DPDP Consent Management: What Every Data Fiduciary Must Know in 2026

DPDPA.5 min Read

How DPDP consent management works: consent capture, lifecycle, consent managers, and what data fiduciaries must implement before May 2027.

Consent is the cornerstone of India's Digital Personal Data Protection Act.

Unlike GDPR, which offers six legal bases for processing personal data, the DPDPA makes consent the primary legal basis for most data processing activities.

If you process personal data of Indian citizens, you need a consent management system, not as a nice-to-have, but as a regulatory mandate with ₹250 crore penalties behind it.

This guide covers what DPDP requires for consent, the difference between a Consent Management Platform (CMP) and a registered Consent Manager, the non-negotiable features, and how to implement consent management before the May 2027 enforcement deadline.

The DPDPA establishes a consent framework that is significantly more prescriptive than most global privacy laws.

Here are the key requirements:

Section 6(1): Free, Specific, Informed, Unconditional

Consent must be:

Free: Not coerced or bundled with service access
Specific: Tied to a defined purpose (no blanket consent)
Informed: Preceded by a clear privacy notice in the user's language
Unconditional: Not contingent on accepting unrelated terms
Unambiguous: Captured through an affirmative action (OTP, toggle, explicit opt-in)

This means you cannot bury consent in a Terms & Conditions page; each data processing purpose requires separate, explicit consent.

Section 5(1) & 5(3): Privacy Notices

Before collecting consent, you must present a privacy notice that clearly states:

What personal data is being collected
Why is it being collected (specific purpose)
How the data principal can exercise their rights

This notice must be available in all 22 languages listed in the Eighth Schedule of the Constitution: Hindi, Tamil, Telugu, Kannada, Bengali, Marathi, Gujarati, Malayalam, and 14 others.

This is one of the most consequential provisions. If your user gave consent with a single tap, they must be able to withdraw it with a single tap. Complex withdrawal processes are a violation.

Your system must provide:

A Privacy Centre or Preference Centre accessible to every data principal
One-click revocation per processing purpose
Immediate downstream effect when consent is withdrawn, processing must stop

Section 8(7) & 12(3): Right to Erasure

When consent is withdrawn, the data fiduciary must erase the data principal's personal data, not just stop processing it, but actually delete it across all systems, databases, and third-party processors.

This requires deep integration between your consent management system and your data infrastructure.

These two terms are often confused. They are fundamentally different:

Aspect	Consent Management Platform (CMP)	Consent Manager (DPDPA Entity)
What it is	Software tool that captures, stores, and manages consent	A registered entity that acts as intermediary between data principals and fiduciaries
Who operates it	The data fiduciary (your organisation)	A third-party registered with the Data Protection Board
Registration required	No — it's software you deploy	Yes — must be registered with DPB, min ₹2 crore net worth
When available	Available now	Registration opens November 13, 2026
Use case	Internal consent infrastructure for your apps/websites	Centralized consent hub where users manage consent across multiple fiduciaries
What you need today	Yes — deploy now	Not yet available for registration

Key insight: You need a Consent Management Platform now to be compliant. Consent Managers are a future ecosystem layer that won't be operational until late 2026.

Don't wait for Consent Managers, build your consent infrastructure today.

Each processing purpose must have its own consent capture. Your system must support independent opt-in/opt-out per purpose: "Account Opening", "Marketing", "Credit Assessment", "Third-Party Sharing" should each be separate toggles, not a single "Accept All" button.

22 Indian languages are mandated under Section 5(3). Your CMP must either auto-translate or allow manual translation of every privacy notice. The user should be able to switch language and read the full notice in their preferred language before consenting.

Every consent decision must generate a tamper-proof record: who consented, when, to what, which version of the notice they saw, their IP address, device fingerprint, and a cryptographic hash (SHA-256) that invalidates if the record is altered. This is your forensic evidence in case of a regulatory audit.

A Privacy Centre or Preference Centre where data principals can:

View all active consents
Revoke any consent with one click
Download their consent history
File a grievance

5. Webhook-Driven Downstream Enforcement

When consent is withdrawn, your CMP must notify all downstream systems in real-time. This means webhook/API integration with your CRM, marketing automation, analytics, data warehouse, and third-party processors. Consent revocation must trigger actual processing stops, not just a flag update in a database.

