Consent Manager vs Consent Management Platform: What the DPDP Act Actually Requires

The short answer

Under India’s Digital Personal Data Protection (DPDP) Act 2023, a Consent Manager and a Consent Management Platform (CMP) are two different things, and most companies only need the second one.

• A Consent Manager is a company registered with the Data Protection Board of India. It acts on behalf of individuals (Data Principals), giving them one place to give, review and withdraw consent across many businesses.
• A Consent Management Platform is software that a business (a Data Fiduciary) runs on its own website or app to collect, record and honour consent.

If you run a website, app or SaaS product that collects personal data from people in India, you are a Data Fiduciary. You need a CMP, or something that does its job. You do not need to become a Consent Manager, and you are not required to use one.

What the DPDP Act says about Consent Managers

The Act defines a Consent Manager in Section 2(g) as a person registered with the Board who acts as a single point of contact so a Data Principal can give, manage, review and withdraw consent through an accessible, transparent and interoperable platform.

Section 6(7) to 6(9) then sets out how they work:

• A Data Principal can give, manage, review or withdraw consent to a Data Fiduciary through a Consent Manager.
• The Consent Manager is accountable to the Data Principal and acts on their behalf.
• Every Consent Manager must be registered with the Board, on conditions set in the Rules.

The DPDP Rules 2025 add the registration conditions. In summary, a Consent Manager must be a company incorporated in India, meet a minimum net worth requirement (reported as ₹2 crore), have sound technical and organisational measures, and run an interoperable platform. It must not have a conflict of interest with the Data Fiduciaries it connects to, and it must keep records of consents it handles.

In other words, a Consent Manager is a regulated intermediary, much closer to an Account Aggregator in the RBI framework than to a cookie banner vendor.

What a Consent Management Platform does

A CMP is the tool a business uses to meet its own consent duties. Under Sections 5 and 6 of the Act, a Data Fiduciary must:

1. Give a clear notice listing the personal data collected and the purpose of each use, in English or any of the 22 languages in the Eighth Schedule of the Constitution.
2. Collect consent that is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. Pre-ticked boxes and “by using this site you agree” banners do not meet this bar.
3. Make withdrawal as easy as giving consent.
4. Prove consent was given. Section 6(10) puts the burden of proof on the Data Fiduciary if consent is ever questioned.
5. Handle rights requests for access, correction, erasure and grievance redressal.

A good CMP covers all five: the notice, the consent capture, the withdrawal flow, a reliable record of every decision, and a way for people to exercise their rights.

Side-by-side comparison

Do you need to integrate with a Consent Manager?

Not today. The Act lets a Data Principal choose to manage consent through a Consent Manager, so once registered Consent Managers are live, some of your users may arrive through one. When that happens you will need to accept and honour consent and withdrawal signals that come from the Consent Manager, in addition to those collected directly.

The practical step now is to make sure your consent records are structured, per purpose, and easy to update from an external signal. If your current setup stores consent as a single yes/no flag in a database, that will be hard to connect later.

Key dates

The DPDP Rules 2025 were notified on 13 November 2025 and phase in over 18 months:

• 13 November 2025: Data Protection Board provisions took effect.
• 13 November 2026: Consent Manager registration provisions take effect.
• 13 May 2027: the main obligations for Data Fiduciaries, including notice, consent, rights and breach reporting, take effect.

Check these dates against the official Rules published in the Gazette before planning around them. Penalties under the Schedule to the Act go up to ₹250 crore for failing to take reasonable security safeguards, and up to ₹50 crore for other breaches of the Act or Rules. Use our DPDP penalty calculator to estimate your exposure.

What to do before May 2027

1. Map your data and purposes. List every personal data field you collect and why. Each purpose needs its own consent item.
2. Rewrite your consent notice. Make it itemised, plain, and available in the languages your users read. See our guide to DPDP consent notice requirements.
3. Replace “implied consent” banners with an explicit opt-in that blocks non-essential scripts until consent is given.
4. Keep a tamper-evident record of each consent decision: who, what notice version, which purposes, and when.
5. Set up a rights and grievance process with clear response times.
6. Plan for Consent Manager signals so external consent and withdrawal can update your records.

Our free DPDP compliance checklist walks through each step.

How ConsentPlix fits in

ConsentPlix is a Consent Management Platform, not a registered Consent Manager. It gives your website or app an itemised DPDP notice in 22 Indian languages, a sub-12KB consent widget, signed receipts for every consent decision, and a hosted rights portal for access, correction and erasure requests. Consent records are stored per purpose, so they can be updated from external signals as Consent Managers come online.

You can compare plans, including a free tier, or book a demo to see it on your own site.

Frequently asked questions

Is a Consent Manager mandatory under the DPDP Act? No. Businesses are not required to use a Consent Manager. Individuals may choose to use one, and businesses must then honour consent given or withdrawn through it.

Can a CMP vendor become a Consent Manager? Only by registering with the Data Protection Board and meeting the conditions in the DPDP Rules, including Indian incorporation, minimum net worth and having no conflict of interest with the Data Fiduciaries it serves.

Is a cookie banner enough for DPDP compliance? Usually not. DPDP consent covers all personal data, not only cookies, and needs an itemised notice, an explicit opt-in, easy withdrawal and proof of consent.

When do DPDP consent rules apply to my business? The main Data Fiduciary obligations apply from 13 May 2027, 18 months after the Rules were notified. Starting now leaves time to fix notices, records and rights handling.