A consent manager, under India's Digital Personal Data Protection (DPDP) framework, is a registered intermediary that acts for the data principal, meaning the customer, in giving, managing and withdrawing consent across businesses. The Uniqus compliance guide describes it as playing the role of fiduciary toward data principals, and places the consent manager ecosystem phase from November 2026. General information only: this is not legal advice.
What does a consent manager do for an online seller or brand?
The Uniqus guide gives one example: an e-commerce platform uses a consent manager to centralise marketing opt-ins and withdrawals across its website, app and CRM. If you run a D2C store, a WhatsApp list or an app, you hold customer data and likely count as a data fiduciary. A consent manager would be one way for customers to manage consent to you.
Who can be a consent manager?
Per the same guide, the conditions are:
- Incorporated in India.
- Net worth of at least ₹2 crore (as the guide states it).
- A Board-certified interoperable platform.
- Consent and notice records maintained for 7 years.
Timeline
The DPDP Rules, 2025 are described as in force, with a build phase from November 2025 to November 2026, an implement phase from November 2026 to May 2027, and full compliance and penalties from 13 May 2027.
What does the Rules text say about timing?
Bar & Bench reports that the DPDP Rules, 2025 were notified by Gazette Notification dated 13 November 2025. Rules 1, 2 and 17 to 21, on the Data Protection Board, applied immediately. Rule 4, on registration and obligations of consent managers, applies after 12 months, which is 13 November 2026, and the data fiduciary obligations in Rules 3, 5 to 16, 22 and 23 apply after 18 months, on 13 May 2027. This matches the Uniqus phases and gives the exact dates. Because the consent manager rule only starts on 13 November 2026, expect few or no registered consent managers in the first weeks.
Your real deadline is 13 May 2027. Map where you collect customer data (checkout, WhatsApp, app, loyalty list), write notices, and keep consent records. A consent manager is optional extra plumbing, not a substitute for that work.
What is not confirmed
We could not open the Rules on meity.gov.in, so the table above is from a compliance firm's summary, not the official text. We also have no list of registered consent managers. Do not sign up with a vendor claiming to be one without checking its registration with the Data Protection Board.
For what the Rules mean for brands, see DPDP rules for e-commerce brands and the DPDP compliance timeline.
Blooprint, a Bengaluru e-commerce agency, handles the catalogue and listing side of marketplaces through catalogue and listing optimisation; data-protection compliance itself is for your lawyer.