Compliance & labour law · Updated October 2026
A Consent Manager is a company registered with the Data Protection Board that gives individuals one platform to give, review, manage and withdraw consent across many organisations. It is defined in section 2(g) of the DPDP Act and is meant to act for the individual, not for the business collecting the data.
Most routine HR processing (payroll, PF and ESI filings, attendance, appraisals) is expected to run on the employment “legitimate use” ground in section 7(i), not on consent. So a Consent Manager will rarely sit in the middle of your payroll. It becomes relevant where you genuinely rely on consent, for example:
If an employee gives or withdraws such consent through a registered Consent Manager, section 6 lets them deal with you through that platform, and you will need to act on a withdrawal received that way. Check whether your HRMS or recruitment software vendor plans to integrate with registered platforms before you assume it will.
Rule 4 of the DPDP Rules, 2025, notified on 13 November 2025, comes into force one year after publication, so applications for registration open from 13 November 2026, along with sections 6(9) and 27(1)(d) of the Act. The First Schedule sets the bar for applicants:
| Condition | Requirement |
|---|---|
| Entity | Company incorporated in India |
| Net worth | Not less than Rs 2 crore |
| Platform | Independently certified as interoperable and meeting Board standards |
| Access to data | Must not be able to read the content of the personal data passing through it |
| Records | Consents given, denied or withdrawn kept for at least seven years |
| Control | No subcontracting of duties; change of control needs prior Board approval |
Registration opening is not the same as your own consent duties starting. Notice, consent and withdrawal obligations for employers are scheduled for 13 May 2027.
No. The Act allows consent to be given directly to the Data Fiduciary or through a Consent Manager; using one is a choice, and for employment data it will often be irrelevant.
Only if it meets the First Schedule conditions, and the conflict-of-interest rules make it awkward for a vendor that also processes the same data for employers; watch how vendors position this when you are reviewing your HRMS vendor.
To the Data Principal, meaning the employee or candidate, and it can be penalised by the Board for breaching its obligations.
Most HR data will rest on legitimate use rather than consent, so start with the employee data retention schedule and decide which records actually need consent at all.