India’s Consent Manager Registration Framework Takes Effect: What the Data Privacy Rules Require and What Is Still Pending

From today, i.e. 13 November 2026, the part of India’s Digital Personal Data Protection Rules, 2025 dealing with Consent Managers is in force. It lets companies apply to the Data Protection Board of India to be registered as Consent Managers, a new category of intermediary that individuals can use to handle their consent to businesses. The registration route opens today, but the obligations on businesses that process personal data do not begin until 13 May 2027, and the Board’s readiness to process applications is not yet confirmed.

What a Consent Manager is

The Digital Personal Data Protection Act, 2023 describes a Consent Manager as a single point of contact through which an individual can give, manage, review and withdraw consent. The platform must be accessible, transparent and interoperable. An individual may choose to use one; the Act does not require it.

The Act also says a Consent Manager is accountable to the individual and acts on that person’s behalf. A Consent Manager is not an agent of the business collecting the data.

What the Rules require of an applicant

The Rules provide that a person meeting the registration conditions may apply to the Board in the form and manner the Board publishes on its website. The Board may make enquiries, and it either registers the applicant and publishes its details, or refuses with reasons. The conditions include:

• the applicant must be a company incorporated in India with sufficient technical, operational and financial capacity;
• it must have a net worth of at least ₹2 crore;
• its directors and senior management must have a reputation for fairness and integrity;
• its constitutional documents must require it to meet the prescribed obligations and allow changes to those provisions only with the Board’s prior approval;
• its operations must serve the interests of individuals; and
• an independent certifier must confirm that its platform meets the standards the Board publishes.

What a registered Consent Manager must do

Once registered, a Consent Manager must meet continuing obligations. In outline, it must:

• enable individuals to give, review and withdraw consent to businesses onboarded to its platform;
• ensure the personal data passing through it cannot be read by the Consent Manager itself;
• keep records of consents, refusals, withdrawals and data sharing for at least seven years, and give individuals access to them;
• act as a fiduciary toward individuals and avoid conflicts of interest with the businesses it works with;
• not sub-contract its obligations;
• publish information about its management and significant shareholders;
• maintain audit mechanisms and report to the Board; and
• obtain the Board’s prior approval before any change of control.

The Board may direct corrective measures and, after a hearing, suspend or cancel a registration where necessary to protect individuals.

Where matters stand

Only the Consent Manager registration provisions, and the Board’s power to act on a Consent Manager’s breach of its registration conditions, begin on 13 November 2026. The provisions letting individuals use a Consent Manager, together with the notice, consent, security, breach-reporting and rights provisions, are scheduled for 13 May 2027, which is 181 days from today.

Practical Takeaways

1. The registration framework starts today, but it is an enabling step; the business-facing obligations start on 13 May 2027.
2. Prospective Consent Managers should expect scrutiny of ownership, governance, net worth and independent certification, and should watch for the Board’s published form and standards.
3. Businesses that rely on consent should expect that individuals may eventually act through intermediaries. How consent requests and withdrawals are received and recorded will matter once the main provisions begin.
4. Dates and procedures may change, and the Board’s published materials should be checked before acting.