How to Implement a Consent Management Platform Under the DPDP Act 2023 in India

India's Digital Personal Data Protection Act, 2023 (DPDP Act) has introduced a regulated intermediary known as the Consent Manager, an entity that acts on behalf of individuals (called Data Principals) to manage, review, and withdraw consent given to organisations that process personal data. With the DPDP Rules, 2025 now providing the detailed operational framework, businesses seeking to operate as Consent Managers or integrate consent management into their operations face a concrete set of obligations. This guide walks you through every step of implementing a compliant Consent Management Platform (CMP), from eligibility assessment to technical deployment.

Understanding the Consent Framework Under the DPDP Act

Under the DPDP Act, consent is the primary lawful basis for processing personal data. Section 6 of the Act mandates that consent must be free, specific, informed, unconditional, and unambiguous, accompanied by a clear affirmative action. This means blanket consent clauses, pre-ticked checkboxes, and bundled permissions are no longer acceptable. Every consent request must clearly describe the purpose and scope of data processing in plain language.

The Consent Manager concept under Section 9 of the Act is a uniquely Indian innovation. Unlike the EU's GDPR, which does not prescribe a dedicated consent intermediary, the DPDP Act creates a registered class of entities that serve as a single point of contact between Data Principals and Data Fiduciaries (organisations that determine the purpose and means of data processing). The DPDP Rules, 2025, published by the Ministry of Electronics and Information Technology (MeitY), elaborate on registration requirements, technical standards, and operational obligations for these entities.

Step 1: Assess Eligibility Requirements

Before investing in platform development, confirm that your organisation meets the eligibility criteria prescribed under the DPDP Rules, 2025. The requirements are as follows:

• Incorporation in India: The entity must be a company incorporated under Indian law. Foreign entities without an Indian subsidiary are not eligible to register as a Consent Manager.

• Minimum net worth of INR 2 crore: This threshold (approximately USD 240,000) will be adjusted annually for inflation. The requirement ensures that only financially stable entities handle sensitive consent operations at scale.

• Technical, operational, and financial capacity: The applicant must demonstrate that it possesses the infrastructure, personnel, and financial resources to manage consent at scale across multiple Data Fiduciaries.

• No conflict of interest: The Consent Manager must act solely in the interest of the Data Principal and cannot simultaneously act as a Data Fiduciary for the same transaction.

Step 2: Register with the Data Protection Board of India

Registration with the Data Protection Board of India (DPBI) is mandatory. No entity may operate as a Consent Manager without obtaining registration. The key details are:

• Registration deadline: Entities must complete registration by November 13, 2026. Operating without registration after this date will attract penalties under the Act.

• Application requirements: Submit an application to the DPBI demonstrating compliance with all eligibility criteria. Include audited financial statements, a detailed technical architecture document, an operational plan, and evidence of data security capabilities.

• Conditions of registration: The Board may impose conditions on registration, including periodic compliance audits and reporting obligations. Registration is not permanent; the Board retains the power to suspend or cancel registration for non-compliance.

Step 3: Build the Technical Infrastructure

The technical requirements for a Consent Management Platform under the DPDP framework are rigorous. MeitY released a Business Requirement Document (BRD) in June 2025 that provides detailed technical and functional guidance. Your platform must address the following areas:

Server and Hosting Requirements

• All servers must be located within India. Data localisation is a baseline requirement under the DPDP Act for Consent Managers.

• Deploy secure, redundant infrastructure with failover capabilities to ensure continuous availability of consent services.

• Implement encryption at rest and in transit. AES-256 encryption is the minimum standard for data at rest, and TLS 1.2 or higher is required for data in transit.

Data Access Restrictions

A critical rule under the DPDP framework is that the Consent Manager must never access the underlying personal data of the Data Principal. The platform handles consent metadata (who consented, to what, when, and for how long) but must not store, process, or view the actual personal data that flows between the Data Principal and the Data Fiduciary. This separation is fundamental to the architecture and must be enforced through technical controls such as API gateway design, access control lists, and data segregation at the storage layer.

Audit Logging

Every consent action must be logged in an immutable, audit-ready format. This includes consent grants, modifications, renewals, and withdrawals. Logs should capture timestamps, the identity of the Data Fiduciary, the purpose of processing, and the Data Principal's action. These logs serve as evidence during regulatory audits and dispute resolution proceedings before the DPBI.

Step 4: Design the Consent Lifecycle Workflow

Consent under the DPDP Act is not a one-time event. It has a full lifecycle that your platform must support end to end. The following stages must be built into your CMP:

• Collection: Present a clear, itemised consent notice to the Data Principal. The notice must describe each purpose of processing separately, identify the Data Fiduciary, and provide a mechanism for granular acceptance or rejection. Consent must be obtained through a clear affirmative action; silence or inactivity does not constitute consent.

• Validation: Verify that each consent record meets the statutory requirements (free, specific, informed, unconditional, unambiguous). Implement automated validation checks that flag incomplete or non-compliant consent records before they are stored.

• Modification: Allow Data Principals to modify the scope of their consent at any time. For example, a user who initially consented to data processing for marketing and analytics should be able to revoke consent for marketing while retaining it for analytics.

• Renewal: Consent is not perpetual. Build mechanisms for periodic renewal based on the purpose and sensitivity of the data being processed. Notify Data Principals before consent expires and provide a streamlined process for renewal or discontinuation.

