Under the DPDP Act 2023 and the DPDP Rules, 2025, consent has to be requested, recorded, reviewed, withdrawn and proved. A consent management platform (CMP) can do much of that work, but installing one does not make a business compliant. Notices, contracts, security and governance matter just as much.
CMP versus Consent Manager
A CMP is a product that shows notices, captures affirmative consent, links it to purposes, keeps records, handles withdrawal and shares changes with connected systems. A Consent Manager under the Act is narrower: an entity registered with the Board that offers an accessible, transparent and interoperable platform. Not every tool sold as a CMP is a registered Consent Manager.
Why it matters
Section 6 requires consent to be free, specific, informed, unconditional, unambiguous and limited to necessary data, and withdrawal should be as easy as giving it. Picture a company with 500,000 visitors, 50,000 registered users, several apps and many marketing tools. It must be able to say who consented, to what, when, under which notice, and whether downstream systems stopped after a withdrawal. That is the job of the seven requirements below.
The seven requirements
1. Purpose-based consent collection
A generic "I agree to the Terms and Privacy Policy" is not specific enough. The platform should let you define purposes, such as account creation, marketing email, promotional SMS and personalised recommendations, and ask for each separately. It should capture an affirmative action and record the notice version, date, time, channel and the person it belongs to. Avoid one checkbox that bundles email, SMS, WhatsApp and advertising.
2. Standalone notice management
Notices must be clear, in simple language, and describe the data, the purpose, the person's rights and how to complain. The platform should keep every notice version. If the notice changed in January but someone consented in December, you must still be able to show exactly what they saw.
3. Easy withdrawal and preference management
A preference centre should show active and withdrawn consents, explain each purpose and let people change their choices. Withdrawal must then travel downstream: the CMP updates the status, the CRM receives it, the email platform suppresses the user, and SMS and WhatsApp systems follow.
4. Immutable records and audit trails
Where consent is the basis for processing and it is disputed, the Data Fiduciary must prove notice and consent under Section 6. Each record should hold the person's ID, status, purpose, data category, timestamps, source, notice and consent versions, the affirmative action, any withdrawal, and the full history. For example: customer 54892, promotional email, notice v2.1, accepted on 15 August 2026 through website registration, withdrawn on 22 August 2026.
5. Interoperability and APIs
A CMP is only useful if its status reaches every other system, from website to CRM, email, analytics, support and advertising. Look for REST APIs, webhooks, web and mobile SDKs, CRM and marketing integrations, real-time synchronisation and machine-readable records. The Act describes a Consent Manager's platform as interoperable, and the Rules require independent certification against standards the Board publishes.
6. Security and access controls
The Rules require reasonable security safeguards against personal data breaches. For a CMP that means encryption in transit and at rest, role-based access, multi-factor authentication for administrators, API authentication, audit logging, backups and monitoring. HTTPS alone is not enough.
7. Transparency, independence and governance
The Rules set conditions for registered Consent Managers: Indian incorporation, adequate technical, operational and financial capacity, a minimum net worth of ₹2 crore, sound management and independent certification. They must keep consent records, give people access to them, act as a fiduciary toward the Data Principal, avoid conflicts of interest and publish ownership details. When choosing a vendor, ask about record export, withdrawal propagation, notice versioning, audit logs, registration status and how they will adapt to future rules.
Banner or platform?
A cookie banner mainly handles cookie and tracking choices. A DPDP-focused CMP also covers registration forms, marketing, apps, CRM, data sharing, withdrawal and audit trails. In the article's words, a cookie banner is not automatically a DPDP Consent Manager.
Mistakes to avoid
- Treating a checkbox as full consent management
- Making withdrawal harder than consent
- Not storing notice versions
- Keeping consent isolated from other systems
- Collecting more data than the purpose needs
- Assuming software alone equals compliance
The takeaway
The real test is not whether you have a banner, but whether you can show how consent was obtained, what it covered, and what happened when it changed.
Add comment