Businesses collect personal data through websites, mobile applications, customer accounts, marketing forms, financial transactions and digital services. As data use becomes more complex, consent management is no longer simply a matter of adding an “I agree” button to a website. It involves obtaining valid consent, recording the decision, connecting it to a specific purpose, respecting withdrawal and ensuring the choice is reflected across relevant systems.

India's Digital Personal Data Protection Act, 2023 introduces a detailed statutory framework for consent. The Digital Personal Data Protection Rules, 2025 add operational requirements and establish a framework for registered Consent Managers. The provisions are being brought into force in phases, making it important for businesses to understand both the legal requirements and the implementation timeline.

What Is Consent Management?

Consent management is the process through which an organisation obtains, records, maintains and acts upon an individual's permission concerning the processing of personal data. A reliable system should answer several basic questions.

• What did the individual agree to?
• For what purpose?
• When was consent given?
• Which notice was presented?
• What personal data was involved?
• Can the individual withdraw consent?
• Has the withdrawal reached the systems and service providers processing the information? 

This makes consent management broader than consent collection. It is an ongoing governance process covering the entire consent lifecycle. A business may manage consent through internal processes, software, a consent management platform or, where relevant under the DPDP framework, through a registered statutory Consent Manager.

Consent Under India's DPDP Act

The DPDP Act establishes consent as one of the grounds for processing personal data. Section 4 permits processing for a lawful purpose based on consent or certain legitimate uses specified under the Act. Section 6 establishes the legal standard for valid consent. Consent must be free, specific, informed, unconditional and unambiguous. It must involve clear affirmative action and relate to the specified purpose. It must also be limited to personal data necessary for that purpose. This requirement has direct implications for how businesses design forms, applications and websites. A customer should not be asked to provide unnecessary information merely because it may be useful at some future point. Similarly, unrelated purposes should not be hidden inside a single blanket permission.

Consent Is Not the Same as a Privacy Notice

Privacy notices and consent serve different functions. A privacy notice provides information. It explains what personal data is being processed, why it is being processed and how relevant rights can be exercised. Consent is the individual's affirmative agreement where consent is the applicable legal basis. Section 5 of the DPDP Act requires notice to accompany or precede a request for consent. The 2025 Rules provide further requirements concerning the content and presentation of this notice. The official explanatory note states the notice should be clear, standalone and understandable, with an itemised description of personal data and the purpose for processing. Businesses should therefore avoid treating a long privacy policy as a substitute for a clear consent request.

What Makes Consent Legally Valid?

A valid consent process begins with meaningful information. The individual should understand what information is being requested and why. The purpose should be specific enough to understand the proposed processing. Consent should also involve a genuine choice. A business should not design its user journey in a manner which makes acceptance unavoidable where consent is not genuinely necessary for the service. The DPDP Act also prevents consent from being used to override statutory protections. Section 6 provides, among other things, that consent infringing the Act, Rules or another applicable law is invalid to the extent of the infringement. For businesses, this means consent is not a mechanism for contracting out of legal obligations.

Consent Withdrawal Is Part of Consent Management

Obtaining consent is only the beginning. Section 6 provides individuals with a right to withdraw consent at any time. The process for withdrawal must be as easy as the process for giving consent. Once consent is withdrawn, the Data Fiduciary must stop processing based on that consent and cause its Data Processors to stop, unless continued processing is otherwise authorised or required by law. This requirement creates a practical technology challenge. If a customer withdraws consent through a website, the preference should not remain active in a separate marketing database. Where relevant, the withdrawal should also reach connected processors and downstream systems. A withdrawal mechanism which changes only one database field may therefore be insufficient from an operational perspective.

Consent Management Must Be Purpose Based

Consent should be connected to a defined processing purpose. For example, a business may process customer information to provide a service, send promotional communications, personalise content or conduct analytics. These activities may involve different purposes and should not automatically be treated as one permission. Purpose based consent also improves internal accountability. When a processing activity is reviewed, the organisation can identify the consent supporting it rather than searching through a general customer preference record. This approach becomes particularly important for businesses using customer information for profiling, targeted advertising, artificial intelligence or data analytics.

How Should Businesses Record Consent?

