Can a Company Be a DPDP Consent Manager? Who Can Register

Yes. Under India's DPDP Act, 2023, a Consent Manager is a "person" registered with the Data Protection Board, and "person" includes a company. The Rules go further: as we read Part A of the First Schedule, an applicant must be a company incorporated in India. Registration under rule 4 applies from 13 November 2026.

Key points

• The Act defines a Consent Manager as a "person" registered with the Board. The Act's definition of "person" includes a company, so a consent manager can be a company and is not defined as only an individual.
• The Act sets the broad category. The Rules, in rule 4 and the First Schedule, set who can actually be registered. As we read Part A of the First Schedule, the applicant must be a company incorporated in India. Applicants should check the exact wording in the notified text.
• Rule 1 gives the Rules three start points: on publication, one year after (rule 4) and eighteen months after (most of the remaining rules).
• Rule 4, on Consent Manager registration, applies from 13 November 2026. When this article was written, on 3 November 2026, that date was still ahead.
• A registered consent manager is a different thing from an organisation's own consent banner or in-app consent screen.

What is a consent manager under the DPDP Act?

The Digital Personal Data Protection Act, 2023 calls individuals "Data Principals". It calls the organisations that decide why and how personal data is processed "Data Fiduciaries". The definitions section (section 2) sets out both terms.

The same section defines a "Consent Manager". In summary, it is a person registered with the Board. That person acts as a single point of contact through which a Data Principal can give, manage, review and withdraw consent. The platform must be accessible, transparent and interoperable. "Interoperable" means it can work with other systems, so one person's consent choices are not locked inside a single organisation's product.

The Act's consent provision (section 6) also refers to Consent Managers. In summary, it says that a Data Principal may give, manage, review or withdraw consent through a Consent Manager. It says a Consent Manager is accountable to the Data Principal and acts on the Data Principal's behalf, subject to prescribed obligations. It also says every Consent Manager must be registered with the Board in the manner, and subject to the conditions, that the Rules prescribe. This is a summary and not a quotation. The exact wording is in sections 2 and 6 of the Act.

Can a company be a consent manager?

Yes, on the Act's wording. The Act defines a Consent Manager as a "person", and its definition of "person" in section 2 is wide. In summary, it covers an individual, a Hindu undivided family, a company, a firm, an association of persons or body of individuals (whether incorporated or not), the State, and any other artificial juristic person. A company therefore falls within the category, and the Act does not limit a consent manager to a natural person.

That is the Act's general category, not the final test. The Act leaves the conditions for registration to the Rules. Those conditions are in rule 4 and Part A of the First Schedule to the DPDP Rules, 2025.

As we read Part A, the applicant must be a company incorporated in India. Part A also sets further conditions on matters such as technical, operational and financial capacity. This article does not restate those further conditions or any financial thresholds. The exact wording matters, and a secondary summary, including this one, is not a substitute for the notified text.

The practical result, in our reading, is that the Act's broad word "person" should not be taken to mean that any kind of person can register. An individual, a partnership or a foreign entity should check Part A closely before assuming it is eligible.

When does consent manager registration begin?

The DPDP Rules, 2025 were notified on 13 November 2025. Rule 1 sets when each part of the Rules starts to apply. As we read it, there are three start points:

• On publication: the opening rules and the rules that set up the Data Protection Board took effect on 13 November 2025.
• After one year: rule 4, on Consent Manager registration, applies from 13 November 2026.
• After eighteen months: most of the remaining rules apply from 13 May 2027.

Registration therefore begins about six months before most of the other rules start to apply. Because the exact list of rules in each group is set out in rule 1, anyone planning around these dates should check that rule in the notified text.

What do the Rules say about registration?

Rule 4 and the First Schedule deal with the conditions an applicant must meet and the obligations that apply once it is registered. In our reading, these are two separate groups. One decides whether an applicant can be registered. The other governs how a registered Consent Manager must behave.

It helps to keep three things apart:

• What the law requires: registration with the Board, and compliance with the conditions and obligations set by the Act and the Rules.
• What is good practice: keeping written records of how a platform lets a person give, manage, review and withdraw consent, and who is responsible for each part.
• What is a recommendation: mapping each registration condition to a named owner and a piece of evidence before applying.

Does a consent manager replace an organisation's own consent work?

In our reading, no. A Consent Manager is a channel through which a Data Principal may act. It does not take over a Data Fiduciary's own duties under the Act. Under rule 1, most of the rules that support those duties apply from 13 May 2027.

On the labels, the Act's definition refers to a person registered with the Board. An organisation's own cookie banner or in-app consent screen is a different tool. Using the words "consent manager" for it does not make its operator a registered Consent Manager under the Act.

How a Data Fiduciary must deal with a registered Consent Manager is a point to check in section 6 of the Act and in the Rules. This article does not state a conclusion on it.

What can a consent platform team prepare in advance?

The checklist below is good practice. It is not a list of what the Rules require, and it does not replace reading the notified Rules.

Common questions

Can a company act as a consent manager, or only an individual?

A company can. The Act defines a Consent Manager as a person registered with the Board, and its definition of "person" includes a company. As we read Part A of the First Schedule, the Rules go further and require the applicant to be a company incorporated in India, so an individual should check eligibility carefully.

When can a consent manager register under the DPDP Rules?

Rule 4 applies from 13 November 2026, one year after the Rules were notified on 13 November 2025. Rule 4 and the First Schedule set the conditions for registration.

Is a consent banner the same as a consent manager?

In our reading, no. The Act defines a Consent Manager as a person registered with the Board. An organisation's own consent banner or in-app screen is part of that organisation's own compliance with the Act's consent duties.

General information, not legal advice. Prepared with AI assistance and checked against the official sources cited. Laws change; check the date above.