No |
Do you need both?
No DPDP provision requires every Data Fiduciary to appoint a registered Consent Manager. You still need valid notices, compliant consent where applicable, withdrawal mechanisms and evidence of your practices, and you can meet those technical requirements through internal systems or external software. Engaging a registered Consent Manager is a separate decision from buying a CMP.
Most businesses need a consent management platform and do not need to become a Consent Manager. As registered Consent Managers start operating, some of your customers will choose to give or withdraw consent through them. Your CMP then becomes the point where those instructions arrive, are recorded and are passed to your systems.
That makes integration important. A CMP with APIs can accept consent events from many sources, including your own channels and external Consent Managers, and keep a single record for each Data Principal.
Questions to ask when choosing a CMP
- Does it capture consent per purpose, rather than one blanket checkbox?
- Does it keep a time-stamped, tamper-evident record of every consent and withdrawal, including the purpose, notice version and channel, without collecting unnecessary evidence?
- Can past notice versions be retrieved for any consent record?
- Can customers withdraw consent as easily as they gave it, through a preference centre?
- How do withdrawals reach the downstream systems that process data under that consent?
- Does it handle consent from multiple collection channels, such as web, app, call centre and branch?
- Does it offer SDKs and REST APIs to connect websites, apps, CRM and marketing tools?
- Does it support multilingual notices and consent experiences?
- Can it handle Data Principal rights requests and grievances with tracked response times?
- What access controls, permission settings and event logs are available?
- How are consent records retained and deleted?
- Where is the data hosted, and who can access it?
- If the vendor describes itself as a registered Consent Manager, can it show independent confirmation of Board registration?
Where ConvergeDPDP fits
ConvergeDPDP is a consent management platform for Data Fiduciaries. It captures purpose-based consent from web, mobile and offline channels, keeps time-stamped consent records in one hub, processes withdrawals in real time and connects to your systems through SDKs and REST APIs, with data hosted in India.
These capabilities support enterprise operational readiness, but they do not by themselves make ConvergeDPDP, or a business using it, a registered Consent Manager.
Conclusion
The distinction is straightforward: a Consent Manager is a regulated role; a CMP is a technology solution. A business may need consent management capabilities without becoming or engaging a registered Consent Manager. Choose a solution based on your legal obligations, architecture and working processes, not only its product label.