• Withdrawal: The DPDP Act mandates that withdrawing consent must be as easy as giving it. Your platform must provide a clear, accessible mechanism for withdrawal. Upon withdrawal, the platform must notify all affected Data Fiduciaries in real time so they can cease processing and, where applicable, initiate data erasure.

Step 5: Implement Interoperability Standards

One of the defining features of the Consent Manager model under the DPDP Act is interoperability. The platform must work across multiple Data Fiduciaries, enabling a Data Principal to manage all their consents from a single interface. This requires:

• Standardised APIs: Develop RESTful APIs that conform to MeitY's technical specifications. These APIs must support consent request, grant, modification, and withdrawal operations in a standardised format that any Data Fiduciary can integrate with.

• Single point of contact: The CMP must function as a unified dashboard for Data Principals. A user should be able to view all active consents, see which organisations hold their data, and take action (modify or withdraw) from one interface.

• Cross-platform compatibility: Ensure the platform is accessible via web and mobile interfaces, with responsive design and accessibility features compliant with Indian accessibility standards.

Step 6: Establish Record Retention and Audit Protocols

The DPDP Rules prescribe stringent record retention obligations for Consent Managers:

• Seven-year retention: All consent records, consent notices, and logs of data sharing activities must be retained for a minimum of seven years. This includes records of withdrawn or expired consents.

• Immutable storage: Use write-once, read-many (WORM) storage or equivalent immutable logging solutions to prevent tampering with consent records.

• Audit readiness: Structure your logs and records so they can be produced promptly in response to DPBI inquiries, Data Principal requests, or judicial proceedings. Consider implementing automated report generation that compiles consent histories by Data Principal, Data Fiduciary, or time period.

Step 7: Integrate with Existing Business Systems

For Data Fiduciaries that are integrating with a Consent Manager (rather than operating as one), the implementation involves connecting your existing data processing systems to the CMP. Key integration points include:

• CRM and marketing systems: Connect your customer relationship management and marketing automation platforms to the CMP so that consent status is checked in real time before any data processing occurs.

• Data warehouses and analytics: Implement consent-aware data pipelines that check the consent status of each Data Principal before including their data in analytics, profiling, or reporting workflows.

• Third-party data processors: Ensure that downstream processors receive consent status updates through webhooks or API polling, so that a withdrawal of consent cascades through the entire data processing chain.

• Grievance redressal mechanisms: Link the CMP to your internal grievance redressal system so that consent-related complaints from Data Principals are tracked, escalated, and resolved within the timelines prescribed by the Rules.

The MeitY Business Requirement Document: A Key Reference

In June 2025, MeitY released a Business Requirement Document (BRD) specifically for Consent Managers. This document provides detailed functional and technical specifications, including API schemas, data flow diagrams, user interface guidelines, and security benchmarks. While the BRD is not a statutory instrument, it represents MeitY's expectations for how Consent Managers should operate and is likely to be used as a benchmark during DPBI assessments. Organisations building CMPs should treat this document as essential reading and align their technical architecture with its specifications.

Penalties for Non-Compliance

The penalty framework under the DPDP Act is substantial and should be taken seriously by every organisation involved in consent management:

• Financial penalties: The DPBI can impose penalties of up to Rs 50 crore (approximately USD 6 million) per instance of non-compliance. This applies to failures in obtaining valid consent, breaches of data processing obligations, and violations of Consent Manager registration requirements.

• Suspension or cancellation of registration: Beyond financial penalties, the DPBI has the authority to suspend or cancel a Consent Manager's registration. This effectively shuts down the entity's operations in the consent management space, with significant reputational and commercial consequences.

• Per-instance calculation: Penalties are calculated per instance of violation, meaning that systemic non-compliance affecting thousands of Data Principals could result in cumulative penalties far exceeding the per-instance cap.

Implementation Timeline and Practical Recommendations

With the November 13, 2026 registration deadline approaching, organisations should plan their implementation carefully. Here is a recommended phased approach:

• Phase 1 (Months 1 to 2): Conduct a gap analysis against DPDP Act requirements and the MeitY BRD. Assess your current data processing landscape, identify all consent touchpoints, and map existing consent mechanisms.

• Phase 2 (Months 3 to 5): Design and develop the technical platform, including API development, consent lifecycle workflows, encryption infrastructure, and audit logging systems.

• Phase 3 (Months 6 to 7): Conduct internal testing, penetration testing, and compliance audits. Run pilot integrations with select Data Fiduciaries to validate interoperability.

• Phase 4 (Month 8 onwards): Submit registration application to the DPBI, deploy the platform, and begin onboarding Data Fiduciaries and Data Principals.

Key Takeaways

Implementing a Consent Management Platform under the DPDP Act is a significant undertaking that spans legal compliance, technical development, and operational planning. The regulatory framework is clear in its expectations: consent must be granular, verifiable, and easy to withdraw; Consent Managers must be registered, financially stable, and technically capable; and all consent records must be retained for seven years in an audit-ready format.

Organisations that begin their implementation now will have sufficient time to build, test, and register before the November 2026 deadline. Those that delay risk not only regulatory penalties but also exclusion from an emerging consent ecosystem that is poised to become central to India's digital economy.

For legal guidance on DPDP Act compliance, consent management implementation, or Data Protection Board registration, consult with a qualified data privacy professional or legal advisor who specialises in Indian data protection law.