Consent Manager vs Consent Management Platform: What 13 November Changes for Indian Enterprises

On 13 November 2026, Rule 4 of the DPDP Rules comes into force. Companies can then apply to the Data Protection Board of India to register as consent managers. Since that date was confirmed, one question keeps reaching compliance teams. Do we now need a consent manager? Is it the same thing as the consent management platform we already run?

The short answer is no, and no. The consent manager vs consent management platform question comes down to who the system works for. A consent manager is a registered intermediary that acts for the individual. A consent management platform is software a data fiduciary runs to meet its own obligations.

Your deadline has not moved either. Notice, consent, rights, security safeguards, breach reporting, and penalties of up to ₹250 crore start on 13 May 2027. The 13 November date matters to companies that want to become consent managers.

Consent Manager Under the DPDP Act: What the Law Says

Section 2(g) of the DPDP Act defines a consent manager as a person registered with the Board. It acts as a single point of contact for a data principal to give, manage, review, and withdraw consent through an accessible, interoperable platform. In practice, that means one app or dashboard where an individual can see and control the consents they have given to many companies over their personal data.

Section 6(9) says every consent manager must be registered with the Board. From 13 November 2026, a company that wants to act as one has to be registered first.

The First Schedule to the Rules sets the bar for registration. An applicant must:

• Be a company incorporated in India
• Have a net worth of at least ₹2 crore
• Have directors, key managerial personnel, and senior management with a record of fairness and integrity
• Get independent certification that its platform meets the interoperability and data protection standards the Board publishes
• Carry conflict of interest provisions in its constitutional documents

Once registered, a consent manager acts in a fiduciary capacity towards the data principal. It must avoid conflicts of interest with data fiduciaries, including through its promoters and key managerial personnel. It must share personal data in a form it cannot read, publish who owns and runs it (including every shareholder above 2%), and it cannot subcontract its obligations.

That last set of rules tells you what the role is for. A consent manager is built to be independent of the companies whose consents it carries.

Consent Manager vs Consent Management Platform: Who Each One Works For

Both deal with consent, which is where the confusion starts. The legal role, the customer, and the scope are different.

The two roles stand on opposite sides of the same consent. When an individual withdraws consent through a consent manager, the consent manager passes that instruction to the company. The company's own systems then have to act on it: stop the processing, update every downstream copy, and keep a record that it did. The consent management platform is where that work happens.

This is also why one company playing both roles for the same consent raises questions under the Rules. A consent manager has to show it has no conflict of interest with the data fiduciaries it serves. A consent management vendor is hired, paid, and directed by those same data fiduciaries.

Why the Difference Matters for Data Fiduciaries

The consent manager vs consent management platform choice changes less than people expect. Three practical consequences follow.

Using a consent manager does not move your obligations. The data fiduciary still gives notice to the Rule 3 standard, honours withdrawal, and keeps a verifiable consent artefact. It also erases data when the purpose ends, answers rights requests, secures the data, and reports breaches. A consent manager gives individuals one more channel to reach you. Every request that comes through it still has to be carried out inside your systems.

Consent is a small share of the work. In our work with Indian enterprises, consent and notices are roughly a fifth of a DPDP programme. The rest is knowing where personal data is held and handling data principal requests through your Data Protection Officer or grievance officer. It also means managing processors, responding to incidents, running privacy impact assessments, and enforcing retention. None of that changes with the consent manager vs consent management platform choice.

Withdrawal is a data mapping problem. A withdrawal that arrives through a consent manager has to reach your CRM, marketing tools, data warehouse, analytics, and every processor that received the data. If you cannot list those systems today, a consent manager will not fix that. It will expose it faster. A DPDP compliance programme for May 2027 starts with that list.

What Is Still Unknown About Consent Managers

Very little about the consent manager market is settled, days before registration opens.

• The Board has no members. MeitY invited applications for a chairperson and four members on 6 May 2026. As of early November 2026, we could find no notification appointing anyone, and a Board without members cannot hold proceedings.
• The consent manager registration process. No public portal, form, or decision timeline had been published that we could find.
• The standards. Consent managers must be certified against interoperability and data protection standards the Board publishes. Those standards are not out yet.
• The market. Nobody knows how many companies will register, who they will be, or when the first approvals will come.
• The business model. Who pays a consent manager, whether the individual, the enterprise, or nobody, is open.

None of these unknowns changes what a data fiduciary has to do by 13 May 2027. Working with a consent manager is optional. An enterprise can choose none, one, or several, and it can make that call once registered consent managers exist and can be assessed. The compliance work cannot wait for that.