A business should maintain sufficient evidence of consent. The record should ideally establish the identity or relevant identifier of the Data Principal, the date and time of the decision, the purpose involved, the personal data covered, the notice presented and the consent decision. Version control is also important. If a business changes its notice or consent language, it should be possible to identify which version an individual saw when consent was obtained. This creates a defensible audit trail and helps the organisation understand how its privacy practices changed over time. The DPDP Act places the burden of proving valid consent on the Data Fiduciary where consent is relied upon.

Consent Management Across Business Systems

Modern businesses rarely process customer information in a single system. A customer may provide information through a website, while the information is stored in a CRM, processed by a cloud provider, analysed by a data platform and used by a marketing system. Consent must therefore be connected to the wider data ecosystem. Suppose a customer withdraws consent for promotional communications. The withdrawal should be reflected not only in the main customer database but also in relevant email marketing, SMS, customer engagement and advertising systems. The objective is not simply to preserve evidence of the customer's decision. The organisation must also operationalise it.

Consent Management for Websites and Applications

Websites and applications are often the first point at which consent is requested. Consent interfaces should use clear language and should not obscure important information. Where multiple purposes are involved, users should be able to understand the choices being presented. Applications require additional consideration because they may process device identifiers, location information, photographs, contacts or other information depending on their functionality. The consent experience should correspond with the actual data practices of the application. A business should also review its cookies, tracking technologies, analytics tools and advertising integrations. A consent mechanism is ineffective if third party scripts continue processing information despite a user's choice.

What Is a Consent Management Platform?

A Consent Management Platform, commonly called a CMP, is a technology solution used by organisations to manage consent processes. A CMP can help display consent notices, record decisions, manage preferences and communicate choices to connected systems. However, using a CMP is not itself a statutory requirement under the DPDP Act. This distinction is important because the term “Consent Manager” has a specific meaning under Indian law.

Consent Manager Under the DPDP Act

The DPDP Act defines a Consent Manager as a person registered with the Data Protection Board who acts as a single point of contact enabling a Data Principal to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform. This is different from an ordinary consent management platform used by a company for its own website or applications. A statutory Consent Manager is an independent regulated intermediary. It is designed to allow an individual to manage consent across multiple Data Fiduciaries. The 2025 Rules establish registration conditions and operational duties for such Consent Managers. The official MeitY explanatory note states the Consent Manager must meet requirements concerning financial and operational capacity, an interoperable platform, security, records, transparency and conflicts of interest.

When Will Consent Managers Become Operational?

The implementation timeline is particularly important. The commencement notification issued in November 2025 provides different dates for different provisions. Section 6(9), which concerns accountability of Consent Managers, is subject to the one year commencement period. Most of Section 6 is subject to the eighteen month period. Based on the notification dated 13 November 2025, the one year milestone is 13 November 2026 and the eighteen month milestone is 13 May 2027. Rule 4 of the DPDP Rules, which deals with registration and obligations of Consent Managers, follows the one year commencement period. Therefore, businesses should distinguish between the concept and regulatory framework for Consent Managers and the later commencement of the provisions allowing Data Principals to use such services.

Is a Business Required to Use a Consent Manager?

No.

An ordinary Data Fiduciary does not become a statutory Consent Manager merely because it collects consent. The DPDP framework gives Data Principals the option to use a registered Consent Manager. A business can continue to collect and manage consent through its own compliant processes. The important requirement is to ensure the consent process itself satisfies the applicable legal standards.This distinction prevents a common misconception. Buying a consent management tool does not automatically make an organisation compliant, and operating an internal consent database does not make the organisation a statutory Consent Manager.

Consent Management and Children’s Data

Children's data requires additional safeguards. The DPDP Act defines a child as an individual who has not completed eighteen years of age. Section 9 requires verifiable parental or guardian consent before processing a child's personal data, subject to the statutory framework. It also restricts processing likely to cause a detrimental effect on a child's well being and addresses tracking, behavioural monitoring and targeted advertising directed at children, subject to specified exemptions. The Rules provide further requirements concerning verification of parental or guardian consent. Businesses serving children should therefore consider age assurance, guardian verification and consent records as part of their product architecture rather than adding them after launch.

