Consent Managers, explained — and why your MSME probably isn't one
A Consent Manager is a new kind of entity the DPDP Act creates: a platform registered with the Data Protection Board through which individuals can give, review and withdraw consent across many businesses in one place. Its provisions switch on around November 2026. Unless you plan to become one of these registered intermediaries, this isn't your obligation — your business is a data fiduciary, and what it needs is valid consent from its own customers and provable records of it.
"Consent Manager" may be the most misunderstood term in the whole DPDP regime. Businesses hear it and assume it's something they must register as, buy, or appoint — like the grievance officer. It isn't. Here's what the framework actually is, and what you need instead.
What the Act actually creates
Think of a Consent Manager as a UPI-style intermediary for consent. Just as UPI lets you operate every bank account from one app, a Consent Manager is meant to give an individual one dashboard where they can see every consent they've given — across their bank, their hospital, their e-commerce apps — and give, review or withdraw any of them from one place.
Key features of the framework:
- Registered and regulated. Consent Managers must register with the Data Protection Board and meet the governance and financial conditions the Rules prescribe.
- Accountable to the individual. A Consent Manager acts on behalf of the data principal — not the businesses — and owes its duties to them.
- Interoperable. The design intent is a single, standard interface between individuals and the many fiduciaries holding their data.
- An option, not a gate. Individuals may route consent through a Consent Manager; businesses must be able to handle that. But consent given directly to you remains fully valid — nothing requires consent to flow through one.
The timeline
| When | What |
|---|---|
| ~Nov 2026 | Consent Manager provisions take effect — 12 months after the final Rules were notified (November 2025). Registration of these entities begins. |
| 13 May 2027 | Full DPDP compliance deadline for every data fiduciary — with or without Consent Managers in the picture. (The full phased timeline.) |
Consent Manager vs consent management tool — the naming trap
Two things with nearly identical names, doing different jobs:
- A Consent Manager (the Act's term) is a registered third-party entity serving individuals across many businesses.
- A consent management tool — what the industry calls a CMP — is software a business uses to collect, record and prove its own customers' consent. Ronin Consent is this second thing.
Every data fiduciary needs the second in some form, because the consent obligations — notice, affirmative action, easy withdrawal, and records that survive an audit — apply to you directly, from day one. Very few companies will ever be the first.
So what should an MSME actually do?
- Don't register for anything — Consent Manager registration is for the intermediaries themselves.
- Get your own consent flow right — valid collection, granular purposes, one-tap withdrawal, timestamped records.
- Keep your records interoperable-ready — clean, per-person, per-purpose consent data will make plugging into Consent Managers straightforward if your customers start using them after Nov 2026.
- Watch the registrations — once the Board starts registering Consent Managers, sectors like BFSI will likely move first; most MSMEs can simply track it.
Need the consent records, not the registration?
Ronin Consent gives your business the part the Act demands of you: compliant collection and an append-only, exportable consent log — one script tag, MSME pricing. Early access is open.
Keep reading
- DPDP Rules 2025 explained: the deadlines and what to do now
- What makes consent valid under the DPDP Act
- Grievance officer under the DPDP Act: who needs one
The DPDP Act gives individuals rights too. Saaph.in — a Ronin Works product — finds where your personal data is exposed across the open web and gets it removed under the Act, then keeps watch.
Scan your exposure at Saaph.in →Confused about what applies to you?
Send us a note — we reply within one working day.
This article is general information, not legal advice. It summarises the DPDP Act, 2023 and the DPDP Rules as notified in November 2025; registration conditions for Consent Managers are prescribed in the Rules — consult the Gazette notifications or a qualified professional for the authoritative text, or talk to Ronin Works.