What a Consent Manager does
Picture a borrower who has shared data with a bank, two NBFC apps and an insurer. Today she would have to visit each one to change her choices. Through a Consent Manager, she could see those consents in one dashboard and withdraw one with a single action, which the Consent Manager passes to the Data Fiduciary.
The Consent Manager acts on behalf of the Data Principal and is accountable to them. It is meant to be interoperable, so that it can work with many Data Fiduciaries at once.
Who can register
A Consent Manager must register with the Data Protection Board. Under Rule 4 and the First Schedule, it must be a company incorporated in India with a net worth of at least 2 crore rupees, and it must meet further conditions on technical, operational and financial capacity, and on avoiding conflicts of interest with the Data Fiduciaries it works with.
Registration is with the Board. How quickly applications will be processed once Phase 2 begins is not yet known, so plan for some lead time.
Obligations once registered
The First Schedule sets out duties that include keeping records of consents given, reviewed and withdrawn, making those available to the Data Principal, protecting the data from breaches, not being able to read the personal data that passes through it, and publishing information about its ownership and management.
The First Schedule is the authoritative text for these duties.
What this means for a Data Fiduciary
If a customer gives or withdraws consent through a Consent Manager, you have to act on it just as you would if they came to you directly. The practical question is whether your systems can receive that signal and push it to every place the data is used.
Consent Managers do not replace your own consent records. You still need to know what was consented to, for which purpose, under which notice, and when it changed.
How TrustOS fits
TrustOS keeps a tamper evident consent record per purpose and can accept consent events through its documented interface, so a withdrawal arriving from a Consent Manager can start the same downstream work as one made in your own Privacy Centre. Connecting to a specific Consent Manager depends on the interfaces it publishes once registered. TrustOS does not replace legal advice on how you work with Consent Managers.
Official sources
- MeitY: Data protection framework (the Act, the Rules and notifications)
- India Code: Digital Personal Data Protection Act, 2023
This guide explains the law in plain words as of October 2026. It is not legal advice. Dates that depend on notifications can change, so check the official text before you rely on them.