Consent Management and Data Processors

Consent decisions must follow the data. If a Data Fiduciary appoints a Data Processor, the processor may handle personal data on behalf of the fiduciary. The Data Fiduciary must therefore ensure its contractual and technical arrangements allow consent related decisions to be implemented where required. For example, if a customer withdraws consent and the relevant processing must stop, the business should have a mechanism for communicating the change to the processor. Vendor contracts should address privacy responsibilities, security, incident reporting, deletion, subcontracting and assistance with Data Principal requests. This is especially important where the business uses numerous SaaS platforms.

Consent and Marketing Communications

Marketing consent should be handled carefully. Businesses often combine service communications with promotional communications. These activities may have different purposes and may be governed by different legal requirements. A customer may need transactional messages to receive a service while separately choosing whether to receive promotional email or SMS communications. Businesses should therefore avoid assuming one general customer acceptance covers every communication channel. The organisation should also consider applicable telecom and sector specific requirements governing commercial communications.

Consent and Artificial Intelligence

The growing use of artificial intelligence creates new consent questions. A business may collect customer conversations for support purposes and later want to use those records to train or improve an AI system. The organisation should assess whether the proposed use falls within the original purpose, whether another lawful basis applies and whether the customer was adequately informed. The same principle applies to profiling, behavioural analytics and personalisation. A consent record should not be treated as a permanent licence to use personal data for every future purpose.

Consent Management and International Privacy Laws

Indian businesses may also be subject to foreign privacy requirements. An organisation offering services to individuals in the European Economic Area, for example, may need to consider the GDPR. Other jurisdictions have their own rules governing consent, marketing, cookies and individual rights. A single consent architecture can support multiple legal regimes, but the underlying legal analysis must remain jurisdiction specific. Businesses should identify where customers are located, which data is processed, which systems receive it and which laws apply.

Consent Management and Information Security

Consent records themselves contain valuable information. A business should protect consent databases against unauthorised alteration, deletion and access. If an attacker can modify consent records, the organisation may lose the ability to demonstrate a customer's actual decision. Access controls, authentication, logging, backups and appropriate security measures should therefore apply to consent systems. The DPDP Act requires Data Fiduciaries to implement reasonable security safeguards to prevent personal data breaches. Businesses should also consider CERT In requirements. Its Cyber Security Directions require specified cyber incidents, including data breaches and data leaks, to be reported within six hours of noticing them.

Building a Practical Consent Management Framework

An effective programme should begin with a data and processing inventory. The organisation should identify each processing purpose for which consent may be required. It should then map the relevant notice, consent interface, data systems, processors and downstream recipients. The next step is to establish how consent is captured and recorded. The organisation should preserve sufficient evidence to demonstrate the decision. Withdrawal should then be tested across the technology environment. A business should verify whether the change reaches CRM systems, marketing platforms, analytics tools and relevant processors. Regular testing is important. A consent mechanism can become ineffective when a new vendor, tracking tool or product feature is introduced. Organisations requiring assistance with designing and implementing these processes may consider data protection compliance services as part of their broader privacy governance framework.

Common Consent Management Mistakes

One common mistake is treating consent as a single checkbox. Another is using vague purposes. A user should be able to understand what the consent actually permits. Businesses also sometimes make withdrawal difficult. A customer may be able to accept a permission in one click but need to contact customer support to withdraw it. This conflicts with the statutory principle requiring withdrawal to be as easy as giving consent. Other risks include missing consent records, outdated privacy notices, inconsistent records across systems and failure to communicate withdrawals to processors. A technically sophisticated platform cannot solve these issues if the underlying governance is weak.

Why Consent Management Matters for Business Governance?

Consent management sits at the intersection of privacy, technology, marketing, cybersecurity and corporate governance. A well designed system can help a business demonstrate accountability, respond to individual requests and maintain consistent data practices. It can also reduce operational confusion. Employees should not have to determine manually whether a customer has consented each time personal data is used. As organisations grow, business compliance legal services can help integrate privacy processes with contracts, vendor management, regulatory obligations and wider corporate governance.

