Consent Managers under the DPDP Act: what media teams need to know
Short answer
A Consent Manager is a company registered with the Data Protection Board that lets people give, review and withdraw consent across many organisations from one platform. Registration opens on 13 November 2026. Organisations are not required to use one. Schools, event organisers and studios still owe their own notice, consent records and withdrawal handling from 13 May 2027.
| Key sections | Section 6, Section 5, Section 7 |
|---|---|
| Applies from | 13 May 2027 |
| Maximum penalty | Up to ₹50 crore for most breaches of these duties, decided by the Data Protection Board after inquiry |
On 13 November 2026 the part of India’s data protection law that deals with Consent Managers comes into force. Expect vendor emails and LinkedIn posts saying every school, event company and studio now “needs a Consent Manager”. That is not what the law says. This guide explains what a Consent Manager is, what changes on 13 November, and what it means if your work involves photos and video of people.
What the Act says
The Digital Personal Data Protection Act, 2023 defines a Consent Manager as a person registered with the Data Protection Board who acts as a single point of contact, letting a Data Principal give, manage, review and withdraw consent through an accessible, transparent and interoperable platform.
Section 6 sets out three things about them:
- A Data Principal may give, manage, review or withdraw consent to a Data Fiduciary through a Consent Manager (Section 6(7)).
- The Consent Manager is accountable to the Data Principal and acts on their behalf (Section 6(8)).
- Every Consent Manager must be registered with the Board, on the technical, operational, financial and other conditions set by the Rules (Section 6(9)).
Rule 4 of the DPDP Rules, 2025 and the related Schedule set the conditions for registration and the obligations a registered Consent Manager carries. Read the official Rules for the full conditions; they apply to the Consent Manager, not to the organisations that receive consent through one.
What changes on 13 November 2026
The commencement notification of 13 November 2025 brought the Act into force in three stages. The Board and the framework provisions applied first. The Consent Manager provisions apply from 13 November 2026. The main duties of fiduciaries, including notice, consent, legitimate uses, children’s data, security, breach reporting and rights, apply from 13 May 2027.
So from 13 November 2026, companies can apply to the Board to register as Consent Managers. Nothing changes that day in what a school, event organiser or studio must do. Your duties to give notice and collect valid consent still start on 13 May 2027.
What a Consent Manager is not
Three misreadings are already common.
It is not mandatory for fiduciaries. The Act gives people the option of using a Consent Manager. It does not require you to integrate with one, and it does not stop you collecting consent directly.
It is not every consent tool. A form builder, a cookie banner or a photo-permission system that you run for your own organisation is a tool you use as a fiduciary, or that a vendor runs for you as a processor. A registered Consent Manager is different: it works for the individual, across organisations, and answers to the individual.
It does not move your responsibility. Even if consent arrives through a Consent Manager, you remain the Data Fiduciary. You still owe a proper Section 5 notice, purpose limits, security, erasure when consent is withdrawn, and the burden of proving notice and consent (Section 6(10)).
What it means for photos and video
Most photo and video consent today is local: a tick box on a school admission form, a line on an event registration page, a signed release at a shoot. That will stay the main route for media teams for some time, for practical reasons.
- Consent is per purpose. A parent may agree to the school’s internal album but not to Instagram. Whatever channel consent arrives through, you need it broken down by purpose, as Section 6(1) requires.
- Photos involve groups. One image can need permission from many people. Your own permission record still has to show who appears in what and what each person agreed to.
- Children need verified parents. For anyone under 18, Section 9 and Rule 10 require verifiable consent from a parent or lawful guardian. Whoever collects it, you must be able to show the consenting adult was checked.
If a parent, attendee or employee withdraws consent through a Consent Manager, the withdrawal reaches you like any other: you stop processing for that purpose within a reasonable time, make your processors stop, and erase what you hold unless a law requires you to keep it.
A short checklist for now
- Do not buy anything because it is called a “Consent Manager” this month. Ask the vendor whether it is registered with the Board, and if not, what it actually is: a processor running your consent records.
- Map where consent for photos and video is collected today: admission forms, registration pages, contracts, WhatsApp. The photo-sharing checklist helps.
- Split consent by purpose, with one tick box per use. The consent form generator gives sample wording.
- Make withdrawal as easy as giving consent, and decide who acts on a withdrawal and how fast.
- Keep a record you can produce: who agreed, to what, when, through which channel, and when they changed their mind.
Where the edges are
How Consent Managers will connect with fiduciaries in practice depends on who registers and what technical standards emerge. Whether a large school group or event platform should accept consent through registered Consent Managers is a decision to revisit once some are registered. If you plan to become a Consent Manager yourself, take specialist legal advice on Rule 4; the conditions are demanding and specific.
Getting ready
Consent Managers are worth watching, but they do not change the work most organisations need to do before 13 May 2027: clear notices, purpose-by-purpose consent, verified parental consent and a withdrawal process that actually works. Take the 2-minute readiness check to see where you stand, or book a readiness call to map your photo and video workflows against the Act.
Frequently asked questions
Do we have to use a Consent Manager?
No. The Act lets a Data Principal give, manage, review or withdraw consent through a Consent Manager, but it does not require a Data Fiduciary to use one. You can collect and record consent yourself, as long as your notice, consent and withdrawal process meet Sections 5 and 6 and you can prove consent was given.
Is a consent management platform the same as a Consent Manager?
Not necessarily. Many software tools manage consent for one organisation. A Consent Manager under the Act is a registered entity that acts for, and is accountable to, the Data Principal across organisations. A vendor should only call itself a Consent Manager if it is registered with the Data Protection Board.
When does Consent Manager registration start?
The provisions on Consent Manager registration, Section 6(9) and Rule 4 of the DPDP Rules, 2025, apply from 13 November 2026 under the commencement notification of 13 November 2025. The main duties of fiduciaries, including notice and consent, apply from 13 May 2027.
If someone withdraws consent through a Consent Manager, what must we do?
Treat it like any other withdrawal. Stop processing for that purpose within a reasonable time, make your processors stop too, and erase the data unless a law requires you to keep it. Earlier processing done lawfully on that consent is not affected (Section 6(4) to 6(6)).
Read next
Prepared by DPDPA Ready and checked against the Digital Personal Data Protection Act, 2023, the DPDP Rules, 2025 and the commencement notification of 13 November 2025. General information, not legal advice. Editorial standards. Found an error? Tell us.