Consent Manager meaning: DPDP Act and ABDM, compared Two things share the name. What each one is, when the DPDP one goes live, and what a clinic has to do.

A Consent Manager, under section 2(g) of the Digital Personal Data Protection Act, 2023, is "a person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform". Section 6(7) lets the Data Principal "give, manage, review or withdraw her consent to the Data Fiduciary through a Consent Manager", and s.6(8) makes the Consent Manager "accountable to the Data Principal". In a clinic, the patient is the Data Principal and the clinic is the Data Fiduciary.

Who can be a Consent Manager under DPDP?

Section 6(9) says "Every Consent Manager shall be registered with the Board in such manner and subject to such technical, operational, financial and other conditions as may be prescribed." Rule 4 of the Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), 13 November 2025) sets the registration process, and Part A of the First Schedule lists the conditions. Among them: "The applicant is a company incorporated in India" and "The net worth of the applicant is not less than two crore rupees." Part B lists obligations, including that the Consent Manager "shall ensure that the manner of making available the personal data or its sharing is such that the contents thereof are not readable by it", shall keep a record of consents "given, denied or withdrawn" for at least seven years, and "shall act in a fiduciary capacity in relation to the Data Principal". So a Consent Manager is a registered intermediary company, not something a clinic appoints internally.

When do the Consent Manager provisions start?

G.S.R. 843(E) of 13 November 2025 appoints "one year from the date of publication of this gazette" as the date on which "sub-section (9) of section 6 and clause (d) of sub-section (1) of section 27" come into force; s.27(1)(d) is the Board's power to inquire into a breach of a Consent Manager's registration conditions. Rule 1(3) of the Rules says "Rule 4 shall come into force one year after the date of publication of this Gazette." The notification was published on 13 November 2025, so these provisions arrive in November 2026. The rest of the Act's obligations on clinics, including consent itself under s.6(1) to (8), are in the eighteen-month group; the full timeline is in our guide to the DPDP Act for clinics.

What is the ABDM consent manager?

A different system with a similar name. ABDM FAQ 294 says: "Health Information Exchange and Consent Manager (HIE-CM) is a digital system developed by ABDM. It enables consent management, linking, and sharing of personal health records for users. Currently there is one HIE-CM which has been developed by the government." FAQ 11 describes the flow: consent "is taken, logged and only after that, the health records are shared". FAQ 344 says a patient can revoke a consent "at any point of time" from the consent tab of the ABHA app, after which the data "would not be visible to healthcare professional or health facility". The HIE-CM is part of ABDM and works through the patient's PHR app; it is not registered under the DPDP Act's s.6(9).

What does a small clinic have to do today?

Nothing specific to Consent Managers. A one-doctor clinic does not register as one and is not required to use one; the Act gives the patient the option. What the clinic will need, when sections 3 to 10 come into force, is its own notice and consent at the desk and a grievance route: a line on the registration form and a named contact, covered in our post on informed consent in an OPD.