A consent manager is a new kind of entity created by India’s Digital Personal Data Protection Act, 2023. It is a person or company registered with the Data Protection Board of India that acts as a single point of contact for individuals, letting them give, manage, review and withdraw their consent through an accessible, transparent and interoperable platform.
The idea is to give people one place to see and control the consents they have given to many businesses, instead of hunting through dozens of websites. A data principal can give consent to a data fiduciary either directly or through a consent manager. Consent managers act on behalf of the data principal and are accountable to them, not to the businesses that receive the consent.
The DPDP Rules, notified in November 2025, set out conditions for registering as a consent manager and their obligations, including keeping records of consents given, withdrawn and shared, and avoiding conflicts of interest with the businesses they deal with. The provisions on consent managers come into effect on a later date than the Rules’ notification, as part of the phased roll-out, so check the current status before relying on them.
For most growing businesses running email marketing, the main point is to be ready to accept consent and withdrawals arriving through a consent manager as well as directly. Keeping a clear, timestamped consent record for each contact, and being able to stop emailing someone promptly when consent is withdrawn, will put you in a good position whichever route people use.
In future, a subscriber in Ahmedabad might use a registered consent manager’s app to review every brand she has allowed to send her marketing, and withdraw consent from a shoe retailer with one tap. The retailer would then need to stop marketing emails to her, just as if she had clicked unsubscribe.