Legal notice: This article provides general commentary on the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”). It is not legal advice and should not be treated as a substitute for advice on the facts of a particular business, its data-processing arrangements, product categories, distribution structure, contractual arrangements, or technology environment.
The DPDP Act introduces the statutory concept of a Consent Manager. The concept has attracted attention and generated confusion, particularly among businesses operating through extensive or distributed sales networks.
The need for direct-selling businesses to give this matter careful thought is clear. These businesses often handle personal data about customers, potential customers, direct sellers, franchisees, distributors, employees, event participants, complainants, and service providers. It will therefore be one of the key elements of their governance structure under the DPDP Act. However, it must not be assumed that every direct-selling business has to use a third-party consent intermediary.
The first step is to distinguish between a direct-selling company’s ordinary role as a Data Fiduciary and its separate statutory role as a registered Consent Manager.
As of September 2026, the DPDP Rules provide for phased commencement. The provisions relating to the registration of Consent Managers and their obligations are set to come into effect on 13 November 2026. Businesses must distinguish between the statutory framework that has been notified and the date on which the relevant operational requirements become effective. Before relying on any statement that an entity is a registered Consent Manager, businesses should verify the official Board notifications and the publicly released official information.
The statutory position
According to section 2(g) of the DPDP Act, a Consent Manager is a person registered with the Data Protection Board of India (“Board”) who functions as a single point of contact, allowing a Data Principal to give, manage, review, and withdraw consent via an accessible, transparent, and interoperable platform. The Data Principal is the individual whose personal data is in question.
Section 6 provides that a Data Principal may give, manage, review, or withdraw consent through a Consent Manager. A Consent Manager is accountable to the Data Principal and acts on the individual’s behalf in the prescribed manner. Every Consent Manager must be registered with the Board and must meet prescribed technical, operational, financial, and other conditions.
The main idea is clear: a Consent Manager is not the privacy team within a company, a customer-relationship-management system, a website cookie banner, or a distributor enrolment workflow. It is a separate statutory position that must be registered and must comply with the detailed conditions set out in the DPDP Rules.
A direct-selling company may design and operate its own internal process for obtaining and managing consent. It should not, however, present itself as a statutory Consent Manager unless it is registered with the Board and can satisfy the applicable requirements relating to fiduciary capacity, governance, interoperability, and conflicts of interest. The DPDP Rules contain conditions concerning fiduciary capacity, governance, and conflicts of interest. Any proposal for a direct-selling company, its affiliate, or a group entity to act as a Consent Manager should therefore be assessed carefully against those requirements and the practical need to preserve the Consent Manager’s accountability to the Data Principal.
What this means for direct-selling businesses
The DPDP Act does not require companies that engage in direct selling, businesses that operate on a network-selling basis, businesses that sell consumer goods, or e-commerce operators to appoint a Consent Manager or integrate with one.
A direct-selling company can collect and manage consent directly as long as its procedures are in line with the requirements set out in the DPDP Act and the DPDP Rules. The Act allows a Data Principal to use a Consent Manager; it does not require every Data Fiduciary to integrate with one.
In most cases, the company engaged in direct selling will act as the Data Fiduciary since it is responsible for setting both the purpose and the methods of processing personal data; the decisions it takes may concern customer accounts, product orders, delivery, payment confirmation, onboarding of direct sellers, commission administration, customer service, complaint handling, compliance monitoring, fraud prevention, and marketing.
The company must still take responsibility for its own compliance and cannot escape that duty just because it uses a technology provider, messaging platform, cloud service, call centre, fulfilment partner, distributor portal, or, where appropriate, a registered Consent Manager.
| Role | Position in a direct-selling context |
|---|---|
| Direct-selling company | Usually the Data Fiduciary where it determines why and how personal data is processed |
| Direct seller or distributor | May process information within the company’s commercial model, but the legal analysis depends upon the actual facts, authority, controls, systems used, and use of data |
| Data Processor | A person processing personal data on behalf of the company, such as a cloud provider, CRM platform, logistics provider, call centre, analytics provider, or technology vendor |
| Consent Manager | A Board-registered person enabling a Data Principal to manage consent through an accessible, transparent, and interoperable platform |
The legal position of a direct seller should not be based simply on the terms of the contract; it is determined by the real processing activity, such as who decides on the purpose and method of the processing, the extent of the company’s control, the systems employed, and whether the seller uses personal data for purposes of its own determination.
