Quick answer: The registration framework for Consent Managers under India's Digital Personal Data Protection (DPDP) law took effect on 13 November 2026. Eligible Indian companies can now apply through the Data Protection Board's new portal. Rule 4 and the First Schedule govern eligibility, registration and duties. Most other substantive DPDP provisions are scheduled for 13 May 2027.
The Ministry of Electronics and Information Technology (MeitY) announced the launch of the online registration portal on 14 November 2026. The change gives prospective Consent Managers a route to seek registration; it should not be confused with the commencement of the entire DPDP framework.
What changed on 13 November 2026?
Rule 1(3) of the Digital Personal Data Protection Rules, 2025 brought Rule 4 into force one year after the Rules were published on 13 November 2025. Rule 4 permits an eligible applicant to apply to the Data Protection Board of India for registration as a Consent Manager. The Board may examine the application and register a qualifying applicant or reject it with reasons.
MeitY says applications can be submitted through dpbi.gov.in. An application is not itself a registration: the Board must assess the conditions in Part A of the First Schedule. Registered entities' particulars are to be published on the Board's website.
| Date | DPDP implementation milestone |
|---|---|
| 13 November 2025 | Rules 1, 2 and 17–21 commenced on publication. |
| 13 November 2026 | Rule 4, concerning Consent Manager registration and obligations, commenced. |
| 13 May 2027 | Rules 3, 5–16, 22 and 23 are scheduled to commence. Other key provisions on Data Principal rights, Data Fiduciary obligations, and inquiry and penalties are also scheduled for this date. |
Key distinction: The portal's launch opens the application route. It does not mean every privacy right and compliance duty in the DPDP Act and Rules is already operative.
What is a Consent Manager under the DPDP Act?
A Consent Manager is an entity registered with the Board that serves as a point of contact for a Data Principal to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform. A Data Principal is the individual to whom the personal data relates. The model is intended to let a person manage consent across participating Data Fiduciaries through such a platform.
Who can apply for registration?
Part A of the First Schedule to the DPDP Rules sets out the conditions. Among them, the applicant must:
- be a company incorporated in India;
- have sufficient technical, operational and financial capacity, with a sound financial condition and management;
- have net worth of at least Rs. 2 crore;
- have directors and senior management with a record of fairness and integrity; and
- obtain independent certification that its interoperable platform meets the Board's applicable standards and assurance framework, with appropriate technical and organisational measures.
The Schedule also addresses the applicant's business prospects, constitutional documents, conflicts of interest and whether its proposed operations serve Data Principals' interests. The net worth threshold alone does not establish eligibility.
What happens after an application?
Under Rule 4, the Board may make inquiries to satisfy itself that Part A's conditions are met. If satisfied, it may register the company and publish its particulars. If not, it must communicate the reasons for rejection. Rule 4 also allows the Board to require information and, after an opportunity of being heard, direct corrective measures or suspend or cancel registration in the interests of Data Principals, with reasons recorded for suspension or cancellation.
What duties apply to a registered Consent Manager?
Part B of the First Schedule describes the Consent Manager's obligations. Its platform must enable a Data Principal to handle consent for participating Data Fiduciaries. The arrangement for making personal data available or sharing it must keep the contents of that data unreadable to the Consent Manager.
The Consent Manager must maintain records of consent given, denied or withdrawn, accompanying notices, and relevant sharing. Data Principals must have access to these records, with a machine-readable version available on request under the prescribed terms. The records must be retained for at least seven years, or longer where agreed or required by law.
Other duties include reasonable security safeguards, acting in a fiduciary capacity towards the Data Principal, avoiding conflicts with Data Fiduciaries, publishing specified ownership and management information, and maintaining audit mechanisms. The Consent Manager cannot subcontract or assign performance of its statutory obligations.
For a prospective applicant, the practical task is therefore broader than launching a consent dashboard. Corporate eligibility, independent certification, governance and continuing accountability are built into the registration framework.
Why the phased timeline matters
The registration framework is an early operational step under the DPDP regime. MeitY's 14 November announcement says the principal rights of Data Principals, duties of Data Fiduciaries, and the Board's inquiry and penalty processes are scheduled to take effect on 13 May 2027. The official commencement notification for the Act and Rule 1 of the Rules should be read together when checking which provision applies on a given date.
Key takeaways
- Rule 4 commenced on 13 November 2026; MeitY launched the application portal on 14 November 2026.
- The applicant must meet all Part A conditions, including Indian incorporation and net worth of at least Rs. 2 crore.
- Registration is decided by the Board, rather than granted automatically on application.
- Part B places detailed obligations on a registered Consent Manager, including recordkeeping, security, independence and audit.
- Most other substantive DPDP provisions are scheduled for 13 May 2027.
Frequently asked questions
Is the DPDP Consent Manager portal open?
MeitY announced on 14 November 2026 that eligible companies can apply through dpbi.gov.in. The Board assesses each application under Rule 4.
Can an individual register as a Consent Manager?
No. Part A requires the applicant to be a company incorporated in India.
Is Rs. 2 crore net worth sufficient for approval?
No. It is one condition among several covering capacity, management, certification and governance. The Board must be satisfied that the prescribed conditions are met.
Can a Consent Manager read the personal data shared through its platform?
The Schedule requires the manner of sharing to ensure that the contents are not readable by the Consent Manager.
Has the entire DPDP Act commenced?
No. The law has a phased commencement. Rule 4 is in force, while major provisions concerning rights, Data Fiduciary duties and enforcement are scheduled for 13 May 2027.
Official sources: MeitY/PIB launch announcement · DPDP Rules, 2025 (Gazette) · DPDP Act commencement notification (Gazette).