Common Mistakes Indian Enterprises Make About the 13 November Date

1. Treating 13 November as their own deadline. It is a registration date for consent managers. Data fiduciary obligations begin on 13 May 2027.
2. Assuming a consent manager makes them compliant. It handles one channel for one obligation. Notices, erasure, rights, security, breach reporting, and processor contracts stay with the enterprise.
3. Calling a cookie banner consent management. A banner captures a click on one website. DPDP consent has to cover apps, branches, call centres, and offline forms, with purpose-level records and working withdrawal. Our guide to cookie laws and cookie managers sets out where banners fit.
4. Waiting to see which consent managers register. Six months is short for data mapping, notice rewrites, and system changes across a large enterprise. Waiting for an optional layer delays the mandatory one.
5. Choosing a consent vendor locked to a single consent manager. If your customers will one day reach you through several consent managers, your platform should be able to connect with any registered one you pick, or with none.

How to Get Started Before May 2027

Start with what is certain. The DPDP compliance guide for 2026 sets out the full sequence, and this shorter one works whether or not you ever connect to a consent manager.

1. Build a data inventory. List every system, vendor, and process that holds personal data, and what purpose each one serves.
2. Rewrite notices to the Rule 3 standard. Each notice must itemise the data, the purpose, and how to withdraw.
3. Make consent and withdrawal work end to end. Capture purpose-level consent, and make sure a withdrawal stops processing in every downstream system.
4. Set up data principal requests and grievance handling. Access, correction, erasure, and nomination requests need an owner, a workflow, and a response clock.
5. Assess risk and prepare breach response. Run privacy impact assessments on high-risk processing. Know who reports to the Board and to affected individuals, and how fast. Our guide to incident management under DPDP covers the steps.
6. Review processor contracts. Every vendor that touches personal data needs a valid contract and a risk review. A TPRM tool keeps that current.
7. Keep the consent manager option open. Whatever you decide on consent manager vs consent management platform, check that your consent platform can connect to registered consent managers once the Board publishes its standards. If you are comparing vendors, our breakdown of consent tools vs privacy platforms sets out what each type of product covers.

Where Privy by IDfy Fits

Privy by IDfy is a full-stack DPDP compliance and privacy governance platform for Indian enterprises. Consent is one of three pillars, next to continuous compliance and risk (privacy impact assessments, incident management, and third-party risk) and personal data discovery and governance. The Consent Governance Platform covers notices, consent records, withdrawals, data principal rights, and cookies. Personal Data Discovery & Governance finds the personal data behind them.

On the consent manager vs consent management platform line, Privy works on the enterprise side. It helps data fiduciaries meet DPDP on their own, and it will connect to any registered consent manager a customer chooses to work with, or none. The full set of modules is on the solutions page.

Conclusion

On 13 November, India's consent manager framework opens for registration, with an empty Board, no published standards, and no clear business model. Those questions will get answered over the coming months, and enterprises can decide then whether to work with a consent manager at all.

The consent manager vs consent management platform distinction gives you a simple rule for the next six months. Consent managers are optional and still taking shape. Compliance is mandatory, the date is 13 May 2027, and the work runs through your own data, systems, and vendors.

You can read more about the platform on IDfy's DPDP compliance platform page.

To see how Privy by IDfy maps DPDP obligations to your data estate, book a demo or write to shivani@idfy.com for a walkthrough.

FAQs

Is a consent manager the same as a consent management platform?

No. A consent manager is a company registered with the Data Protection Board that acts for individuals. A consent management platform is software an enterprise uses to meet its own consent obligations. The consent manager vs consent management platform difference is who each one works for.

Do enterprises have to use a consent manager under the DPDP Act?

No. The DPDP Rules let data fiduciaries collect and manage consent directly, as long as they meet the notice, consent, withdrawal, and record-keeping obligations themselves.

What happens on 13 November 2026?

Section 6(9) of the Act and Rule 4 of the DPDP Rules come into force, and consent manager registration opens. Eligible companies can apply to the Board to register as consent managers. No new obligation starts for ordinary data fiduciaries on that date.

Who can register as a consent manager?

It must be an Indian company with a net worth of at least ₹2 crore. Its directors and management need a record of fairness and integrity. Its platform needs independent certification, and its constitutional documents need conflict-of-interest safeguards.

If we use a consent manager, are we DPDP compliant?

Not by itself. A consent manager is one channel for giving and withdrawing consent. Notices, erasure, data principal requests, security safeguards, breach reporting, and processor contracts remain your responsibility.

Can our consent management platform work with consent managers?

It should. Ask your vendor whether it can connect to any registered consent manager through an API once the Board publishes interoperability standards. Ask whether it works equally well with none.

When do DPDP penalties apply?

From 13 May 2027, together with most data fiduciary obligations. The highest penalty, for failing to keep reasonable security safeguards, is up to ₹250 crore.