If you have written "our vendor is a Consent Manager" into a compliance assessment on the strength of a website claim, you may have imported an error into your own file. That is the practical reason this distinction matters.
What is a Consent Manager under the DPDP Act?
A defined role: a person registered with the Board who enables a Data Principal to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform. A Data Principal may give consent through a Consent Manager, which acts as a single point of contact and is accountable to the Data Principal.
That last phrase is the structural difference. A Consent Manager's duty runs to the individual, not to the business paying it.
Registration is substantive. The First Schedule to the Rules sets conditions including that the applicant is a company incorporated in India; has a net worth of not less than two crore rupees; has sound financial condition and general character of management; has directors and key managerial personnel of good reputation and record; has constitutional documents binding it to specified obligations, amendable only with the Board's prior approval; and is independently certified that its interoperable platform is consistent with the data protection standards and assurance framework published by the Board.
Rule 4 commences 13 November 2026. Until then, no entity in India is a registered Consent Manager, because the mechanism to register does not exist.
What is a consent management platform?
Software a Data Fiduciary licenses and deploys to run its own consent operations — notice delivery, capture, storage, withdrawal, enforcement and audit. It sits inside your compliance perimeter. You remain the Data Fiduciary and you remain accountable.
Side by side
| Consent Manager | Consent management platform | |
|---|---|---|
| Status | Registered with the Board | Commercial software |
| Registration required | Yes — opens 13 Nov 2026 | Not applicable |
| Net worth condition | ₹2 crore minimum | Not applicable |
| Interoperability certification | Required | Not applicable |
| Accountable to | The Data Principal | Its customer, under contract |
| Who remains Data Fiduciary | You do | You do |
| Available today | No | Yes |
Note what does not change in either column: you remain the Data Fiduciary. Neither arrangement transfers your accountability under section 8(1), which applies notwithstanding any agreement to the contrary.
Why vendors blur it
Mostly, we think, without intent to mislead. "Consent manager" is a natural English description of software that manages consent, and it was in common use before the Act gave the term a specific legal meaning. Some vendors also refer to "integration with future government-registered Consent Managers," which is accurate and forward-looking.
The problem arises where marketing implies present registered status. For the buyer, if your DPDP assessment records that consent is managed through a registered Consent Manager, and it isn't, your documentation is wrong — and it is your file the Board would look at. For the vendor, a claim of registered status that cannot be evidenced is the kind of thing a prospect's counsel checks in minutes.
Where Consiva sits, plainly
Consiva is a consent management platform. It is software licensed to Data Fiduciaries. Swaran Soft Support Solutions Private Limited, which operates Consiva, is not a registered Consent Manager and does not represent itself as one — registration is not open, and we do not currently meet the First Schedule net worth condition.
We state that directly because it is true, and because a vendor's unverifiable claim becomes the buyer's problem. You remain the Data Fiduciary for your data principals' personal data. We act as a Data Processor for the data you process through the platform. And yes, we sign a Data Processing Agreement. → See what that agreement needs to say
Eight questions for any vendor in this category
Are you a registered Consent Manager or a CMP? Do you meet the First Schedule net worth condition? Who remains the Data Fiduciary? Will you sign a DPA? Question one is the fastest way to find out how carefully a vendor reads the law they are selling against.
Start Free on Consiva.ai — No Credit Card →Will you need a registered Consent Manager?
Possibly, depending on how the ecosystem develops after November 2026. The Act creates the role as a route for individuals to manage consent across multiple Data Fiduciaries from one place — an account-aggregator-style model for consent.
If it takes hold, Consent Managers and consent management platforms are complementary rather than competing: the Consent Manager is the individual's interface, the platform is the business's infrastructure, and the two exchange consent artefacts. A registered Consent Manager does not remove your need for notice, records, withdrawal handling and rights fulfilment inside your own systems.
What we would avoid is designing a 2027 compliance architecture that assumes a mature Consent Manager ecosystem exists. As at today, none does.
Frequently Asked Questions
A person registered with the Data Protection Board who enables a Data Principal to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform, and who is accountable to the Data Principal.
No. A CMP is software licensed to a Data Fiduciary and sits inside its compliance perimeter. A Consent Manager is a registered entity accountable to the individual. Only one requires registration and a ₹2 crore net worth.
Rule 4 of the DPDP Rules, 2025 commences on 13 November 2026. Before that date no entity in India is a registered Consent Manager.
No. You remain the Data Fiduciary. Section 8(1) makes you responsible for compliance notwithstanding any agreement to the contrary, and you still need notice, records, withdrawal handling and rights fulfilment in your own systems.
No. Consiva is a consent management platform. Registration is not open, and Swaran Soft does not meet the First Schedule net worth condition. We say so rather than let a buyer record something incorrect.
Get Your Consent Infrastructure Right — Free
One domain, 1,000 cookie consents and 50 form consents a month, no credit card, unmetered rights requests.