#CAMS Is Selling DPDP Consent Software. That Does Not Make It a Consent Manager

On 17 September, Computer Age Management Services told the stock exchanges it had launched ConsenPro Self-Serve, a do-it-yourself DPDP compliance product, and had signed up WhiteOak Capital Management and Helios Mutual Fund as clients. Fifty-five days from now, on 13 November 2026, the DPDP consent manager framework switches on. Those two facts are being read as connected. They are not — and the gap between them is where a lot of Indian compliance budgets are about to be misspent.

A DPDP consent manager is a specific creature of statute: a registered intermediary, licensed by the Data Protection Board, that acts for the citizen. A consent management platform is software a company buys to run its own notice-and-consent plumbing. ConsenPro Self-Serve is the second thing. Most coverage of the launch has treated it as though it were the first. Here is why that confusion is expensive, and why CAMS in particular is the sharpest illustration of it in the Indian market.

#What CAMS actually announced

The disclosure describes ConsenPro Self-Serve as a streamlined tier of ConsenPro, the consent platform built by Think360.ai, a CAMS Group company, which first launched in late 2025. The self-serve version bundles four capabilities: data discovery, consent notice creation, legacy consent management, and API-based integration. Trade coverage ties the unveiling to Global Fintech Fest 2026, held 8–11 September at Mumbai's Jio World Centre, with the formal exchange filing following on 17 September.

Alongside the product, CAMS announced service engagements with WhiteOak Capital Management and Helios Mutual Fund covering data discovery, privacy assessments, consent governance, policy operationalisation and ongoing compliance monitoring. Anuj Kumar, CAMS's Managing Director, framed the pitch around discovery and governance as the first steps to DPDP readiness — which is a more honest description of what the product does than the "consent manager" framing that has attached itself to the story.

The commercial logic is obvious. CAMS is the registrar and transfer agent for roughly 68% of Indian mutual fund average assets under management, servicing around ₹52 lakh crore. It already holds the operational relationship with almost every AMC in the country. Selling those same AMCs their privacy tooling is a natural extension, and the WhiteOak and Helios engagements are the proof points.

#The distinction the market keeps collapsing

Under the DPDP Act, Section 6(9) is unambiguous: "Every Consent Manager shall be registered with the Board in such manner and subject to such technical, operational, financial and other conditions as may be prescribed." Sections 6(7) and 6(8) fill in what that entity does — a Data Principal may give, manage, review or withdraw consent through a Consent Manager, and that Consent Manager is accountable to the Data Principal and acts on her behalf.

Read those three sub-sections together and the architecture is clear. A consent manager is not a vendor to business. It is a fiduciary for the citizen, sitting deliberately outside the commercial interest of the companies whose consents it brokers. Rule 4 of the DPDP Rules 2025, read with Part A of the First Schedule, sets the entry conditions: incorporation in India, minimum net worth of ₹2 crore, a board with conflict-of-interest policies, encrypted infrastructure and audit-ready logging. Part B sets the continuing obligations. Critically, a registered consent manager handles consent artefacts, not personal data — it records and transmits the permission, and never sees the underlying information.

A consent management platform does almost the inverse. It is deployed by a data fiduciary, configured to that fiduciary's purposes, and operates on the fiduciary's behalf. It touches real personal data as part of discovery and rights fulfilment. It requires no registration with anybody, and no regulator has to approve it. As TrustArc puts it in its own explainer on the distinction, the two "are often confused because both involve the word 'consent,' but they operate at fundamentally different levels."

The practical consequence for an Indian business: buying a CMP discharges none of your Rule 4 obligations, because you never had any. Rule 4 binds entities that want to operate as consent managers. If you are an AMC, a bank or a retailer, you are a data fiduciary. Your obligations are notice under Section 5, valid consent under Section 6, security safeguards under Section 8(5), breach notification under Rule 7 and rights fulfilment under Sections 11–14 — all of which land on 13 May 2027, not 13 November 2026. A CMP genuinely helps with those. It is simply not what November's deadline is about.

Conversely, a company that wanted to become a consent manager gets nothing from buying software. It needs ₹2 crore of net worth, an Indian incorporation, and a registration certificate from a Board that currently cannot issue one.

#India invented this category, which is why nobody recognises it

Part of the confusion is that there is no international reference point. GDPR relies entirely on controllers and processors and has no neutral consent intermediary. Neither does California's CPRA, China's PIPL, Singapore's PDPA or Brazil's LGPD. India's consent manager is a first-in-the-world statutory consent intermediary, and the vocabulary that has grown up around global privacy tech simply has no slot for it.

So the market reached for the nearest available word. Vendors selling consent management platforms — a mature, crowded global category — found themselves selling into a country where "consent manager" had just acquired a precise legal meaning that described something they were not. Some have been careful. A great many product pages, comparison listicles and "top 10 consent managers in India" posts have not been, and the resulting search results are now actively misleading buyers about what they are procuring and what it satisfies.

#The CAMS case is the cleanest illustration in India

Here is what makes this particular launch worth writing about rather than just another vendor announcement.

