India has opened the registration process for Consent Managers under the Digital Personal Data Protection (DPDP) Act, 2023, marking another step in the implementation of the country's digital data protection framework.
The Ministry of Electronics and Information Technology (MeitY) announced on November 14 that the Consent Manager registration framework had come into effect on November 13, 2026. MeitY Secretary S. Krishnan also launched an online portal to enable eligible companies to apply for registration.
Editorial Insight
Key Highlights
Important points readers should notice.
Consent Manager registration framework became effective on November 13, 2026.
MeitY launched the online registration portal on November 14.
Eligible companies can apply through dpbi.gov.in.
Applicants must be companies incorporated in India.
Minimum net worth requirement is ₹2 crore.
Applicants must meet technical, operational, financial and governance conditions.
What Are Consent Managers?
Under the DPDP framework, a Consent Manager is a registered entity that provides individuals, known as Data Principals under the law, with an accessible and interoperable platform to give, manage, review and withdraw consent for the processing of their personal data.
The system is intended to make consent management easier by allowing individuals to manage their preferences through a common platform instead of handling separate consent interactions across different organisations.
Editorial Analysis
Why This Matters
The registration framework introduces a regulated mechanism to help individuals manage consent relating to their digital personal information. As people increasingly use online banking, shopping platforms, digital applications and other internet services, they encounter multiple requests for access to personal information. Consent Managers are intended to simplify these interactions through an interoperable platform. For businesses, the framework also introduces a new category of regulated service providers with specific financial, technical and governance requirements. Its practical impact will depend on the registration of eligible companies, the development of reliable platforms and the effective implementation of the wider DPDP framework.
Consent Managers must maintain records of consent-related activities and operate in accordance with the responsibilities prescribed under the DPDP Rules, 2025.
Who Can Apply for Registration?
The registration framework allows companies incorporated in India to apply for recognition as Consent Managers.
Applicants must meet several prescribed conditions, including:
- A minimum net worth of ₹2 crore.
- Adequate technical, operational and financial capacity.
- Sound financial condition and management.
- Suitable business prospects and an adequate capital structure.
- Directors, key managerial personnel and senior management with a general reputation for fairness and integrity.
- Appropriate provisions in the company's constitutional documents to ensure compliance with prescribed obligations.
- Independent certification of the proposed interoperable platform and relevant technical and organisational safeguards.
The proposed operations must also be in the interests of Data Principals.
Meeting the minimum net worth requirement alone does not guarantee registration. Applicants must satisfy the other conditions specified in the First Schedule of the DPDP Rules, 2025.
How Will Registration Work?
Eligible companies can submit their applications through the online portal.
Under Rule 4 of the DPDP Rules, 2025, the Data Protection Board of India is responsible for examining applications and assessing whether applicants satisfy the prescribed registration conditions.
The Board may register qualifying applicants and publish their particulars on its website. Applications that do not meet the requirements may be rejected with reasons communicated to the applicant.
The portal's launch enables companies to seek registration. It should not be interpreted as confirmation that any applicant has already received approval.
Responsibilities of Registered Consent Managers
Registered Consent Managers will have specific responsibilities under the framework.
They must maintain records of consent given, denied or withdrawn, along with relevant notices and information about personal data sharing.
They must also provide individuals access to their consent records and maintain those records for at least seven years, subject to the applicable rules.
The framework requires Consent Managers to act in a fiduciary capacity towards Data Principals, maintain appropriate security safeguards and avoid conflicts of interest with Data Fiduciaries.
They must also undergo appropriate audit and compliance monitoring.
Next Phase of Digital Data Protection Implementation
The Consent Manager registration process is part of India's phased implementation of the DPDP Act.
Other major provisions concerning the rights of Data Principals, obligations of Data Fiduciaries and the Data Protection Board's inquiry and penalty processes are scheduled to come into effect on May 13, 2027.
The registration framework is intended to establish the institutional and technical foundation for consent management ahead of the next implementation phase.
