Policies · eGov
MeitY has launched an online portal for companies to apply as Consent Managers under the Digital Personal Data Protection Act, 2023, with the registration framework effective from November 13, 2026.
✦ AI SUMMARY 30-second read
- The Consent Manager registration framework came into effect on November 13, 2026, with the portal launched by MeitY Secretary S. Krishnan the following day.
- Applicants must be companies incorporated in India with a minimum net worth of ₹2 crore and must satisfy technical, operational, financial and governance conditions.
- Other major DPDP provisions, including rights of Data Principals and Data Fiduciary obligations, are scheduled to take effect on May 13, 2027.
Why it matters: The framework introduces a regulated category of service providers to help individuals manage consent over their personal data across digital platforms.
This summary was generated by AI. Editors may review and update it.
Document details
| Document type | Framework |
|---|---|
| Issued by | Government of India |
| Region | India |
| Published | 15 November 2026 |
The Government of India has opened registration for Consent Managers under the Digital Personal Data Protection Act, 2023, as part of the phased implementation of the country's data protection framework. The Ministry of Electronics and Information Technology announced that the registration framework became effective on November 13, 2026.
MeitY Secretary S. Krishnan launched an online portal on November 14 to allow eligible companies to submit their applications for registration as Consent Managers.
Under the DPDP framework, a Consent Manager is a registered entity that provides individuals — referred to as Data Principals under the law — with an interoperable platform to give, manage, review and withdraw consent for the processing of their personal data.
What the document says
The registration framework sets out several conditions that applicants must satisfy. These include a minimum net worth of ₹2 crore, adequate technical and operational capacity, sound financial management and appropriate capital structure.
Applicants must also ensure that their directors, key managerial personnel and senior management have a general reputation for fairness and integrity. The proposed interoperable platform must be independently certified, along with relevant technical and organisational safeguards.
Meeting the minimum net worth requirement alone does not guarantee registration. Applicants must satisfy all other conditions specified in the First Schedule of the DPDP Rules, 2025.
Who is affected
Only companies incorporated in India are eligible to apply for Consent Manager registration. The framework establishes a new category of regulated service provider within the digital data protection ecosystem.
Data Principals stand to benefit from a simplified, centralised mechanism to manage their consent preferences across multiple organisations, rather than handling separate consent interactions with each.
Responsibilities of registered entities
Registered Consent Managers must maintain records of consent given, denied or withdrawn, along with relevant notices and information about personal data sharing. These records must be retained for at least seven years, subject to applicable rules.
The framework requires Consent Managers to act in a fiduciary capacity towards Data Principals, maintain appropriate security safeguards, avoid conflicts of interest with Data Fiduciaries and undergo audit and compliance monitoring.
The Data Protection Board of India is responsible under Rule 4 of the DPDP Rules, 2025, for examining applications, assessing whether conditions are met, and publishing the particulars of qualifying registrants. Applications that do not meet requirements may be rejected, with reasons communicated to the applicant.
What happens next
The launch of the portal enables companies to begin seeking registration; it does not indicate that any applicant has already received approval.
Other significant provisions of the DPDP Act — covering Data Principal rights, Data Fiduciary obligations and the Data Protection Board's inquiry and penalty processes — are scheduled to come into force on May 13, 2027. The Consent Manager registration process is intended to build the institutional and technical foundation ahead of that phase.