The Indian government has officially opened the application process for companies seeking to operate as consent managers under the Digital Personal Data Protection (DPDP) Act. The registration framework, which aims to provide individuals with greater control over their personal information, came into effect on November 13, 2026.
Electronics and IT Secretary S. Krishnan launched the online portal, hosted at dpbi.gov.in, where eligible businesses can submit their applications to the Data Protection Board of India. According to the Ministry of Electronics and Information Technology (MeitY), the board will assess applicants based on their technical, operational, and financial capacity before approving and publishing a list of registered entities.
Once registered, these companies will provide a platform—either via an app or website—allowing users to manage their data permissions across various participating businesses. Users will be able to review, grant, or withdraw consent for data processing from a single interface. Furthermore, consent managers are required to maintain a comprehensive history of these interactions, including requests that users have previously declined or withdrawn.
To ensure data security, the rules mandate that these firms store records for a minimum of seven years. Companies must also implement strict safeguards to prevent potential data breaches and avoid any conflicts of interest regarding the data requests they facilitate. Only companies incorporated in India with a net worth of at least Rs 2 crore are eligible to apply.
Key facts
- The registration portal for consent managers was launched at dpbi.gov.in on November 15, 2026.
- Applicants must be Indian-incorporated companies with a minimum net worth of Rs 2 crore.
- The registration framework officially became effective on November 13, 2026.
- Consent managers are required to retain user consent history records for at least seven years.
- Major provisions regarding user rights, company obligations, and penalty processes will take effect on May 13, 2027.
Why it matters
This initiative represents a phased implementation of India's digital data protection law. By centralizing consent management, the government intends to simplify how citizens interact with the various businesses handling their personal data, making the process more transparent and accessible.
Background
The framework follows the notification of the DPDP Rules in November 2025, which established the roadmap for rolling out the data protection legislation in systematic stages across the country.
Source: Times of India, Economic Times
Comments