Consent Manager Integration Agreement Template

CONSENT MANAGER INTEGRATION AGREEMENT

This Consent Manager Integration Agreement ("Agreement") is entered into on [Date] between:

[Organization Name], a Data Fiduciary under the DPDP Act, 2023 ("Data Fiduciary"),
AND
[Consent Manager Name], a Consent Manager registered with the Data Protection Board of India under the DPDP Rules, 2025 ("Consent Manager").

RECITALS
The Data Fiduciary wishes to integrate with the Consent Manager's platform to enable Data Principals to give, manage, review, and withdraw consent for the processing of their personal data by the Data Fiduciary through an interoperable, transparent, and accessible interface, consistent with Section 6 of the DPDP Act, 2023.

1. CONFIRMATION OF REGISTRATION
The Consent Manager represents and warrants that it holds a valid and current registration with the Data Protection Board of India as a Consent Manager, and shall promptly notify the Data Fiduciary of any suspension, cancellation, or material change to that registration.

2. SCOPE OF INTEGRATION
The Consent Manager shall provide the Data Fiduciary with technical integration (API/SDK) enabling:
   a. Presentation of the Data Fiduciary's itemised notice (per Section 5) to the Data Principal through the Consent Manager's interface;
   b. Capture of granular, purpose-wise consent artefacts, timestamped and versioned;
   c. Real-time or near-real-time synchronisation of consent grants and withdrawals to the Data Fiduciary's systems;
   d. A consolidated dashboard allowing the Data Principal to view all consents given to the Data Fiduciary and to withdraw any of them with the same ease as granting.

3. DATA FIDUCIARY OBLIGATIONS
The Data Fiduciary shall:
   a. Provide the Consent Manager with accurate, itemised notice content for each processing purpose, consistent with Section 5;
   b. Honour consent withdrawal signals received from the Consent Manager within [X hours], ceasing the relevant processing unless a Section 7 legitimate use independently applies;
   c. Not process personal data for any purpose beyond the scope of consent recorded via the Consent Manager;
   d. Maintain its own record of consent transaction identifiers received from the Consent Manager for audit purposes.

4. CONSENT MANAGER OBLIGATIONS
The Consent Manager shall:
   a. Act only as an intermediary facilitating consent and shall not process the underlying personal data for any purpose of its own, other than to the extent necessary to provide the consent management service;
   b. Maintain the interoperability, accessibility, and transparency standards prescribed under the DPDP Rules, 2025;
   c. Implement security safeguards to protect the integrity of consent records and prevent unauthorised alteration;
   d. Make available to the Data Principal a clear, accessible record of all consents and withdrawals, and to the Data Fiduciary, an auditable log of the same;
   e. Notify the Data Fiduciary of any breach affecting consent records or Data Principal data without undue delay and in any event within [X hours].

5. DATA MINIMISATION
The Consent Manager shall access only the minimum personal data necessary to render the consent notice and record the consent decision, and shall not aggregate or use consent metadata for any purpose other than providing the consent management service to the Data Principal.

6. LIABILITY
Nothing in this Agreement relieves the Data Fiduciary of its primary obligations as Data Fiduciary under the DPDP Act, 2023. The Consent Manager shall be liable for losses arising from its failure to accurately record, transmit, or honour consent instructions in accordance with this Agreement.

7. AUDIT
The Data Fiduciary may audit the Consent Manager's records relating to consents given in respect of the Data Fiduciary's processing activities, on [X days'] written notice.

8. TERM AND TERMINATION
This Agreement remains in effect until terminated by either Party on [X days'] written notice, or immediately upon suspension or cancellation of the Consent Manager's registration with the Data Protection Board of India.

9. GOVERNING LAW
This Agreement is governed by the laws of India, with courts at [City] having exclusive jurisdiction.

For [Organization Name]                          For [Consent Manager Name]
Name: ______________________                    Name: ______________________
Title: ______________________                   Title: ______________________
Consent Manager Registration No.: [Registration Number]