The Ministry of Electronics and Information Technology (MeitY) has opened the registration process for consent managers under the Digital Personal Data Protection (DPDP) Act, 2023. The framework came into effect on 13 November 2026, allowing eligible companies incorporated in India to apply to the Data Protection Board of India (DPBI) for registration.
MeitY Secretary S Krishnan launched the application portal at dpbi.gov.in on 14 November. The portal is intended for companies seeking approval to provide consent-management services under the data-protection law. The DPBI will examine applications against the prescribed requirements and approve entities that meet the eligibility conditions.
“The framework marks an important step towards operationalising a system that enables data principals to exercise greater control over consent relating to the processing of their personal data. It forms part of the phased implementation of the DPDP framework and enables eligible entities to seek registration and prepare to offer consent management services,” MeitY said.
What consent managers will do
Under the framework, a consent manager will provide an accessible, transparent and interoperable platform through which individuals can control permissions connected with the processing of their personal data. The law refers to these individuals as data principals.
The service is designed to cover the main consent-related actions available to users:
- give consent for the processing of personal data;
- manage and review previously provided consent; and
- withdraw consent through the platform.
This places consent managers between individuals and organisations that process personal information. Registered entities will be accountable to data principals, while the DPBI will maintain oversight of the registration process. The names of approved consent managers will be made publicly available on the Board’s website, according to MeitY.
Who can apply
The registration route is open to Indian companies that have the required technical, operational and financial capacity. A minimum net worth requirement also applies.
| Requirement | Condition |
|---|---|
| Company status | Must be incorporated in India |
| Capabilities | Adequate technical, operational and financial capacity |
| Minimum net worth | ₹2 crore |
| Application authority | Data Protection Board of India |
The minimum net worth threshold means that registration is aimed at companies able to operate the required consent infrastructure and meet the Board’s prescribed conditions. However, meeting the financial threshold alone will not result in automatic approval; applications will be assessed by the DPBI.
Part of a phased rollout
The registration process is an early operational step in the wider implementation of the DPDP framework. The next phase, scheduled for May 2027, will cover provisions relating to data principals’ rights, obligations for data fiduciaries and the DPBI’s penalty processes.
For users in India, the immediate development is the creation of a regulated route for organisations that want to manage consent on their behalf. The practical effect will depend on which companies are registered, how their platforms interoperate with businesses holding personal data, and how easily individuals can review or revoke permissions. MeitY has described the framework as a measure intended to give people greater control over the use of their personal information while establishing accountability for consent-management services.
