DPDP Act Implementation: MeitY Opens Consent Manager Registration Portal

The IT ministry (MeitY) has opened the registration process for consent managers under the Digital Personal Data Protection (DPDP) Act, 2023. 

The registration framework, which came into effect on November 13, will enable eligible Indian companies to apply for registration. IT secretary S Krishnan also launched an online portal, dpbi.gov.in today to enable the companies to submit their applications to the Data Protection Board of India (DPBI).

A consent manager is an entity registered with the DPBI that enables individuals, referred to as data principals (DPs) under the Act, to give, manage, review and withdraw consent for the processing of their personal data through an interoperable platform.

The framework seeks to give individuals greater control over how their personal information is used and strengthen accountability in the digital ecosystem. Consent managers will be accountable to data principals.

Companies incorporated in India with adequate technical, operational and financial capacity can apply for registration as Consent Managers. They must have a minimum net worth of ₹2 Cr to qualify.

“The framework marks an important step towards operationalising a system that enables data principals to exercise greater control over consent relating to their personal data. It forms part of the phased implementation of the DPDP framework and enables eligible entities to seek registration and prepare to offer consent management services,” MeitY said.

The DPBI will assess the applicants against the prescribed requirements and will approve the companies that meet the eligibility criteria. A list of registered consent managers will be made publicly available on the Board’s website.

DPDP Act: Key Provisions And Implementation Timeline

The Digital Personal Data Protection (DPDP) Act, 2023 establishes a legal framework for processing digital personal data in India. It also defines the rights of individuals and obligations of organisations handling their personal information. The legislation was passed by the Parliament in August 2023. 

It identifies two key entities: data fiduciaries and data principals. A data fiduciary is an organisation that determines the purpose and means of processing personal data. This includes banks collecting customer details, ecommerce platforms storing purchase histories and companies maintaining employee records. 

A data principal, meanwhile, is the individual to whom the personal data belongs.

Under the Act, data fiduciaries must obtain consent before processing personal data, except in specified circumstances permitted under the law. Such consent must be free, specific, informed, unconditional and unambiguous. They must also inform individuals about the purpose of collecting their data and how it will be used.

The law also grants data principals several rights, including the right to access information about the processing of their personal data, seek correction and erasure, withdraw consent and raise grievances. They can also nominate another person to exercise their rights in certain circumstances.

On the compliance front, data fiduciaries are required to implement reasonable security safeguards to protect personal information. They must also notify the DPBI and affected individuals in the event of a data breach, in accordance with the prescribed framework.

The Act also provides additional safeguards for children’s data. It requires verifiable parental consent before processing the personal data of children below 18 years and restricts tracking, behavioural monitoring and targeted advertising directed at children, subject to specified exemptions.

The implementation framework took shape with MeitY notifying the Digital Personal Data Protection Rules, 2025, in November last year. 

The rules lay down a phased timeline for bringing the Act’s provisions into effect. According to a Press Information Bureau (PIB) backgrounder published in November 2025, the government received 6,915 inputs during the consultation process from startups, MSMEs, industry bodies, civil society organisations, government departments and citizens.

The rollout will continue in phases. The provisions concerning the rights of data principals, obligations of data fiduciaries, and the DPBI’s inquiry and penalty processes are scheduled to come into effect on May 13, 2027.

The post DPDP Act Implementation: MeitY Opens Consent Manager Registration Portal appeared first on Inc42 Media.