CAMS already operates a regulated consent intermediary. CAMS Financial Information Services Private Limited, trading as CAMSfinserv, is an RBI-licensed NBFC-Account Aggregator, one of the earliest licensed, having received its operating licence in March 2020. An Account Aggregator does almost exactly what a DPDP consent manager does: it brokers consent between a citizen and multiple institutions, transmits data on the strength of that consent, and — like a consent manager — cannot itself read what it moves.

So within one corporate group you can now see all three categories at once:

• CAMSfinserv — a regulated consent intermediary, licensed by the RBI, restricted to financial information as defined in the Master Direction – NBFC – Account Aggregator (2016), with technical standards set by ReBIT, barred from non-AA business, and answerable to the RBI.
• A DPDP consent manager — which CAMS does not yet operate, because nobody does. It would cover all personal data, not just financial information, with standards set by the Data Protection Board and no bar on other lines of business.
• ConsenPro Self-Serve — enterprise software, no licence, no registration, no regulator, answerable to its customers.

That is the "one function, two rulebooks" problem that the specialist press flagged the day after the CAMS filing — except it is really one function, two rulebooks and a third lane with no rulebook at all.

The AA-versus-consent-manager overlap is a live and unresolved question. Sahamati, the AA industry body, has argued that registration criteria for the two are "largely the same" and that the Board should simply deem existing AAs to be consent managers for the financial sector rather than force a parallel registration. The differences it concedes are real: scope of data, the business-activity prohibition, and which body sets technical standards. There is also a genuine jurisdictional question about grievance redressal, where judicial precedent on regulatory overlap has tended to favour the sectoral regulator over the subject-matter one.

None of that is settled. And it cannot be settled by anyone right now, which brings us to the structural problem underneath this whole story.

#There is still no Board to register anyone

The DPDP Rules were notified on 13 November 2025 with a phased commencement: Board provisions immediately, the consent manager framework at twelve months, and the substantive compliance obligations plus the penalty regime at eighteen months on 13 May 2027.

On 6 May 2026, MeitY invited applications for the Chairperson and four Members of the Data Protection Board of India, with a follow-up notification on 6 June. As of today, no appointments have been announced. Rule 4 gives the Board — and only the Board — the power to inquire into an applicant and grant or reject registration. There is at present no one empowered to receive a consent manager application, let alone decide one.

So on 13 November 2026, the consent manager framework commences into a vacuum. Section 6(9) will be in force. Operating as an unregistered consent manager after that date exposes an entity to the Act's residual penalty tier of up to ₹50 crore. But the registration counter has no one behind it.

This is precisely why the vocabulary matters. A business that has been told it "bought a consent manager" may believe it has dealt with November. It has not, because November was never its deadline. A fintech that genuinely intends to operate as a consent manager may believe it can register once it has the software. It cannot, because the bottleneck is an appointment file in Delhi, not a procurement decision.

#What Indian businesses should actually do with 55 days

Three concrete things, in order.

First, work out which category you are in. If you collect personal data from individuals in India in connection with offering goods or services, you are a data fiduciary and your hard deadline is 13 May 2027. November is not yours. If you intend to operate as a registered consent manager, November is yours, and your blocker is the Board, not your tech stack — get the ₹2 crore net worth, Indian incorporation, conflict-of-interest policy and encryption posture documented now so you are first in the queue when registration opens.

Second, audit the language in your vendor contracts. If a proposal, SOW or marketing deck describes the product as a "consent manager," ask the vendor in writing whether it is applying for Rule 4 registration and, if not, which of your statutory obligations the product discharges. A good vendor will answer that cleanly. The answer also matters for liability: a CMP processing personal data on your behalf is a processor, and under Section 8(1) a data fiduciary stays responsible for compliance regardless of any contract with a processor. You cannot outsource the liability, only the work.

Third, treat discovery as the real deliverable. Whatever else is confused about this launch, the underlying insight in the CAMS pitch is sound: you cannot build consent flows over a data estate you have not mapped. EY's research on Indian enterprise readiness found roughly 83% of organisations had not begun comprehensive implementation and about 77% were not equipped to adopt privacy technologies such as consent management, data discovery or rights fulfilment tooling — with nearly 70% saying they find the Act genuinely difficult to interpret. Discovery is the step that is valuable on day one and stays valuable regardless of how the consent manager question resolves.

For a plain-English breakdown of which obligations attach to data fiduciaries versus registered consent managers, and where the 13 November and 13 May dates actually bite, see our /consent-manager explainer and the wider /resources library.

#The bottom line

The CAMS announcement is a real, dated, commercially significant development — the country's dominant mutual fund registrar is now selling privacy infrastructure to the AMCs whose back offices it already runs, and it has named clients to prove the market exists. That is worth knowing.

What it is not is a consent manager launch, and the speed with which it got described as one is the actual story. India has built a genuinely novel institutional layer into its privacy law, handed it a commencement date, and not yet appointed the regulator that gives it effect. Into that gap, a vocabulary is forming that is precise in the statute and mushy everywhere else. Fifty-five days out, the single most useful compliance step an Indian business can take is a boring one: read Section 6(9), read Rule 4, work out which side of the line it sits on, and stop buying the other side's product.