The position of the direct seller requires particular attention. Where individual sellers collect customer information, upload contact details, maintain spreadsheets, create informal messaging groups, or use personal data for prospecting outside authorised company systems, significant compliance and security risks may arise. Companies should address these risks through policy, training, technical controls, contractual obligations, supervision, and effective enforcement.
Consent, notices and withdrawal
Where a direct-selling company relies on consent, that consent must be free, specific, informed, unconditional, and unambiguous, and must be signified through clear affirmative action. Consent should be limited to personal data necessary for the specified purpose. These requirements arise from section 6(1) of the DPDP Act and should be assessed separately for each processing purpose.
This has significant implications for direct-selling businesses. A company should be cautious about treating an individual’s acceptance of general terms and conditions as authority to use that individual’s personal data for every possible purpose.
For example, a customer buying a product may expect the company to process information necessary to accept payment, deliver the product, issue an invoice, respond to a return request, and handle a complaint. This does not mean that the customer has agreed to receive promotional communications, referral activity, direct-seller recruitment communications, marketing by multiple direct sellers, profiling, or sharing personal information across a sales network.
A sound compliance model identifies the purpose of each processing activity.
| Activity | Illustrative processing purpose |
|---|---|
| Product sale and delivery | Payment processing, order fulfilment, delivery, invoicing, returns, and customer support |
| Direct-seller onboarding | Identity verification, account creation, administration of contractual rights and obligations, product purchasing, and commission calculation |
| Optional marketing | Product offers, newsletters, events, promotional communications, and customer-engagement activity |
| Compliance and investigations | Fraud prevention, enforcement of distributor terms, investigation of misconduct, grievance management, and legal compliance |
| Referral activity | Contacting a referred individual only after a proper assessment of the relevant purpose and legal basis |
The DPDP Act permits processing for a lawful purpose based on consent or, where applicable, one of the defined “certain legitimate uses” in section 7. It does not include the broad, open-ended “legitimate interests” ground familiar from the UK GDPR and EU GDPR. A direct-selling business should therefore identify and document the applicable statutory basis for each processing activity, rather than assume that commercial convenience, sales targets, or established distributor practice is sufficient.
Where consent is sought, the notice should be clear, intelligible, and specific to the relevant purpose of processing. Depending on the circumstances and where applicable, a business should explain:
- The identity of the Data Fiduciary
- The personal data proposed to be processed.
- The specified purpose of processing
- Whether marketing communications are optional
- How consent may be withdrawn
- How the individual may exercise relevant rights
- How a privacy grievance may be raised
- The mechanism through which the individual may make a complaint to the Board
Where consent is relied upon, and its validity is questioned, the Data Fiduciary bears the burden of proving that the required notice was given and valid consent was obtained. Companies should therefore retain reliable evidence of the consent journey, including the notice version presented, the processing purpose, the time and channel of collection, the affirmative action taken, and any later withdrawal, refusal, or modification of consent.
Withdrawal of consent must be as easy as giving it. Where consent is withdrawn, the Data Fiduciary must, within a reasonable time, cease and cause its Data Processors to cease processing personal data processed based on that consent, unless processing without consent is required or authorised under the DPDP Act or another law in force in India.
Withdrawal of marketing consent does not necessarily require immediate deletion of every record. A company may still have a lawful basis or legal obligation to retain limited personal data, for example, to fulfil an existing order, process a return, maintain tax and accounting records, deal with a consumer complaint, investigate fraud, or establish, exercise, or defend legal claims. The company should cease processing that relied on the withdrawn consent and retain only what remains necessary and lawful.
