On November 14, 2026, India's Ministry of Electronics and Information Technology said that companies can apply to register as consent managers under the Digital Personal Data Protection Act, 2023, through an online portal launched by MeitY Secretary S. Krishnan. The registration framework came into effect on November 13, 2026, according to the ministry, and applicants must be companies incorporated in India with a net worth of at least 2 crore rupees.

In Short

India has started accepting applications from companies that want to become consent managers, a new kind of licensed service that lets people give, track and withdraw permission for the use of their personal data across many apps and websites from one place. Only Indian companies with enough money and technical capacity, including a net worth of at least 2 crore rupees, can apply, and the Data Protection Board of India decides who gets registered. The ministry's announcement names no Board members, although applications go to the Board, and as of PPC Land's November 12 report no appointment had been announced. The obligations that matter most for advertisers and publishers, such as consent notices, breach reporting and penalties, start on May 13, 2027.

What the ministry announced

The announcement came through the Press Information Bureau in New Delhi at 12:41 p.m. India time on November 14, as release ID 2336151. According to the ministry, "the registration framework for Consent Managers under the Digital Personal Data Protection (DPDP) Act, 2023, came into effect on 13 November 2026." As part of that phase, Krishnan "launched the online portal https://dpbi.gov.in to enable eligible companies to apply for registration as Consent Managers," according to the release.

The ministry describes the step as "an important step towards operationalising a system that enables Data Principals to exercise greater control over consent relating to their personal data." Data Principal is the Act's term for the individual whose data is processed. According to the release, the framework is part of the phased implementation of the law and allows eligible entities "to seek registration and prepare to offer consent management services."

The release is short - 339 words, by its own count - and it leaves most operational detail to the 2025 rules and to the portal. It gives an email address for queries, secretary[at]dpbi[dot]gov[dot]in, and links to a further explanatory document on the framework hosted on Google Drive.

According to the ministry, a consent manager "is an entity registered with the Data Protection Board of India (Board) that enables Data Principals to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform." The release adds that "the framework seeks to strengthen trust and accountability in the digital ecosystem, with Consent Managers being accountable to the Data Principals."

That accountability is the feature that separates India's model from the tools most marketers know. A consent management platform of the kind European publishers deploy under the GDPR works for the website or app that installs it, collecting choices on that company's behalf. An Indian consent manager is registered with the regulator, sits between the individual and the companies that want to use the data, and owes its duties to the individual.

The concept comes from Section 6 of the 2023 Act. Section 6(9), which requires every consent manager to register with the Board, took effect on November 13, 2026, alongside Section 27(1)(d), which gives the Board power to inquire into a consent manager's breach of its registration conditions, and Rule 4 of the 2025 rules, which sets out how registration works. PPC Land described that split in detail on November 12. The provisions that let an individual act through a consent manager in dealings with companies sit in the later tranche that starts in May 2027.

Who can apply

The release sets out the eligibility test in one sentence: "Companies incorporated in India with adequate technical, operational and financial capacity, including a net worth of not less than ₹2 crore, may seek registration as Consent Managers." According to the ministry, these requirements "are intended to ensure that registered entities have the resources and capabilities to provide secure, reliable and accountable services."

The Digital Personal Data Protection Rules, 2025, published in November 2025, list the full conditions in Part A of their First Schedule. According to the rules, there are nine.

Condition (Part A, First Schedule, DPDP Rules 2025) Summary
Incorporation The applicant is a company incorporated in India
Capacity Sufficient technical, operational and financial capacity to meet its obligations
Soundness Sound financial condition and general character of management
Net worth Not less than 2 crore rupees (20 million rupees)
Business prospects Adequate volume of likely business, capital structure and earning prospects
Integrity Directors, key managerial personnel and senior management have a general reputation and record of fairness and integrity
Constitutional documents Memorandum and articles of association contain provisions on avoiding conflicts of interest, which can be changed only with the Board's prior approval
Purpose Proposed operations are in the interests of Data Principals
Certification Independent certification that the platform meets the data protection standards and assurance framework published by the Board, and that the required safeguards are in place

The net worth floor is low by the standards of large technology firms. Two crore rupees is 20 million rupees. The other conditions do more of the filtering: independent certification of the platform, management integrity tests and conflict-of-interest provisions written into the company's own constitutional documents.

