Consent Manager registration opens under DPDP Act: What companies need to know and do
MeitY has launched an online portal for Indian companies to apply as Consent Managers, enabling individuals to manage, review and withdraw consent for the use of their personal data.
The registration requirements seek to ensure that companies entering this space have the financial resources and operational and technical capabilities to provide secure and reliable services.
NEW DELHI: The registration framework for Consent Managers under the Digital Personal Data Protection (DPDP) Act, 2023, came into effect on November 13, enabling eligible Indian companies to apply for registration through a new online portal launched by the Ministry of Electronics and Information Technology (MeitY).
MeitY Secretary S. Krishnan launched the portal at dpbi.gov.in, marking a key step in operationalising the consent management mechanism envisaged under India’s data protection framework.
Companies incorporated in India with adequate technical, operational and financial capacity, including a minimum net worth of ₹2 crore, can apply to the Data Protection Board of India (DPBI) for registration as Consent Managers.
Consent Managers to facilitate user control over personal data
A Consent Manager is an entity registered with the Data Protection Board that provides an accessible, transparent and interoperable platform for individuals to give, manage, review and withdraw consent relating to their personal data.
Under the framework, these entities will be accountable to Data Principals, the individuals to whom personal data relates. The mechanism is intended to give users greater control over how their personal data is processed and the consent they provide to organisations.
The registration requirements seek to ensure that companies entering this space have the financial resources and operational and technical capabilities to provide secure and reliable services.
Data Protection Board to assess applications
Eligible companies can submit registration applications through the newly launched portal. The Data Protection Board will assess applications against the prescribed requirements and register companies that meet the criteria.
The list of registered Consent Managers will be made publicly available on the Board’s website.
Wider DPDP provisions scheduled for May 2027
The registration framework is part of the phased implementation of the DPDP Act and the DPDP Rules, 2025.
Other key provisions relating to the rights of Data Principals, obligations of Data Fiduciaries and the Board’s inquiry and penalty processes are scheduled to come into effect on May 13, 2027.
The phased rollout is intended to provide time for the development of the institutional and operational mechanisms required to implement the data protection framework.
Further information on the DPDP Act and the DPDP Rules is available on the MeitY website at https://www.meity.gov.in/.
