PRIMELEGAL | Consent is Not Final: Consent Managers and the Right to Withdraw under the Digital Personal Data Protection Act, 2023

 

ABSTRACT

The Digital Personal Data Protection Act, 2023 (DPDP Act) makes consent revocable and allows a Data Principal to give, manage, review or withdraw it through a registered Consent Manager. Under the Digital Personal Data Protection Rules, 2025 (DPDP Rules), registration of Consent Managers opens on November 13, 2026, whereas the duties of Data Fiduciaries on withdrawal apply only from May 13, 2027. This article examined what the Act and the First Schedule to the DPDP Rules provide on withdrawal and what they leave open on timing, responsibility and enforcement. It argues that Consent Managers will begin operating six months before the duty they serve can be enforced, and while the Data Protection Board on the available public record still has no appointed Chairperson or Members. Clear timelines and a clear allocation of responsibility are needed before the framework is relied upon.

INTRODUCTION

On November 13, 2025, the Ministry of Electronics and Information Technology (MeitY) notified the DPDP Rules, which bring the DPDP Act into force in phases over eighteen months.1 The Data Protection Board of India (Board) was established at once. Registration of Consent Managers follows after one year, on November 13, 2026 and the remaining duties of Data Fiduciaries apply from May 13, 2027. The Act defines a Consent Manager as a person registered with the Board who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform.2

The policy case is easy to see. Consent that is easy to give but hard to take back is not a real choice, and a single platform for many consents promises to make withdrawal practical. But a withdrawal made through a Consent Manager involves three parties, namely the individual, the Consent Manager and the Data Fiduciary, and the law gives each a different duty. This article asks three questions: 

1. What must a Data Fiduciary actually do once consent is withdrawn?
2. When consent is withdrawn through a Consent Manager, who is responsible for making the withdrawal effective?
3. Can the framework work when Consent Managers are registered before the withdrawal duty is enforceable?

THE RIGHT TO WITHDRAW AND THE CONSENT MANAGER

Section 6(4) of the DPDP Act gives the Data Principal the right to withdraw consent at any time, with the ease of doing so being comparable to the ease with which consent was given. The consequences of withdrawal are borne by the Data Principal, and processing done before withdrawal remains lawful.3 Sections 6(7) to 6(9) then add the Consent Manager. A Data Principal may give, manage, review or withdraw consent through one, the Consent Manager is accountable to her and acts on her behalf as prescribed, and every Consent Manager must be registered with the Board.4

The detail is in Rule 4 and the First Schedule to the DPDP Rules. An applicant must be a company incorporated in India with a net worth of at least ₹2 crore and an independently certified platform. Once registered, it must act in a fiduciary capacity towards the Data Principal, avoid conflicts of interest with Data Fiduciaries and ensure that it cannot read the personal data shared through its platform. Additionally, they must keep a record of consents given, denied or withdrawn for at least seven years. The model is not new. Under the Reserve Bank of India’s Account Aggregator framework, a customer can already revoke consent given through a consent artefact.5 Sahamati, which represents the Account Aggregator ecosystem, has therefore asked that Account Aggregators be registered as Consent Managers for financial data.6

WHAT WITHDRAWAL REQUIRES OF THE DATA FIDUCIARY

The duty on withdrawal falls on the Data Fiduciary, not the Consent Manager. Under section 6(6), the Data Fiduciary must, within a reasonable time, cease and cause its Data Processors to cease processing the personal data, unless processing without consent is required or authorised by law. Section 8(7) adds that, unless retention is necessary for compliance with law, it must erase the data upon withdrawal. The Act’s own illustration of a bank that must retain identity records for ten years shows how far this exception can reach.7 If consent is questioned in a proceeding, the burden lies on the Data Fiduciary to prove that notice was given and that consent was given in accordance with the Act and the Rules.8

Two gaps stand out. First, “reasonable time” is not defined, and neither the Act nor the First Schedule fixes the period within which a withdrawal must take effect. A withdrawal made on a platform in seconds may therefore be honoured only after an open-ended delay. Second, neither section 6(6) nor section 8(7) obliges the Data Fiduciary to tell the Data Principal which processing continues after withdrawal and on what legal basis. The individual may believe that everything has stopped when it has not.

WHO ANSWERS WHEN WITHDRAWAL FAILS?

