A DPDP Consent Manager is a defined intermediary in the data-protection framework. It helps a person give, manage, review and withdraw consent through an accessible, interoperable platform. Confirm the applicable registration and operational requirements before relying on an intermediary's claim.

An application's consent screen is one interface within a broader processing workflow. It does not become a registered Consent Manager because it stores a choice or issues an OAuth token.

Identify the actor and the decision

Mechanism	Decision it addresses	Evidence to inspect
Application privacy consent	The stated processing purpose under the applicable framework	Notice version, choice and withdrawal handling
DPDP Consent Manager	A person's consent-management interface across participating processing relationships	Registration, applicable rules and supported arrangements
DigiLocker requester consent	Access to approved documents under a provider contract	Requested purpose and actual returned document grant
OAuth authorization	A client requests defined access to a resource	Granted scope, audience and protocol context
Account Aggregator consent	A financial-data sharing arrangement under its own framework	Applicable AA contract and evidence

The government describes Consent Managers as an interoperable interface for a person's consent choices. That role does not make every other authorization mechanism interchangeable with it. Official DPDP backgrounder.

Check commencement and registration separately

Rule 4 concerns Consent Managers and has its own commencement group. Read the current Rule 1 schedule and the relevant requirements before making an availability claim. The date a provision commences is not proof that a particular company has been registered. Final DPDP Rules.

For implementation planning, use the rule-specific commencement guide. Obtain current registration evidence from the responsible official source before describing an organization as registered.

Design evidence around your actual purpose

Keep the notice, the person's choice and the processing decision linked. Define how an operator can identify the relevant record without receiving unnecessary personal data.

The following is an application planning example. It is not a statutory wire format, an AA artifact or a NamoID product schema.

{
  "purpose_reference": "synthetic-support-followup",
  "notice_version": "example-v1",
  "choice": "granted",
  "record_reference": "synthetic-choice-001",
  "withdrawal_route": "application-privacy-settings"
}

Your actual system needs an appropriate subject reference and time evidence. Keep those fields within the responsible processing boundary. Do not copy a financial-data artifact and assume it is the required format for every DPDP workflow.

Make withdrawal an operational change

Locate the relevant purpose and record.
Verify the request through the approved route.
Record the withdrawal and its effective state.
Identify downstream processing that relies on that choice.
Apply the reviewed stop, retention or deletion decision.
Record completion and unresolved dependencies.

Withdrawal does not automatically mean that every retained record must disappear in the same way. Assess other lawful requirements and the applicable duty. Make those decisions explicit in the workflow.

Use the consent withdrawal engineering guide for the application process and the retention guide for data locations.

Keep document grants and sessions distinct

A DigiLocker document grant can expire while an application session remains active. An application logout can leave other grants requiring cleanup. Define each transition rather than treating a single consent boolean as the system state.

The DigiLocker grant lifecycle explains that boundary. It does not establish that DigiLocker or NamoID is a registered DPDP Consent Manager.

Review the implementation boundary with NamoID

NamoID can provide scoped identity events and supported authorization controls. These do not constitute a complete application privacy-consent record or establish Consent Manager registration.

Our engineers can help map the identity events your workflow actually produces. Share your stack, purpose and synthetic withdrawal journey in Slack for an early response. Contact the NamoID team