How registration works

According to the ministry's release and Rule 4 of the 2025 rules, the process has five stages:

  1. Eligibility. The applicant must meet the Part A conditions, including Indian incorporation and the 2 crore rupee net worth floor.
  2. Application. Eligible companies "may apply to the Board for registration through the newly launched portal," according to the release. Under Rule 4, the application carries the particulars, information and documents that the Board publishes on its website.
  3. Assessment. According to the release, "the Board will assess applications against the applicable requirements and may register qualifying companies." Rule 4 allows the Board to make any inquiry it considers appropriate before deciding.
  4. Decision and publication. If satisfied, the Board registers the applicant and publishes its particulars; if not, it rejects the application with reasons, according to the rules. The release says "the list of registered Consent Managers will be made publicly available on the Board's website."
  5. Supervision. A registered consent manager carries the obligations in Part B of the First Schedule. After a hearing, the Board can direct it to take corrective measures and, with written reasons, suspend or cancel its registration. It can also require the consent manager to provide information, according to Rule 4.

The release uses "may register," a discretionary verb. Some Indian outlets went further: Inc42 wrote that the Board "will approve" companies meeting the criteria. The ministry's own wording leaves room for the Board to refuse an applicant that technically qualifies.

What registration commits a company to

Part B of the First Schedule sets the duties that apply once a company is registered, according to the 2025 rules.

Obligation area (Part B, First Schedule) What the rules require
Consent Enable a Data Principal to give consent to a company onboarded to the platform, directly or through another onboarded company
Data blindness Share personal data in a way that keeps its contents unreadable to the consent manager itself
Records Keep records of consents given, denied or withdrawn, of notices, and of data shared with another company
Access Give the Data Principal access to those records, in machine-readable form on request
Retention Keep the records for at least seven years, or longer if agreed or required by law
Interface Operate a website, an app or both as the primary means of access
No outsourcing Do not sub-contract or assign the performance of its obligations
Security Take reasonable security safeguards against personal data breaches
Fiduciary duty Act in a fiduciary capacity towards the Data Principal
Conflicts Avoid conflicts of interest with the companies it serves, including through their promoters and key managerial personnel
Disclosure Publish its promoters, directors, key managerial personnel and senior management, holders of more than 2% of its shares, and bodies corporate in which those people hold more than 2%
Audit Maintain audit mechanisms and report to the Board on controls, continued eligibility and compliance
Control No transfer of control by sale, merger or otherwise without the Board's prior approval

The data blindness requirement stands out. A consent manager records who agreed to what, and routes data between companies, but under the rules it should not be able to read the personal data it moves.

A Board that must decide

Every stage after the application runs through the Data Protection Board of India. The November 14 release does not name a Chairperson or any Member, and does not say who will assess the first applications.

The Board has existed in law since November 13, 2025, when a gazette notification fixed it at four members. PPC Land reported on November 12 that none of the posts had been filled, even though MeitY had invited applications for a Chairperson and four Members on May 6, 2026 and advertised the posts on June 6. At a Kerala High Court hearing on October 7, 2026, the central government's counsel said the Board had been constituted but not yet made functional, and the court recorded that it expected it to be functional within eight weeks, a period that ends on December 2, 2026 by PPC Land's calculation.

Nothing in the ministry's announcement changes that picture. The ministry has opened the door and named the body that will decide; whether anyone is in a position to decide is a question the release does not address. Can a register of approved consent managers be published before the Board has members to approve them? The release is silent on that point.

The phased timetable

India chose to bring its data protection regime in by stages. The consent manager phase is the second of three, according to the release and the 2025 rules.

Date What takes effect
November 13, 2025 Definitions, establishment and constitution of the Data Protection Board (Sections 18 to 26), general provisions; Rules 1, 2 and 17 to 21
November 13, 2026 Consent manager registration: Section 6(9), Section 27(1)(d) and Rule 4
May 13, 2027 Rights of Data Principals, obligations of Data Fiduciaries, the Board's inquiry and penalty processes, and the remaining rules

According to the release, "other key provisions concerning the rights of Data Principals, the obligations of Data Fiduciaries, and the Board's inquiry and penalty processes are scheduled to come into effect on 13 May 2027."