The Consent Manager regime
The DPDP Rules prescribe conditions for registering and operating Consent Managers. An applicant must be a company incorporated in India and must satisfy the prescribed technical, operational, financial, governance, interoperability, and conflict-of-interest requirements. The First Schedule specifies a minimum net worth of ₹2 crore.
A registered Consent Manager must, among other matters:
- Operate an accessible, transparent, and interoperable consent-management platform.
- Enable Data Principals to give, manage, review, and withdraw consent.
- Maintain records of consent given, denied, or withdrawn, related notices, and sharing with transferee Data Fiduciaries.
- Provide Data Principals with access to the prescribed records, including in machine-readable form on request.
- Retain prescribed records for at least seven years, or longer where agreed with the Data Principal or required by law.
- Maintain a website or application as the primary means for Data Principals to access the platform.
- Implement reasonable security safeguards.
- Avoid delegating or subcontracting its statutory obligations.
- Comply with applicable audit, reporting, governance, and change-of-control obligations.
The DPDP Rules also require the relevant arrangement to ensure that the contents of personal data made available or shared through the platform are not readable by the Consent Manager. This is an important architectural safeguard. It should not, however, be understood to mean that a Consent Manager has no interaction with personal data whatsoever. The role may necessarily involve limited processing of consent-related information and records required to operate the platform and fulfil legal obligations.
Practical governance priorities
For most direct-selling businesses, the immediate priority is not to become a Consent Manager. It is to establish an internal privacy and data-governance framework that can be explained, evidenced, and defended.
The framework should begin with a thorough mapping of personal-data flows: what information is collected; from whom; through which channels; for what purpose; where it is stored; who can access it; whether it is shared; how long it is retained; and how it is deleted or otherwise securely disposed of.
The following measures are likely to be particularly relevant.
Purpose mapping and data inventory
Identify processing involving customers, prospective customers, direct sellers, franchisees, distributors, employees, leads, event participants, consumer complainants, payment providers, logistics partners, and technology suppliers.
Separate notices and consent journeys
Distinguish customer ordering, direct-seller onboarding, commission administration, optional marketing, recruitment communications, grievance handling, fraud prevention, and legal compliance. Do not use a single generic consent for unrelated activities.
Direct-seller data controls
Establish clear rules governing how distributors collect, upload, use, share, retain, and delete customer and prospect data. Informal use of personal contact lists should not replace a documented privacy process.
Withdrawal and suppression processes
Ensure that withdrawal of consent is operationally effective across CRM systems, distributor portals, email platforms, telecalling operations, bulk SMS tools, messaging services, lead-management systems, and relevant service providers.
Data Processor governance
Put appropriate contractual and operational controls in place with cloud providers, CRM providers, marketing providers, payment providers, fulfilment providers, call-centre providers, analytics providers, and IT service providers.
Security and incident preparedness
Apply security measures that are reasonable and appropriate having regard to the volume, nature, sensitivity, and risk profile of the personal data processed.
Privacy and consumer-grievance coordination
Under the Consumer Protection (Direct Selling) Rules, 2021, a direct-selling entity must establish an adequate grievance-redressal mechanism and provide a mechanism through which consumers may submit complaints through its offices or branches, direct sellers, or by post, telephone, email, or website. The privacy-grievance process should be coordinated with, but must not displace, these separate consumer-law obligations.
Closing observation
The Consent Manager is an important feature of India’s developing data-protection framework. It is intended to give individuals a transparent and interoperable means of giving, managing, reviewing, and withdrawing consent across participating Data Fiduciaries.
It is not, however, a substitute for sound internal data governance, nor is it a universal requirement for direct-selling companies. A direct-selling business remains responsible for its own compliance as a Data Fiduciary, including clear notices, purpose-based processing, valid consent where consent is relied upon, effective withdrawal mechanisms, appropriate security safeguards, reliable records, and oversight of direct sellers and service providers.
Companies that establish these fundamentals will be better placed to assess whether integration with a registered Consent Manager is appropriate as the DPDP regime and the Board’s operational framework develop.