DPDP Act consent manager registration opens; firms can apply now
Synopsis
India has formally opened registrations for Consent Managers under the DPDP Act, 2023 — the first operational step toward giving citizens structured control over who accesses their personal data. With a ₹2 crore net worth bar and a government-run portal now live, the race to become India's first registered data consent intermediaries has begun. Full enforcement, however, only kicks in from May 2027.
Key Takeaways
Krishnan launched the Consent Manager registration portal on 14 November 2026 .
Eligible companies must be incorporated in India and have a minimum net worth of ₹2 crore .
Consent Managers will allow Data Principals to give, manage, review, and withdraw consent over their personal data.
Registered Consent Managers will be listed publicly on the Data Protection Board of India's website.
Broader DPDP Act provisions — including Data Fiduciary obligations and penalty processes — come into effect on 13 May 2027 .
The registration framework for Consent Managers under the Digital Personal Data Protection (DPDP) Act, 2023 has come into effect in India, with eligible companies now able to apply for registration through a newly launched online portal. The development marks a significant milestone in the phased rollout of the country's first comprehensive personal data protection law.
Portal Launch and What It Enables
IT Secretary S. Krishnan formally launched the online registration portal on Saturday, 14 November 2026, enabling eligible companies to seek registration as Consent Managers with the Data Protection Board of India. The portal allows qualifying entities to submit applications that will be assessed by the Board against prescribed requirements.
A Consent Manager, as defined under the DPDP Act, is a registered entity that enables Data Principals — individuals to whom the personal data belongs — to give, manage, review, and withdraw consent through an accessible, transparent, and interoperable platform. The list of registered Consent Managers will be made publicly available on the Board's website once approvals are granted.
Who Can Apply and What the Eligibility Criteria Are
Companies incorporated in India with adequate technical, operational, and financial capacity are eligible to apply. A key financial threshold is a minimum net worth of not less than ₹2 crore. According to the Ministry of Electronics and Information Technology (MeitY), these requirements are intended to ensure that registered entities possess the resources and capabilities to deliver secure, reliable, and accountable consent management services.
The framework positions Consent Managers as intermediaries that are accountable directly to Data Principals, reinforcing citizen-centric control over personal data in India's expanding digital ecosystem.
What This Means for Citizens
For ordinary users, the activation of this framework means they will eventually gain a structured mechanism to manage exactly who can access their personal data and under what terms. Currently, digital consent in India is largely governed by opaque terms-of-service agreements. Consent Managers are designed to replace that model with a transparent, user-controlled layer.
This comes amid a broader global push for data sovereignty, with frameworks such as Europe's GDPR having already reshaped how corporations handle personal information. India's DPDP Act has been in the making for over a decade, and the operationalisation of Consent Managers represents one of its most citizen-visible features.
Remaining Provisions and Timeline
Notably, only the Consent Manager registration framework has been activated at this stage. Other key provisions of the DPDP Act — covering the rights of Data Principals, the obligations of Data Fiduciaries (entities that process personal data), and the Board's inquiry and penalty processes — are scheduled to come into effect on 13 May 2027. This phased approach is intended to give industry time to build compliance infrastructure before enforcement begins.
With applications now open and the Board set to begin assessments, the coming months will reveal how many companies meet the bar — and how quickly India's consent management ecosystem takes shape.
Point of View
But its real significance lies in what it signals: the government is now committed to a rollout timeline, with hard deadlines replacing years of legislative drift. The ₹2 crore net worth bar is low enough to allow startups to participate, which could accelerate competition in what may become a high-stakes intermediary market. The more critical question is whether citizens will actually use Consent Manager platforms or treat them as yet another checkbox. Without digital literacy campaigns and genuine interoperability mandates, the architecture risks becoming technically sound but practically invisible. The May 2027 enforcement date for penalties is the real pressure point — and industry compliance will likely spike only in the months before it.
NationPress
14 Nov 2026
Frequently Asked Questions
What is a Consent Manager under India's DPDP Act, 2023?
A Consent Manager is an entity registered with the Data Protection Board of India that enables individuals — called Data Principals — to give, manage, review, and withdraw their personal data consent through a transparent and interoperable platform. The role is defined under the Digital Personal Data Protection Act, 2023, and is central to giving citizens structured control over their data.
Who is eligible to apply as a Consent Manager?
Companies incorporated in India with sufficient technical, operational, and financial capacity — including a minimum net worth of ₹2 crore — can apply for registration as Consent Managers. Applications are submitted through the newly launched portal and assessed by the Data Protection Board of India.
When will the full DPDP Act come into force?
The Consent Manager registration framework is now active, but broader provisions covering Data Principal rights, Data Fiduciary obligations, and the Board's inquiry and penalty processes are scheduled to take effect on 13 May 2027. This phased approach gives industry time to prepare for full compliance.
How does the Consent Manager system benefit ordinary citizens?
It gives individuals a structured, accessible way to decide who can collect and use their personal data, replacing the current model of opaque terms-of-service agreements. Once registered Consent Managers begin operating, users will be able to manage and withdraw consent in real time through these platforms.
Where can citizens find the list of registered Consent Managers?
The Data Protection Board of India will publish the list of all registered Consent Managers on its official website, ensuring public transparency about which entities are authorised to provide consent management services.
