A Consent Manager is not something your company needs to register with

A DPDP vendor's onboarding page tells a founder to register with a Consent Manager before their consent flows count as valid. A comparison article calls a competitor's lack of Board registration a red flag. Both statements describe a business that does not exist yet, applying to a process that was never required in the first place.

What section 6(9) and Rule 4 actually build

Section 6(9) of the Act and Rule 4 of the DPDP Rules 2025, read with the First Schedule, do not tell a company how to collect consent. They license a new kind of business: an intermediary a person can use to give, manage, review, and withdraw her consent across multiple companies from one place. Think of it as closer to a UPI handle for consent than to a compliance checkbox. Rule 4(1) is explicit about who it addresses.

That sentence is written for the applicant, the entity that wants to operate as a Consent Manager. It is not written for the ordinary company collecting sign-up emails or processing payroll data. Nothing in Rule 4, and nothing in section 6, tells a Data Fiduciary it must route consent through a registered intermediary before that consent counts. You can still collect it directly, through your own form, your own notice, your own consent log.

The bar to become one is deliberately high

Part A of the First Schedule sets the entry conditions, and they read like a licence for a regulated financial intermediary because that is roughly what a Consent Manager is meant to be. The applicant has to be a company incorporated in India. Its net worth cannot be less than two crore rupees. It needs sufficient technical and financial capacity to run the platform, and its directors need to be of good repute. This is not a form you fill in on a slow afternoon.