India’s statutory Consent Manager role is a regulated intermediary position, not just another name for consent-management software. In January 2025, Leegality and IDfy were reported as intending to apply under the then-draft framework; that report does not establish that either firm—or Skyflow—later applied or registered. The final Rules have since been notified, with the Consent Manager provisions scheduled to take effect on 13 November 2026, according to the International Bar Association’s implementation analysis.
What is a DPDP Consent Manager?
Under India’s Digital Personal Data Protection framework, a Consent Manager is an intermediary registered with the Data Protection Board of India. Its platform enables a Data Principal—the person whose personal data is involved—to give, manage, review or withdraw consent across the Data Fiduciaries onboarded to that platform. The statutory role is therefore different from enterprise consent software that a company buys to manage its own customer or employee consent processes. A vendor’s use of the phrase “consent management” does not by itself mean it is a registered Consent Manager.
As an Amazon Associate I earn from qualifying purchases.
The final Rules put duties on the intermediary in relation to the Data Principal. They require it to act in a fiduciary capacity, provide records of consent and related notices, and make those records available in machine-readable form on request. Records must be retained for at least seven years. The Rules also require safeguards intended to ensure that personal-data contents shared through the platform are not readable by the Consent Manager, alongside conflict-of-interest controls, specified ownership and management disclosures, and audit mechanisms.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Which privacy-tech companies said they might apply?
The Economic Times reported on 7 January 2025, while the Rules were still in draft, that Leegality intended to apply for registration and IDfy planned an application. IDfy had built Privy to manage customer consent. The report also described Skyflow as providing privacy-data services to some Indian companies; it did not say Skyflow planned an application.
#1 Best Overall
Leegality cofounder Shivam Singla told the newspaper: “We do plan to apply for consent manager registration. Our experience with operating digital compliance flows at scale within large organisations – especially in the banking sector puts us in a good position to take on the role of a consent manager and help close the compliance gap in large companies,”
The same article said executives had spoken with more than 100 large companies, many of which were conducting initial assessments or pilots. That figure is an attributed statement in the January 2025 report, not an independently verified count of the market. The report records intentions and activity at the draft stage; it does not establish any named firm’s later application, registration, or current statutory status.
What does registration require?
The Rules’ First Schedule sets entry requirements for an applicant. These are materially different from ordinary software procurement criteria because the applicant must qualify as a company and its platform must meet requirements linked to standards and an assurance framework published by the Board.
| Requirement | What the Rules specify |
|---|---|
| Legal form and place of incorporation | The applicant must be a company incorporated in India. |
| Financial threshold | Minimum net worth of ₹2 crore, with sound financial condition and adequate prospective business. |
| Management | Management must have a general reputation and record of fairness and integrity. |
| Platform assurance | Independent certification that the interoperable platform conforms to standards and an assurance framework published by the Board, with appropriate technical and organisational measures. |
The Rules also give the Board supervisory powers. It can require information, direct corrective measures after giving the Consent Manager an opportunity to be heard, and suspend or cancel registration to protect Data Principals. Registration is thus an ongoing regulated status, not a label a software provider can adopt on its own.
When do the DPDP Consent Manager provisions take effect?
The Government announced that the Digital Personal Data Protection Rules, 2025 were notified on 14 November 2025 and described an 18-month phased implementation. The IBA analysis identifies the stages as follows:
| Provision category | Commencement date cited by the IBA |
|---|---|
| Board-related provisions | 13 November 2025 |
| Consent Manager provisions | 13 November 2026 |
| Substantive provisions | 13 May 2027 |
On the cited schedule, the Consent Manager provisions are due to commence shortly after this article’s 5 October 2026 status date. The Board-related provisions have already commenced under that schedule, but commencement alone does not establish that the Board has appointed all members, published technical standards, opened applications, or completed registrations. The Government describes the Board as intended to operate digitally; that design description is not proof of its operational capacity.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Has the Data Protection Board been formed, and are applications open?
The available published information summarized here does not verify whether the Board’s Chairperson and members have been appointed by 5 October 2026, whether the Board has issued the Consent Manager standards, whether applications are open, or whether any of the firms named above has registered. It is therefore not possible to confirm the live application or registration position from these sources. Board-related provisions having commenced is not, by itself, an answer to whether the Board is fully appointed or operational.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →The Government’s November 2025 release describes the framework’s announced design: Data Fiduciaries are to issue clear, standalone consent notices explaining the specific purpose, and Consent Managers are to be Indian companies. For a current decision, organisations and prospective applicants need to check the latest MeitY or Board notices and any official register rather than infer availability or status from the 2025 company-interest report.
Best Value
- No more exposed information in unprotected notary journals. This product shields clients' confidential information from prying eyes. It allows the Notary Public to keep the journal open during the transaction, as NO prior client information is viewable.
- Shields clients' AND Notary Publics' confidential information
- GLBA and HIPAA require non-disclosure policies and procedures. Notary Privacy Guard is a compliance tool for the professional Notary Public.
- Decreases Notary Public's liability from exposing client information
- Journal column headers are printed on the Notary Privacy Guard, no having to peek underneath to complete the journal entry. Becomes part of the journal and also acts as a place marker.
What should a company assess before choosing this route?
A business deciding whether to become a statutory Consent Manager is making a different decision from one choosing privacy software for internal workflows. Prospective applicants should assess their eligibility and ability to meet the Board’s certification requirements; organisations considering a Consent Manager should assess whether the intermediary is actually registered and whether its platform meets their integration and governance needs.
- Regulatory eligibility: Confirm Indian incorporation, the net-worth and financial-condition requirements, and management suitability.
- Interoperability and certification: Establish what the Board’s published standards and assurance framework require and whether independent certification is available.
- Data handling: Determine how the platform prevents its operator from reading personal-data contents shared through it.
- Accountability: Review consent and notice records, machine-readable access on request, the seven-year retention duty, audits, disclosures, and conflict controls.
- Operational fit: Map integrations with onboarded Data Fiduciaries and the consent journeys Data Principals must be able to manage.
Buying enterprise privacy software does not confer statutory registration. Conversely, a firm’s historical intention to apply is not evidence that it has met these conditions or is authorized to act in the registered role.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →
