News · eGov
The Ministry of Electronics and Information Technology has launched a registration process for consent managers under the Digital Personal Data Protection Act, 2023, requiring applicant companies to hold a minimum net worth of Rs 2 crore.
✦ AI SUMMARY 30-second read
- Registration framework for consent managers under the DPDP Act, 2023, came into effect on November 13, 2026.
- Eligible Indian companies with a minimum net worth of Rs 2 crore can apply to the Data Protection Board of India.
- The next major implementation phase, covering data rights and penalty provisions, is scheduled for May 13, 2027.
Why it matters: The move gives individuals a formal mechanism to control how companies collect and use their personal data under India's data protection law.
This summary was generated by AI. Editors may review and update it.
The Ministry of Electronics and Information Technology has opened the registration window for consent managers under the Digital Personal Data Protection Act, 2023. The framework came into effect on November 13, 2026, with MeitY Secretary S Krishnan launching the online portal through which companies can file their applications with the Data Protection Board of India.
Indian companies that meet the prescribed technical, operational and financial criteria — including a minimum net worth of Rs 2 crore — are eligible to apply. The names of approved consent managers will be listed publicly on the Board's website once registration is granted.
What consent managers do
A consent manager acts as an intermediary that allows individuals — referred to as data principals under the law — to give, manage, review and withdraw their consent for how organisations use their personal data.
The ministry described the role as providing an accessible, transparent and interoperable platform for individuals to exercise control over their personal information. The framework is designed to place consent decisions directly in the hands of users rather than leaving them entirely to data-handling companies.
Background
The Digital Personal Data Protection Act, 2023, is India's principal legislation governing how personal data may be collected, stored and processed by companies. The DPDP Rules were notified in November 2025, laying down the phased roadmap for bringing the law into full effect.
The opening of consent manager registration marks one step in that phased roll-out. MeitY has described the broader implementation effort as aimed at giving citizens meaningful control over their digital data.
What happens next
The Data Protection Board will review applications against the prescribed eligibility conditions before granting registration. Companies that satisfy the requirements will be listed on the Board's public register.
The next significant milestone in the implementation schedule falls on May 13, 2027, when provisions relating to individuals' data rights, the obligations of companies that handle personal data, and the Board's inquiry and penalty processes are set to come into force.