PPC Land covered the 2025 rules on November 15, 2025, including the consent manager framework, the 72-hour deadline for reporting breaches to the Board and the salaries set for its members.

Why it matters for advertisers and publishers

From May 13, 2027, any company that decides why and how personal data of people in India is processed will be a Data Fiduciary, the Act's equivalent of a data controller in European law. That covers most advertisers, publishers and ad tech firms with Indian audiences. Vendors acting on their instructions will be Data Processors, the counterpart of a data processor under the GDPR.

Consent managers are meant to stand between those companies and the people whose data they use. Once the third tranche begins, an individual will be able to give or withdraw consent through a registered consent manager, which then records the choice and passes it to the relevant companies. For businesses, that means consent signals may arrive from outside their own interfaces, and withdrawals may arrive the same way.

The idea of moving consent out of individual sites and into an intermediary is not unique to India. The European Commission's Digital Omnibus proposal of November 19, 2025 included machine-readable consent signals that browsers would send to websites. The Council's compromise text of June 18, 2026 dropped that browser signal. India has written its intermediary into law and put a licensing regime behind it.

The market at stake is large. OpenAI switched on ChatGPT ads in India on August 29, 2026, part of a run of 32 new markets in five days. Platforms and advertisers building in India will face the Data Fiduciary obligations from May 2027, and consent managers registered under the new framework would be among the channels through which consent reaches them.

Other countries in the region are moving on similar timetables. Indonesia's Government Regulation No. 33 of 2026 sets fines of up to 2% of annual revenue and takes effect in January 2027. Vietnam brought its personal data decree into force on January 1, 2026, with a 72-hour breach notification rule.

What the release does not say

The release does not list application fees, required documents, review times or the certification bodies that can certify a platform, and it gives no figure for applications received. It does not name any Board member or explain how applications will be decided before members are appointed, and it does not say whether any company has already applied.

Key facts

  • Announcing body: Ministry of Electronics and Information Technology (MeitY), Government of India
  • Source document: Press release "Consent Manager Registration Framework Comes into Effect; MeitY Secretary Launches Online Registration Portal", Press Information Bureau, Delhi, November 14, 2026, 12:41 p.m. IST, release ID 2336151
  • Source URL: https://www.pib.gov.in/PressReleasePage.aspx?PRID=2336151
  • Effective date of the framework: November 13, 2026
  • Portal: https://dpbi.gov.in, launched by MeitY Secretary S. Krishnan
  • Legal basis: Digital Personal Data Protection Act, 2023, Section 6(9) and Section 27(1)(d); Digital Personal Data Protection Rules, 2025, Rule 4 and First Schedule (Parts A and B)
  • Eligibility: company incorporated in India with adequate technical, operational and financial capacity and a net worth of not less than 2 crore rupees
  • Decision-maker: Data Protection Board of India, which "may register qualifying companies"
  • Public register: list of registered consent managers to be published on the Board's website
  • Next phase: May 13, 2027, for Data Principal rights, Data Fiduciary obligations and the Board's inquiry and penalty processes
  • Queries: secretary[at]dpbi[dot]gov[dot]in

Timeline

Summary

Who: India's Ministry of Electronics and Information Technology and its Secretary, S. Krishnan, who launched the registration portal; the Data Protection Board of India, which decides applications; and Indian companies that want to operate as consent managers. Advertisers, publishers and platforms that will be Data Fiduciaries from May 2027 are the companies consent managers will deal with.

What: The consent manager registration framework under the Digital Personal Data Protection Act, 2023 and Rule 4 of the 2025 rules is in effect, and eligible companies can apply through dpbi.gov.in. Applicants must be incorporated in India, show adequate technical, operational and financial capacity and have a net worth of at least 2 crore rupees. The Board may register qualifying companies and will publish the list.

When: The framework came into effect on November 13, 2026, and the ministry announced it on November 14, 2026. The main obligations and penalties under the Act are scheduled for May 13, 2027.

Where: India, with applications filed online through the Data Protection Board's portal.

Why: Consent managers are designed to give individuals one accountable place to give, review and withdraw consent across many companies, with duties owed to the individual rather than to the companies collecting data. The framework has to be running before the Act's consent and notice obligations start in May 2027, but the release names no Board members to decide the applications it now invites.