On November 14, 2026, the Ministry of Electronics and Information Technology (MeitY) introduced a new online portal allowing eligible Indian companies to register as Consent Managers. This step is part of the ongoing implementation of the Digital Personal Data Protection Act, 2023, which aims to regulate how personal data is managed and protected in India. The registration framework officially came into effect a day earlier, on November 13, 2026.
Understanding Consent Managers and Their Role
Consent Managers are entities authorized to provide individuals, referred to as Data Principals under the Act, with a clear and user-friendly platform to give, manage, review, and withdraw their consent regarding the processing of their personal data. This role is crucial because it ensures transparency and control over how personal information is used by various organizations, often called Data Fiduciaries.
To qualify as a Consent Manager, companies must be incorporated in India and demonstrate sufficient technical, operational, and financial capabilities. One key requirement is maintaining a minimum net worth of ₹2 crore. The portal's launch marks the second phase of the Act's rollout, focusing on establishing a structured system for consent management in the digital space.
Key Details About the Registration and Data Protection Board
- The registration portal opened on November 14, 2026, for Indian companies meeting eligibility criteria.
- Consent Managers must provide an interoperable platform that respects the principles of free, informed, specific, unconditional, and unambiguous consent.
- The Data Protection Board of India (DPBI), created by notification on November 13, 2025, has yet to become operational as no Chairperson or members have been appointed as of early November 2026.
- Applications for the Board's positions were invited in May and June 2026, but appointments remain pending.
- Without an operational Board, inquiries, complaint hearings, and penalty impositions under the Act cannot yet proceed.
- Key provisions regarding data fiduciary obligations and Data Principal rights will become enforceable starting May 13, 2027.
- The Act allows penalties up to ₹250 crore for serious violations of data protection rules.
Why the Consent Manager Portal Matters for Data Privacy
The introduction of the Consent Manager registration portal is a significant milestone in India's journey toward stronger data protection. By creating a formal mechanism for managing consent, the government aims to empower individuals with greater control over their personal data. This is especially important in an era where digital services and data-driven technologies are rapidly expanding.
However, the delay in operationalizing the Data Protection Board means that enforcement of many critical provisions is still pending. This gap highlights the challenges in fully implementing the Act and ensuring compliance among data fiduciaries. Once the Board is functional, it will have the authority to investigate complaints, conduct inquiries, and impose substantial penalties, which could reshape how organizations handle personal data in India.
Meanwhile, companies aspiring to become Consent Managers must prepare to meet stringent standards, including technical robustness and financial stability. Their role will be central to building trust in digital ecosystems by facilitating transparent and accountable data processing practices.
Frequently Asked Questions
Q: What is the purpose of a Consent Manager under the Digital Personal Data Protection Act?
A: Consent Managers provide platforms that allow individuals to give, manage, review, and withdraw consent for the processing of their personal data, ensuring transparency and control.
Q: Who can apply to become a Consent Manager?
A: Indian companies incorporated in India with adequate technical, operational, and financial capacity, including a minimum net worth of ₹2 crore, are eligible to apply.
Q: When will the Data Protection Board start enforcing penalties under the Act?
A: The Data Protection Board is expected to become operational and enforce key provisions, including penalties, from May 13, 2027, once its Chairperson and members are appointed.
