Preparing for Consent Manager rules without confusing software with registration

A product that stores consent records is not automatically a Consent Manager under the DPDP Act. The statutory role carries registration conditions, duties to individuals and restrictions that go well beyond displaying a consent banner. This distinction matters when evaluating a vendor or naming an internal project.

As of 22 October 2026, the scheduled registration phase has not yet begun. The commencement notification places section 6(9) and the relevant Board function in the one-year phase, scheduled for 13 November 2026. Rule 4 follows that phase. Sections 6(7) and 6(8), addressing individuals’ use of a Consent Manager and its accountability, belong to the main phase scheduled for 13 May 2027.

Start with the statutory role

The Act’s definition and section 6 describe a person registered with the Board who enables an individual to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform. The Consent Manager acts on behalf of the individual and is accountable to them under the Act.

An ordinary consent management tool may help a business record choices or propagate withdrawals. Those functions can be valuable without establishing statutory registration. Equally, registration in another Indian data-sharing framework does not by itself prove DPDP Consent Manager status.

When a supplier uses the term, ask whether it means a product category or the registered statutory role. Record the answer in procurement documents so commercial descriptions do not quietly become legal assumptions.

Read the eligibility conditions accurately

Rule 4 and Part A of the First Schedule require an applicant to be a company incorporated in India. They include a minimum net worth of two crore rupees, appropriate capacity and other conditions concerning management, technical operation and financial soundness. Net worth should not be casually rewritten as paid-up capital.

The framework also calls for certification concerning the platform and compliance with specified standards and obligations. An ordinary security certification, a successful product demonstration or an attractive interface does not substitute for the registration process.

A prospective provider should map every condition to evidence and identify who will maintain it after registration. Eligibility is an operating commitment, not merely a document assembled once for an application.

Understand what changes after registration

Part B of the First Schedule sets duties concerning records of consents, notices and data sharing. The specified records must be retained for at least seven years. That is a scoped Consent Manager obligation; it is not a direction for every retailer to retain every customer record for seven years.

The framework also requires the contents of personal data shared through the platform to be unreadable to the Consent Manager. This is an architectural requirement that cannot be demonstrated by a promise that staff usually avoid opening records.

Other provisions address conflicts, disclosures, audits and restrictions on subcontracting or assigning the statutory obligations. These details affect staffing, contracts and technical design. A company considering the role should evaluate them before treating registration as an additional label for an existing application.

Evaluate a provider without inventing future status

Consider a hypothetical lending marketplace comparing two consent tools. One supplier describes plans to seek DPDP registration; the other says it already supports withdrawal workflows. These are different claims. Neither establishes registered status without authoritative evidence.

The marketplace can ask for a demonstration of notice versioning, consent export and withdrawal propagation today. Separately, it can ask how the supplier expects to meet the statutory conditions and what happens if registration is delayed or refused. Contracts should describe actual capabilities and responsibilities rather than assume a future approval.

If registration is claimed after the phase begins, verify it against authoritative Board information then available. Do not rely on a badge copied into a sales deck or treat a pending application as approval.

Keep the business’s own duties visible

Using a Consent Manager does not erase the Data Fiduciary’s accountability. Section 8(1) places responsibility on the fiduciary for processing undertaken by it or on its behalf. The business still needs defensible purposes, appropriate notices, safeguards, processor arrangements and rights procedures as the applicable duties commence.

A practical readiness file should therefore separate three questions: what the business must do, what an ordinary tool currently supports and what a registered Consent Manager will be authorised and required to do. That separation helps teams make a useful purchase now without overstating either the product or the law.