Consent manager registration opens under data protection law; ₹2 crore net worth needed

Companies that want to run platforms where Indians grant and withdraw permission to use their personal data can now apply. Consent manager registration, part of India’s Digital Personal Data Protection Act, 2023, took effect on Friday, 13 November, and the Ministry of Electronics and Information Technology (MeitY) has opened a portal, dpbi.gov.in, for applications.

MeitY Secretary S. Krishnan launched the portal, the ministry said in a statement on Saturday, 14 November. The DPDP Rules, published in the Gazette on 13 November 2025, had timed the consent manager clause to begin a year after publication. Consultations on the draft rules ran in seven cities, Hyderabad among them, and drew 6,915 inputs in all.

A consent manager stands between a person and the organisations that want their data. The Data Protection Board of India registers it, and it offers one platform where a user can grant, track and cancel permissions for every organisation that joins. It answers to the user, not to the companies asking for consent.

Who can apply, and what they must do

Only Indian companies qualify, with at least ₹2 crore in net worth and the money, systems and staff to run the service. The rules also demand sound management, directors and senior staff of known integrity, and independent certification that the platform meets data protection standards set by the Board. The Board will vet each application and list registered firms online.

A consent manager must be unable to read the personal data moving through its system. It must keep a record of every consent given, refused or withdrawn for seven years or more, and give users a machine-readable copy on request. It cannot sub-contract its work, must avoid conflicts of interest with companies seeking consent, and must name its directors and every shareholder above 2 per cent on its app or website. The company cannot change hands without the Board’s approval, and the Board can suspend or cancel a registration after hearing the firm.

When users will see the change

The rules give a banking example: a woman asked by one bank for her account statement can send her consent via the bank that holds her account, which then passes the statement on.

Under the Act, a company that fails to keep reasonable security safeguards can be fined up to ₹250 crore, and one that does not report a breach of personal data up to ₹200 crore. The Board’s powers to investigate and fine, individuals’ rights and the duties of companies holding personal data take effect on 13 May 2027. From then, companies and consent managers must respond to individuals’ complaints within 90 days.