Consent Manager registration opens in days, but India's Data Protection Board still has empty chairs

What is about to open

On 13 November 2026, Rule 4 of the Digital Personal Data Protection Rules, 2025, comes into force. From that date, an Indian company that meets the First Schedule conditions can apply to the Data Protection Board of India to register as a Consent Manager: a neutral intermediary that lets a person give, manage, review and withdraw consent for personal data across many organisations from one place. Sister reference dpdpr.in summarises the bar: the applicant must be a company incorporated in India with a net worth of at least Rs 2 crore, fit-and-proper directors, an interoperable platform and adequate security for consent records. The Consent Manager is meant to be data-blind, handling consent artifacts and routing instructions rather than reading the underlying personal data.

This is not the start of the Act's main duties. Notice, consent proof, security safeguards, breach reporting, Significant Data Fiduciary rules and penalties still wait until 13 May 2027. What changes in mid-November is only the registration track for Consent Managers. For ordinary apps and banks that act as Data Fiduciaries, the practical message is to expect consent signals from outside their own banners once managers exist, while still keeping their own proof of consent when the May 2027 duties switch on.

The boardroom problem

The catch is who will receive those applications. The Economic Times reported on 27 October 2026 that a government RTI reply showed the Data Protection Board of India had spent not a single rupee on salaries, office expenses, rent or information and communication technology equipment as of 30 September 2026. Coverage in The Economic Times and The Hindu BusinessLine says no Chairperson and no members have been appointed, even though Board provisions have been in force since the Rules were notified in November 2025. Without members, the Board cannot publish the application particulars Rule 4 assumes, cannot set the technical certification standards the First Schedule points to, and cannot adjudicate registrations.

Hindu BusinessLine's early October survey of the consent-tech market found privacy software firms busy selling consent stacks to clients, yet still unsure whether they themselves would register as intermediaries. Government sources told that paper the Board's composition would be announced "soon." As of early November, The Economic Times' follow-up on revenue models still described an industry preparing paperwork against a deadline while the regulator that must open the counter remains unstaffed.

Who pays for consent

Even firms ready to apply have not settled how Consent Managers will make money. The Economic Times reported on 2 November 2026 that players are divided over whether data fiduciaries, technology companies, consumers or the government should bear the cost. That debate matters because a Consent Manager has to stay independent of the firms whose consents it routes. If fiduciaries fund the service, conflict rules get harder. If consumers pay, adoption may stay thin outside high-literacy users. If nobody pays, the platforms that meet the Rs 2 crore net-worth bar may never leave the slide deck.

The First Schedule also expects an independently certified interoperable platform. As of 1 November 2026, specialist explainers noted that the Board had not published the certification standards, the form, the fee or the submission channel. Applicants preparing files are working from the Gazette text alone. Filing on 13 November may create a queue. It does not create a decision until a staffed Board can inquire, register or reject under Rule 4.

What could still go wrong

Best case for the digital economy is a Board appointed in late 2026, application particulars soon after, and first registrations adjudicated early enough that Consent Managers exist when May 2027 duties begin. Worst case is further delay, so the Consent Manager lane stays legal on paper and empty in practice while fiduciaries build one-off consent banners that do not talk to each other. Either way, the November date is a stress test: India wrote a privacy law that puts a registered intermediary at the centre of consent, then left the registrar's chairs vacant with days to go.

For readers tracking DPDP from the outside, the actionable split is simple. If you want to be a Consent Manager, watch MeitY and the Board website for the published particulars and keep the Rs 2 crore and certification evidence ready. If you are a Data Fiduciary, you do not register as a Consent Manager, but you should plan systems that can honour consent given or withdrawn through one once registrations exist, and treat 13 May 2027 as the hard date for your own notice, consent and security duties.