The First Schedule makes the Consent Manager a recorder and a conduit, not the party that stops the processing. It must keep a record of consents withdrawn, give the Data Principal access to it and, on request, supply it in machine-readable form.9 That record is useful evidence of when the Data Principal withdrew. However, item 1 of Part B describes only how consent is given, directly or routed through another Data Fiduciary. It is silent on how a withdrawal travels, how quickly it must reach the Data Fiduciary, and what the Consent Manager must do if the Data Fiduciary does not act. Since section 6(8) says the Consent Manager acts on the Data Principal’s behalf, the Act leaves open whether the Data Fiduciary’s duty starts when the Data Principal withdraws or only when the message reaches it.

Remedies are also split. Section 13 gives the Data Principal readily available means of grievance redressal against both Data Fiduciaries and Consent Managers, and she must exhaust it before approaching the Board.10 A failure to cease processing, or a breach of the First Schedule, does not appear in a specific entry of the Schedule to the Act and would attract the general penalty of up to ₹50 crore.11

A FRAMEWORK AHEAD OF ITS ENFORCER

The timing sharpens these gaps. Section 6(9) and Rule 4 commence on November 13, 2026, but the rest of section 6, including the right to withdraw and the cease-processing duty, applies from May 13, 2027.12 For six months, Consent Managers may be registered and onboarding Data Fiduciaries while a withdrawal lodged through them does not yet carry the consequences of section 6(6).

The enforcer is also missing. The Board exists in law, but the Government told the Lok Sabha on August 12, 2026 that its chairperson and four Members were still to be appointed, the recruitment advertisement having been published only on June 6, 2026. No appointment appears on the public record at the time of writing. Applications for registration are made to the Board, the audits of Consent Managers are reported to it, and complaints about failed withdrawals are ultimately decided by it. Each of these depends on a body that has no members.

WAY FORWARD

A statute can state a right, but the Rules must make it work in practice. As Consent Managers prepare to enter the market, three steps might be helpful:

1. The Rules should fix a maximum period for a withdrawal to reach the Data Fiduciary through a Consent Manager and for the Data Fiduciary to act on it, and should require the Data Fiduciary to tell the Data Principal which processing continues under law.
2. The First Schedule should state who bears responsibility when a withdrawal is lodged but not given effect, so that delay in transmission rests with the Consent Manager and failure to cease rests with the Data Fiduciary, wherein the Consent Manager’s record serves as the evidence.
3. The Government should appoint the Board’s Chairperson and Members without delay, and MeitY, the Board and the RBI should coordinate so that Account Aggregators registered as Consent Managers do not face inconsistent regimes on withdrawal and appeals.

CONCLUSION

Consent Managers are meant to make the right to withdraw practical. The Act gives the right and the Rules give the Consent Manager its duties, but they do not yet say how fast a withdrawal must travel, who answers if it does not, or which body will decide. Registration opening before the withdrawal duty and the Board are in place makes these questions urgent. If consent is truly not final, the framework must move from principle to enforceable timelines and clear responsibility.

 

“PRIME LEGAL is a National Award-winning law firm with over two decades of experience across diverse legal sectors. We are dedicated to setting the standard for legal excellence in civil, criminal, and family law.”

WRITTEN BY: T. R. AISIRI RAO

 

1. Ministry of Electronics and Information Technology, Digital Personal Data Protection Rules, 2025, G.S.R. 846(E) (Nov. 13, 2025), https://egazette.gov.in/WriteReadData/2025/267650.pdf
2.  Digital Personal Data Protection Act, 2023, § 2(g), No. 22 of 2023 (India). 
3. Id. § 6(4)-(5).
4. Id. § 6(7)-(9).
5.  Reserve Bank of India, Non-Banking Financial Company – Account Aggregator (Reserve Bank) Directions, 2016 (Sept. 2, 2016), https://www.rbi.org.in/Scripts/BS_ViewMasDirections.aspx?id=10598
6. Sahamati, Feedback on Draft DPDP Rules (Mar. 2025), https://sahamati.org.in/wp-content/uploads/2025/03/Sahamati-Feedback-on-Draft-DPDP-Rules.docx.pdf
7. Digital Personal Data Protection Act, 2023, § 6(6), § 8(7) and Illustration (II) to § 8(7).
8. Id. § 6(10).
9. Digital Personal Data Protection Rules, 2025, First Schedule, Part B, items 3 and 4.
10. Digital Personal Data Protection Act, 2023, § 13(1), (3).
11. Id. § 33(1) and the Schedule, item 7.
12. Lok Sabha, Unstarred Question No. 3960 (Aug. 12, 2026), https://sansad.in/getFile/lsapps/loksabhaquestions/annex/188/AU3960_GyWSTk.pdf (describing Phase 2 as registration and functioning of Consent Managers and Phase 3 as compliance obligations of Data Fiduciaries).