6. SDK for Seamless Integration

For web and mobile apps, the CMP should provide lightweight SDKs (React, Angular, iOS, Android) that your engineering team can embed with minimal code. The SDK handles consent capture UI, language selection, and API calls to the backend.

For websites, the CMP must detect and classify cookies (strictly necessary, analytics, marketing), present a compliant consent banner, and block non-essential cookies until consent is granted.

BFSI vs Fintech vs Enterprise: Different Needs

Requirement	Banks / NBFCs	Fintechs	Large Enterprises
Deployment	On-premise mandatory (RBI)	SaaS preferred (speed)	Hybrid (flexibility)
Data principals	10M-100M+	1M-10M	5M-50M
Integration	Core banking, CBS, existing IT stack	API-first, microservices	SAP, Salesforce, legacy systems
Languages	All 22 (national presence)	5-10 (regional focus)	Varies
Regulatory overlay	RBI + DPDPA dual compliance	RBI (for lending) + DPDPA	DPDPA primarily
Typical budget	₹30-80 lakh/year	₹15-30 lakh/year	₹25-50 lakh/year

Understanding the pricing model is critical because costs can vary 3-5x depending on the model:

Model	How It Works	Best For	Watch Out For
Per Data Principal / month	Fixed rate per unique user (e.g., ₹0.02-0.04/DP/month)	Organisations with predictable DP volumes	Costs scale linearly with growth
Per Consent Event	Charged per consent collect, check, or revocation	Low-volume use cases	Unpredictable costs at scale; overage charges can spike
Per Profile (digital property)	Charged per app/website/domain	Organisations with few properties	Banks with 16+ digital properties face very high costs
Flat Annual License	Fixed annual fee regardless of volume	Large enterprises who want predictability	May overpay if volume is small

Tip: Always calculate 3-year TCO, not just the Year-1 price. Factor in implementation fees, AMC (for on-premise), overage charges, and communication costs (SMS/WhatsApp/email for notifications).

Explore CoTrust: DPDPA Consent Management Platform by Digio

Frequently Asked Questions

Q: What is DPDP consent management?

A: DPDP consent management refers to the systems and processes organisations use to capture, store, manage, and enforce user consent as required by India's Digital Personal Data Protection Act, 2023.

It involves presenting clear privacy notices, obtaining purpose-specific consent, maintaining immutable records, enabling easy withdrawal, and ensuring consent decisions are enforced across all data processing systems.

This is mandatory for every entity processing personal data of Indian citizens.

Q: What is the difference between a consent management platform and a consent manager?

A: A Consent Management Platform (CMP) is software that organisations deploy to manage consent internally. It handles consent capture, storage, withdrawal, and audit.

A Consent Manager, as defined under the DPDPA, is a registered entity (with a minimum net worth of ₹2 crore) that acts as a neutral intermediary between data principals and multiple data fiduciaries.

Consent Manager registration opens November 13, 2026. Organisations need a CMP now; Consent Managers are a future ecosystem layer.

Q: Which consent management platforms work for Indian banks?

A: Indian banks require platforms that support on-premise or private cloud deployment (for data residency), field-level encryption, WORM audit logs, 22 Indian language support, and integration with core banking systems.

The platform must support both RBI compliance requirements and DPDPA obligations simultaneously.

Key evaluation criteria include deployment flexibility, security certifications, and proven banking deployments.

Q: How much does consent management cost in India?

A: Costs depend on the pricing model and deployment type.

SaaS platforms range from ₹15-40 lakh per year for typical enterprise volumes.

On-premise deployments for banks range from ₹28-80 lakh per year plus implementation fees.

Pricing models vary; some charge per data principal per month (₹0.02-0.04), others per consent event, and others per digital property. Always calculate 3-year TCO, including implementation, AMC, and overage charges, before comparing.

This content is for informational purposes and does not constitute legal advice. Consult qualified legal professionals for advice specific to your circumstances.