Policies · eGov
The Data Protection Board of India has begun accepting applications from eligible Indian companies seeking registration as Consent Managers under the DPDP Act, 2023, through a new online portal launched by MeitY.
✦ AI SUMMARY 30-second read
- Applicant companies must be incorporated in India and hold a minimum net worth of INR 20 million, certified by a practising Chartered Accountant.
- Registration requires 17 mandatory documents spanning corporate governance, financials, technical architecture, operational capacity and integrity declarations.
- Remaining DPDP Act provisions — covering Data Fiduciary obligations, Data Principal rights and penalty mechanisms — are scheduled to take effect on 13 May 2027.
Why it matters: Consent Manager registration marks the second phase of India's DPDP Act rollout, setting the stage for full enforcement in May 2027.
This summary was generated by AI. Editors may review and update it.
Document details
| Document type | Rules & Regulation |
|---|---|
| Issued by | Government of India |
| Region | India |
| Published | 14 November 2026 |
The Data Protection Board of India (DPBI) opened registration for Consent Managers on 13 November 2026, marking the second phase of implementation of the Digital Personal Data Protection Act, 2023. The Ministry of Electronics and Information Technology launched an online portal through which eligible Indian companies can submit their applications to the DPBI.
The registration framework creates a mechanism for individuals — referred to as Data Principals under the Act — to give, manage, review and withdraw consent for personal data processing through a single interoperable platform. It also sets out the eligibility, governance, financial and technical conditions that companies must satisfy before providing these services.
What the document says
A registered Consent Manager must provide an interoperable platform enabling Data Principals to manage their consent across participating Data Fiduciaries. Consent Managers are required to operate transparently and in the interests of Data Principals.
The DPBI will assess each application against prescribed conditions. Applications that qualify may be registered; those that do not meet requirements may be rejected with reasons given. Particulars of registered Consent Managers will be made publicly available on the Board's website, though no date for that publication has been specified.
Who is affected
Only companies incorporated in India may apply. The principal eligibility conditions include a minimum net worth of INR 20 million supported by a certificate from a practising Chartered Accountant, demonstrated financial soundness and an appropriate capital structure.
Directors, Key Managerial Personnel and senior management must show a record of fairness and integrity. Applicants must also demonstrate technical capacity to maintain an interoperable consent management platform and must embed prescribed conflict-of-interest provisions in their constitutional documents.
Foreign entities that do not meet the local incorporation requirement cannot apply directly for registration.
Documentation requirements
The DPBI has specified 17 mandatory documents across five categories: corporate governance records, financial statements, technical architecture documentation, operational capacity and governance documents, and fairness and integrity declarations.
Financial documents include audited statements for the preceding three financial years or the latest available balance sheet, annual turnover certificates issued by a practising Chartered Accountant, and a net worth certificate. Companies incorporated less than three years ago may submit statements covering their operating years; those yet to complete their first financial year must provide a provisional profit and loss statement certified by a practising Chartered Accountant.
The technical submission must cover platform architecture, interoperability, security safeguards, consent lifecycle management, data-blind design, record-keeping, and scalability. Governance submissions must include a conflict-of-interest policy, an internal audit and compliance plan, a business continuity plan and a capital structure statement disclosing shareholders holding more than 2 per cent of share capital.
What happens next
Eligible companies may now access the DPBI's online registration portal, complete the application form, upload the required documents and submit for assessment.
The remaining provisions of the DPDP Act — including key obligations of Data Fiduciaries, the rights of Data Principals and the DPBI's inquiry and penalty mechanisms — are scheduled to take effect on 13 May 2027. Businesses are expected to use the intervening period to review their personal data processing practices and consent management arrangements.