Originals · Startup · Startups & Fintech
Consent manager registration opens under the DPDP Act, but the Data Protection Board that must approve applicants has no members yet
MeitY has launched dpbi.gov.in for Indian companies with a net worth of at least Rs 2 crore to apply as consent managers, one year after the DPDP Rules were notified.
The registration framework for consent managers under the Digital Personal Data Protection (DPDP) Act, 2023 came into effect on 13 November 2026, exactly a year after the DPDP Rules were notified. MeitY Secretary S Krishnan launched the online portal dpbi.gov.in so that eligible companies can apply to the Data Protection Board of India to be registered, the government said in a PIB release on 14 November. The Economic Times reported that the portal went live late on Friday night.
A consent manager is a company registered with the Board that lets people give, manage, review and withdraw their consent to data use across many organisations through one accessible and interoperable platform, and it is accountable to those people rather than to the businesses collecting the data. Moneycontrol described the goal as cutting "consent fatigue", so users do not have to read and act on every website's privacy terms separately. Only companies incorporated in India with adequate technical, operational and financial capacity, including a net worth of at least Rs 2 crore, can apply. The Board will assess applications and publish the list of registered consent managers on its website.
The catch is that the Board is not yet staffed. Moneycontrol reported that the government has still not appointed a chairperson or members, and a senior official said only that appointments would come "soon". The Economic Times quoted an official as saying the government is close to selecting the chairperson and four full time members, with the Department of Legal Affairs vetting candidates. Companies that want to register told ET the Board needs to be operational to examine applications and decide on questions such as conflict of interest, and that some official guidelines remain unclear.
The stakes are commercial as well as regulatory. ET reported that consent managers are emerging as the cornerstone of a compliance as a service market that could reach Rs 10,000 crore in India over the next three years, and that the Board will be able to impose penalties of up to Rs 250 crore on organisations that fail to put reasonable security safeguards in place against data breaches. Those wider provisions, covering the rights of data principals, the duties of data fiduciaries and the Board's inquiry and penalty process, take effect on 13 May 2027, according to the PIB release.
The rollout is also happening under legal cloud. Moneycontrol noted that the DPDP Act faces a constitutional challenge in the Supreme Court, with petitions filed by activists, journalists and the Digital News Publishers Association, which represents 21 major media organisations.