Conclusion

Consent management under India's data protection framework is becoming an important operational discipline for businesses. It is no longer sufficient to collect an affirmative response and store a simple “yes” in a database. Businesses need to understand the purpose for which consent is sought, provide meaningful information, capture valid consent, preserve evidence, make withdrawal easy and ensure changes are reflected across relevant systems and processors.

The DPDP Act also introduces a distinct statutory concept of the Consent Manager. This should not be confused with ordinary consent management software. The 2025 Rules establish the framework for registration and operation of Consent Managers, with the relevant provisions coming into force in phases. Organisations should therefore use the transition period to review their consent journeys, privacy notices, customer databases, vendor contracts and technical controls. The objective should be a consent process which is legally defensible, technically enforceable and understandable to the individual.

Frequently Asked Questions (FAQs)

Q1. What is consent management under the DPDP Act?

Consent management refers to the processes used to obtain, record, manage and honour an individual's consent for processing personal data. It includes consent capture, evidence, withdrawal and implementation across relevant systems.

Q2. What are the requirements for valid consent in India?

Under Section 6 of the DPDP Act, consent must be free, specific, informed, unconditional and unambiguous, involve clear affirmative action and be limited to personal data necessary for the specified purpose.

Q3. Can consent be withdrawn under the DPDP Act?

Yes. A Data Principal may withdraw consent at any time. The withdrawal process must be as easy as the process used to give consent.

Q4. Is a Consent Management Platform mandatory in India?

No. The DPDP Act does not require every Data Fiduciary to use a particular consent management platform. Businesses must instead establish processes capable of meeting their applicable legal obligations.

Q5. Is a Consent Manager the same as a Consent Management Platform?

No. A statutory Consent Manager is a person registered with the Data Protection Board and provides an interoperable service through which Data Principals can manage consent. A Consent Management Platform is generally software used by an organisation to manage its own consent processes.

Q6. When will Consent Managers be registered in India?

The registration framework under Section 6(9) and Rule 4 is subject to the one year commencement period from 13 November 2025. The relevant milestone is 13 November 2026.

Q7. Does every business need to use a registered Consent Manager?

No. Businesses can manage consent directly. The statutory Consent Manager is an optional mechanism available to Data Principals under the DPDP framework.

Q8. Does consent apply to every type of personal data processing?

No. The DPDP Act recognises consent as one ground for processing and separately provides for certain legitimate uses. Businesses should identify the appropriate legal basis for each processing activity.

Q9. How should businesses prove consent?

Businesses should maintain reliable records showing the relevant consent decision, purpose, timing, notice version and other appropriate contextual information. The DPDP Act places the burden of proving valid consent on the Data Fiduciary where consent is relied upon.

Q10. What happens after a user withdraws consent?

Where consent is the applicable basis, the Data Fiduciary must stop processing based on the withdrawn consent and cause its Data Processors to stop, unless continued processing is otherwise authorised or required by law.

Q11. Do consent requirements apply to children's data?

Yes, with additional safeguards. The DPDP Act requires verifiable parental or guardian consent for processing a child's personal data, subject to the applicable statutory provisions and exemptions.

This update was released on 14 Sep 2026.

The views expressed in this update are personal and should not be construed as any legal advice. Please contact us directly on +91 22 40565252 or contact@mhcolaw.com for any assistance.

Legal Update Team
MANSUKHLAL HIRALAL & COMPANY
Advocates, Solicitors and Notaries
T: +91 22 40565252
Mumbai Office: Surya Mahal, 2nd Floor, 5, Burjorji Bharucha Marg, Fort, Mumbai-400 023, India
Delhi Office: Block C-9, Lower Ground Floor, Jangpura Extension, New Delhi - 110 014, India
www.mhcolaw.com

"Noted lawyer in the Real Estate practitioner from India" - Chambers & Partners

Please consider the environment before printing this email

The information contained in this communication is intended solely for the use of the individual or entity to whom it is addressed and others authorized to receive it. This communication may contain confidential or legally privileged information. If you are not the intended recipient, any disclosure, copying, distribution or action taken relying on the contents is prohibited and may be unlawful. If you have received this communication in error, or if you or your employer does not consent to email messages of this kind, please notify the sender immediately by responding to this email and then delete it from your system. No liability is accepted for any harm that may be caused to your systems or data by this message.