Privacy workflow software and a registered Consent Manager are different roles

Software can help a business record choices, route requests or maintain evidence without being a registered Consent Manager under the DPDP Act. The statutory role has a specific definition and registration framework.

That distinction affects product language, procurement questions and responsibility. A feature called “consent management” does not by itself establish the provider’s legal status.

SWARN is in development. This article explains the distinction and does not claim that SWARN is registered with the Data Protection Board or currently provides any particular workflow.

What the statutory term means

Section 2(g) of the DPDP Act defines a Consent Manager as a person registered with the Board who acts as a single point of contact for a Data Principal to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform.

The registration element is central. A cookie tool, preference database or privacy case-management application does not become a statutory Consent Manager merely by using similar words.

The definition also concerns a role serving the individual in the specified consent process. A business’s internal record of its own customer choices is a different function, even if the underlying software offers useful consent features.

Classify the actual service and legal relationship rather than relying on a product category label.

Read the two commencement stages carefully

As of 22 October 2026, the definition is in force, while the Consent Manager registration phase is scheduled for 13 November 2026. The commencement notification places section 6(9) and section 27(1)(d) in that earlier phase.

The broader substantive provisions, including section 6(7) and 6(8), are scheduled for 13 May 2027. The final Rules, read with their corrigendum, bring rule 4 into force on 13 November 2026, separately from most business obligations.

These dates should not be collapsed into a claim that the entire consent regime is already operative. Nor should the existence of final rules be described as a merely draft framework.

Any claim that a named organisation is registered should be checked against current authoritative registration evidence. This article makes no assertion about a current registered-provider list.

Registration involves more than a feature checklist

Rule 4 and the First Schedule set conditions for registration and obligations for the role. The applicant must be a company incorporated in India with at least ₹2 crore net worth, alongside the prescribed capacity and governance requirements.

Net worth is not the same as paid-up share capital. These conditions are also not universal requirements for every shop, software company or Data Fiduciary using a consent workflow.

The Schedule addresses matters including platform assurance, records, conduct, conflicts and security. It also requires the contents of personal data shared through the specified process to remain unreadable to the Consent Manager. An architecture should be assessed against the actual provisions and applicable standards rather than declared compliant from a marketing diagram.

The Schedule’s minimum seven-year retention requirement concerns prescribed Consent Manager records, with longer retention under the stated agreement or legal conditions. It should not be copied into a blanket rule for every business’s entire customer database.

What ordinary workflow software can contribute

A hypothetical retailer may need a clear preference screen, versioned notices, a withdrawal queue and evidence that its campaign system received an instruction. A software provider could help implement parts of that process.

The legal role of the provider still depends on the actual processing. The Act’s definitions in sections 2(i) and 2(k) distinguish a Data Fiduciary that determines purpose and means from a Data Processor acting on its behalf. A provider may perform different roles for different activities.

A contract and a useful interface do not resolve every responsibility. The retailer still needs to identify its purposes, evaluate its processing and operate the workflow appropriately. Future accountability under the Act should be assessed against the relevant provisions and commencement.

This is why procurement should ask both what the software does and what legal role the provider claims.

Questions that keep the distinction clear

Before relying on a provider’s description, ask:

• Is “consent management” a feature description or a claim to the statutory role?
• If registration is claimed, what current Board evidence supports it?
• Which entity provides the service and which processing role does it perform?
• Which functions are available, in pilot or still planned?
• How are responsibilities, data access and operating limits documented?
• Are Consent Manager-specific conditions being incorrectly presented as universal business duties?

A privacy tool can be useful without claiming a status it does not hold. Precise language lets businesses assess the service on its actual capabilities while keeping the statutory Consent Manager role tied to its legal definition and verified registration.