SCENARIO C02 · GOVERNANCE & TRANSFERS
A vendor calls its consent widget a registered Consent Manager. What must be separated?
IN PLAIN ENGLISH
Why you are seeing this step
This field note uses one realistic decision to separate the official source, an editorial interpretation, a practical option, evidence to keep, and any uncertainty that still depends on your facts.
Educational only, not legal advice. Source status is dated 13 November 2026; inspect the official links below before relying on it.
BEST NEXT STEP
Separate an ordinary consent tool from the statutory role registered with the Board.
Verify the role, registration evidence and applicable commencement cohort before describing the vendor publicly or relying on its statutory status.
WHY THE OTHER INSTINCTS MISS
Separate an ordinary consent tool from the statutory role registered with the Board.
Correct. Act section 6(9) and Rule 4 concern registration; a product label does not create that status.
Accept the title if the vendor offers a consent dashboard.
Dashboard functionality is not proof of registration or satisfaction of statutory conditions.
Assume every Consent Manager is the organisation’s Data Processor.
The statutory Consent Manager role is accountable to the Data Principal and should not be collapsed into a generic vendor category.
BUILD THIS EVIDENCE
Board registration check, role assessment, conflict review and vendor claim record.
This artefact supports review. It does not certify compliance or replace advice on your facts.
- Guidance type
- legal requirement
- Pinpoint
- Act s. 6(7)–(9); Rule 4 and First Schedule; G.S.R. 843(E) and 846(E)
- Reviewed
- 2026-08-30
- Change note
- Status and pinpoint reviewed against the official Act, final Rules, commencement notification and corrigendum for this educational website.
OFFICIAL SOURCE TRAIL
Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) ↗
Definitions and specified machinery provisions are operative; most substantive duties and rights are notified for later commencement. Check each scenario's status record.
Act s. 1(2); provision-specific section pinpointsDigital Personal Data Protection Rules, 2025 (G.S.R. 846(E)) ↗
Final Rules with phased commencement. Scenario pinpoints identify the particular Rule being taught.
Rule 1(2)–(4), read with the corrigendumDPDP Act commencement notification G.S.R. 843(E) ↗
Appoints immediate, one-year and eighteen-month commencement cohorts for the Act.
G.S.R. 843(E), clauses (a)–(c)