DPDP Consent Manager Registration Begins: ₹2 Crore Minimum Net Worth for Indian Companies

The news

The registration framework for Consent Managers under the Digital Personal Data Protection (DPDP) Act, 2023, came into effect on 13 November 2026. On the same day, Shri S. Krishnan, Secretary of the Ministry of Electronics and Information Technology (MeitY), launched the online portal https://dpbi.gov.in to enable eligible Indian companies to apply for registration as Consent Managers. The framework is part of the phased implementation of the DPDP framework and allows eligible entities to seek registration and prepare to offer consent management services.

A Consent Manager is an entity registered with the Data Protection Board of India that enables Data Principals to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform. Companies incorporated in India with a net worth of not less than ₹2 crore and adequate technical, operational and financial capacity may seek registration. The Board will assess applications against applicable requirements and may register qualifying companies; the list of registered Consent Managers will be made publicly available on the Board's website. Other key provisions concerning the rights of Data Principals, the obligations of Data Fiduciaries, and the Board's inquiry and penalty processes are scheduled to come into effect on 13 May 2027.

What is the Digital Personal Data Protection Act, 2023?

The Digital Personal Data Protection Act, 2023 is India's comprehensive law governing the processing of digital personal data, enacted to provide a framework that recognizes both the right of individuals to protect their personal data and the need to process such data for lawful purposes. The Act establishes the Data Protection Board of India as the regulatory authority and creates the role of Consent Managers to help individuals, termed Data Principals, manage their consent with entities that process their data, called Data Fiduciaries. The law was passed by Parliament in August 2023 and received presidential assent on 11 August 2023. It draws upon the principles laid down by the Supreme Court in the landmark 2017 right to privacy judgment in Justice K.S. Puttaswamy (Retd.) vs Union of India, which declared privacy a fundamental right under Article 21 of the Constitution. The Act replaces the earlier Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, which had provided limited data protection norms under the Information Technology Act, 2000. The framing of the DPDP Act was preceded by the report of the Justice B.N. Srikrishna Committee, which submitted its draft Personal Data Protection Bill in 2018 after a year-long consultation process.

What is a Consent Manager?

A Consent Manager is an entity registered with the Data Protection Board of India that enables Data Principals to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform. The framework seeks to strengthen trust and accountability in the digital ecosystem, with Consent Managers being accountable to the Data Principals.

What are the eligibility and registration requirements?

Applicants must be companies incorporated in India with a net worth of at least ₹2 crore and adequate technical, operational and financial capacity. Applications are submitted through dpbi.gov.in to the Data Protection Board of India, which assesses them against applicable requirements and may register qualifying companies. The Board's website will publish the list of registered Consent Managers.

What is the next scheduled phase?

Key provisions concerning Data Principal rights, Data Fiduciary obligations and the Board's inquiry and penalty processes are scheduled to take effect on 13 May 2027. The current registration phase allows eligible entities to prepare to offer consent management services before those provisions come into force.