India: DPDP Act Consent Manager Is Data Principal's Election, Not Fiduciary's

• Rule 4 of the DPDP Rules, 2025, governing Consent Managers, will come into force on November 14, 2026.
• Under the DPDP Act, the data principal exclusively elects their Consent Manager, not the data fiduciary.
• Data fiduciaries are required to "onboard" to a Consent Manager chosen by the data principal, rather than appointing one.
• A Consent Manager acts as a single point of contact for data principals to manage their consent transparently and is a company registered in India.
• This framework aligns with NITI Aayog's Data Empowerment and Protection Architecture, emphasizing individual control over personal data.

Data fiduciaries must recognize that their role is to integrate with, or "onboard" to, a Consent Manager that has been independently selected by the data principal, rather than to appoint one themselves.

The Digital Personal Data Protection Act, 2023 (DPDP Act) and its accompanying Digital Personal Data Protection Rules, 2025, are set to significantly reshape data privacy regulations in India. The DPDP Act 2023 received Presidential assent on August 11, 2023, and is currently in force. The Digital Personal Data Protection Rules, 2025, were notified on November 13, 2025. As the November 14, 2026 deadline for the enforcement of Rule 4 of the DPDP Rules approaches, organizations are actively developing their compliance frameworks. Rule 4, pertaining to Consent Managers, is scheduled to come into force around November 13, 2026. A critical point of confusion for many entities, particularly data fiduciaries, revolves around the precise role and engagement mechanism for Consent Managers, a key component of the new regime.

Many compliance teams instinctively assume that engaging a Consent Manager is a vendor decision, akin to appointing a data processor, where the data fiduciary selects and controls the service. However, this common assumption is not supported by the explicit language of the DPDP Act or the Rules. Misinterpreting this fundamental aspect can lead to significant compliance gaps as the November 2026 deadline draws nearer, necessitating a re-evaluation of current strategies for building consent architecture.

The DPDP Act, specifically Section 2(g), defines a Consent Manager as an entity registered with the Board. Its primary function is to serve as a unified point of contact, empowering a data principal to effectively grant, manage, review, and revoke their consent. This process must occur through a platform that is accessible, transparent, and interoperable. The definition clearly positions the Consent Manager as a facilitator of individual consent, operating solely in the best interests of the data principals it serves. It is not depicted as an integral party to the data fiduciary's processing activities, nor is it described as an appointee of the fiduciary or a direct link within their data processing chain.

A crucial distinction in the DPDP Act is the optional nature of using a Consent Manager. Section 6(7) of the Act explicitly states that a data principal may choose to give, manage, review, or withdraw consent to a Data Fiduciary through a Consent Manager. The legislative choice of the word "may" underscores that while a Consent Manager offers a valuable channel for individuals to exercise control over their data, especially when dealing with multiple data fiduciaries, it is not a mandatory intermediary. Consequently, a data fiduciary that does not onboard a Consent Manager is not, by that fact alone, in violation of the Act.

Neither the DPDP Act nor the DPDP Rules utilize the term "appoint" when describing the relationship with a Consent Manager. This is a deliberate omission, highlighting that a Consent Manager is not engaged by a data fiduciary in the same manner as an auditor or legal counsel, nor is it selected by a data principal like a power-of-attorney holder. Instead, a Consent Manager is fundamentally a person or entity registered with the Board, and both data fiduciaries and data principals interact with this registered intermediary in distinct ways. Furthermore, it is stipulated that a Consent Manager must be a company formally registered within India.

The power of choice unequivocally rests with the data principal. Section 6(7) unambiguously grants the data principal the sole discretion to elect a Consent Manager through which their consent is managed. The Act provides no authority for a data fiduciary to designate, restrict, or substitute the specific Consent Manager an individual chooses to utilize. On the data fiduciary's side, the Rules employ the term "onboarded." Part B of the First Schedule mandates that a Consent Manager must enable a data principal to provide consent to a data fiduciary that has been "onboarded onto its platform," signifying the data fiduciary's act of integrating with a Consent Manager chosen by the data principal.

This architectural design has profound implications for how organizations must structure their compliance efforts under the Digital Personal Data Protection Act 2023. Data fiduciaries must recognize that their role is to integrate with, or "onboard" to, a Consent Manager that has been independently selected by the data principal, rather than to appoint one themselves. This requires a shift in perspective for compliance officers and legal teams, moving away from a vendor selection model to one of interoperability and integration with a principal-chosen intermediary.

The framework established by the DPDP Act and Rules aligns closely with the Data Empowerment and Protection Architecture (DEPA) framework, a policy initiative published by NITI Aayog, the Government of India's primary policy think tank. NITI Aayog continues to serve as the apex public policy think tank of the Government of India. Under the DEPA model, individuals retain the power to select and change their Consent Manager, independent of the institution holding their data. The intermediary is designed to log consent instructions without ever accessing or retaining the underlying personal data itself. This ensures that the data principal's election of a Consent Manager remains central to the system, emphasizing individual control over personal data ahead of the November 14, 2026, enforcement date for Rule 4 of the DPDP Rules 2025.

Lawyers and compliance officers must understand that under the DPDP Act, the data principal, not the data fiduciary, elects the Consent Manager. Data fiduciaries must adjust their compliance architecture and vendor engagement strategies to reflect that they 'onboard' to a Consent Manager chosen by the data principal, rather than appointing one themselves, to avoid non-compliance ahead of the November 14, 2026 deadline.

Source: Original reporting via legal industry analysis.