Almost every company
Needs a CMP or equivalent: clear notices, granular consent, easy withdrawal and consent logs.
India · DPDP · Consent
Consent manager vs CMP: two different things under DPDP.
The DPDP Act creates registered consent managers, a role no other privacy law has. A consent management platform (CMP) is software a company uses itself. Most companies need a CMP; few need to become a consent manager.
Consent managerA registered intermediary, accountable to the Data Principal.
CMPSoftware a Data Fiduciary uses to collect and log consent.
From November 2026Consent manager registration and duties apply.
Under India’s DPDP Act, a consent manager is a person registered with the Data Protection Board who gives individuals a single, interoperable platform to give, manage, review and withdraw consent across many companies, and who acts on behalf of the individual. A consent management platform (CMP) is software a company uses to collect, record and honour consent for its own processing. Consent manager rules apply from November 2026.
Side by side
| Consent manager | Consent management platform | |
|---|---|---|
| What it is | A registered intermediary under section 2(g) and section 6(7) of the Act | Software run by or for a company |
| Acts for | The Data Principal (the individual) | The Data Fiduciary (the company) |
| Registration | Must register with the Data Protection Board and meet the Rules’ conditions | No registration |
| Scope | Consent across many Data Fiduciaries in one place | Consent for one company’s own processing |
| From | November 2026 | Needed in practice by May 2027, when notice and consent duties apply |
Who needs which
Platforms that want to be the individual’s single consent dashboard
May apply to become a registered consent manager.
Companies whose users rely on a consent manager
Must accept and honour consent given or withdrawn through it.
Frequently asked questions
Do I need to register as a consent manager?
Only if you want to offer individuals a platform to manage consent across many companies. Companies collecting consent for their own processing need a CMP, not registration.
When do consent manager rules apply?
From November 2026, 12 months after the DPDP Rules were notified on 13 November 2025.
Can a CMP help with DPDP compliance?
Yes. A CMP produces notices, records consent and handles withdrawal, which supports the notice and consent duties that apply from May 2027.
More on the DPDP Act
DPDP Act complianceDPDP Act penaltiesDPDP Rules 2025 timelinePII data discoveryFree PII discovery tool
Not sure where consent is collected today?
Map your personal data first with the free tool, then design consent around it.