India Opens Consent Manager Registration Portal under DPDP Phase 2

The Data Protection Board of India (DPBI) has opened registration for Consent Managers under the Digital Personal Data Protection (DPDP) Act, 2023. To facilitate applications, the Ministry of Electronics and Information Technology (MeitY) has launched an online registration portal through which eligible Indian companies can apply to the DPBI.

The registration framework establishes a mechanism for individuals, referred to as Data Principals under the DPDP Act, to manage their consent for personal data processing through registered Consent Managers. It also sets out the eligibility, governance, financial and technical requirements that companies must satisfy before undertaking these services.

What is a Consent Manager under India’s DPDP Act?

A Consent Manager is an entity registered with the DPBI that provides an interoperable platform for Data Principals to give, manage, review and withdraw their consent for personal data processing.

Through this platform, individuals can manage their consent through a single interface across participating Data Fiduciaries. Consent Managers must operate transparently and in the interests of Data Principals, enabling them to exercise greater control over their personal data.

Who can apply for Consent Manager registration in India?

Companies incorporated in India can apply to the DPBI for registration as Consent Managers, subject to the eligibility conditions under the DPDP Rules, 2025.

The principal registration requirements include the following:

1. Indian incorporation: The applicant must be a company incorporated in India.
2. Minimum net worth: Applicant’s minimum net worth must be at least INR 20 million. The net worth disclosure must be supported by a certificate issued by a practising Chartered Accountant (CA).
3. Financial soundness: The company must demonstrate adequate financial resources, business prospects and a suitable capital structure.
4. Management integrity: Directors, Key Managerial Personnel (KMPs) and senior management must demonstrate a record of fairness and integrity.
5. Technical and operational capacity: Applicant must demonstrate its ability to maintain an interoperable consent management platform, implement appropriate safeguards and meet its operational obligations.
6. Governance and independence: The company’s constitutional documents must incorporate the prescribed provisions addressing conflicts of interest.

The DPBI will assess applications against the prescribed registration conditions. Qualifying applicants may be registered, while applications that do not meet the requirements may be rejected with reasons. As per the official announcement, particulars of registered Consent Managers will be made publicly available on the Board’s website. However, the date of declaration is not specified.

ALSO READ: Does Your Company’s AI Usage Comply with India’s IT Act and DPDP Act?

What documents are required for Consent Manager registration under the DPDP framework?

The DPBI has specified 17 mandatory documents that applicants must prepare before submitting their registration applications. These documents cover five areas.

1. Corporate governance documents

Applicants must provide the following documents to establish their legal constitution and governance arrangements:

1. Certificate of Incorporation issued by the Registrar of Companies
2. Memorandum of Association (MoA)
3. Articles of Association (AoA)

The MoA and AoA must contain provisions requiring compliance with the prescribed conflict-of-interest obligations under Items 9 and 10 of Part B of the First Schedule to the DPDP Rules, 2025. Amendments to these provisions require prior approval from the DPBI.

2. Financial documents

Applicants must demonstrate their financial standing through the following documents:

• Audited financial statements for the preceding three financial years or the latest applicable balance sheet.
• Annual turnover certificates for the preceding three financial years, issued by a practising CA.
• Net worth certificate confirming a minimum net worth of INR 20 million, issued by a practising CA.

Companies incorporated less than three years ago may submit the financial statements and turnover certificates available for their operating years. Applicants that have not completed their first financial year must provide a provisional profit and loss statement certified by a practising CA.

3. Technical documentation

The Meity registration guideline mandates submission of a System Architecture Overview documenting the technical design and capabilities of their proposed consent management platform.

The document must cover the following details:

1. Platform architecture and interoperability framework
2. Security safeguards, hosting arrangements and infrastructure
3. Consent lifecycle management
4. Data-blind design
5. Consent record-keeping
6. Platform scalability and availability

The architecture documentation must demonstrate conformity with the applicable obligations under Part B of the First Schedule to the DPDP Rules, 2025.

4. Operational capacity and governance documents

DBPI requires applicants to demonstrate that they have the organisational resources and governance arrangements to operate as Consent Managers.

The mandatory documents include:

• Statement of operational capacity: A statement on the applicant’s letterhead, signed by an authorised signatory, detailing manpower strength, functions and engagement arrangements.
• KMP and senior management details: Qualifications, experience, roles and responsibilities of key managerial personnel and senior management.
• Board governance structure: Details of the board’s composition, committees, directors and their other directorships.
• Conflict-of-interest policy: Procedures for disclosing, preventing and managing conflicts of interest with Data Fiduciaries, including governance oversight.
• Internal audit and compliance monitoring plan: Mechanisms, scope, frequency and responsibilities for reviewing controls, safeguards and regulatory compliance, including reporting outcomes to the Board.
• Business continuity plan: Arrangements for maintaining platform availability, protecting consent records, managing disruptions, implementing backup and disaster recovery measures, and communicating with Data Principals and Data Fiduciaries.
• Business and capability plan: Details of the platform, operational model, fees and grievance redressal process.
• Capital structure statement: Details of authorised, issued and paid-up share capital, promoters and shareholders holding more than 2 per cent of the company’s share capital. Applicants must also disclose relevant shareholdings in other body corporates held by their promoters, directors, KMPs and senior management.

5. Fairness and integrity declarations

Applicants must submit two additional undertakings.

1. Fit-and-proper declaration: Confirmation that the applicant’s directors, KMPs and senior management have a general reputation, a record of fairness and integrity and no regulatory debarment.
2. Declaration on operations in the interests of Data Principals: An undertaking confirming that the applicant will conduct its operations in the interests of Data Principals.

All these documents are mandatory, as specified in the DPBI’s registration checklist.

What are the document submission requirements?

The DPBI has prescribed the following specifications for supporting documents:

Requirement	Specification
Accepted format	PDF, preferably machine-readable
Maximum file size	8 MB per document
Number of mandatory documents	17
Financial statements	Preceding three financial years, subject to the provisions for newer companies
Net worth certification	Minimum INR 20 million, certified by a practising CA

Applicants must also undertake to comply with the conditions under Part A and, following registration, the obligations under Part B of the First Schedule to the DPDP Rules, 2025.

The requirements indicate that registration involves more than meeting the minimum financial threshold.

How can companies apply for Consent Manager registration?

Eligible companies can apply through the DPBI’s online registration portal. The application process involves three preparatory and submission steps.

Step 1: Review the eligibility conditions

Companies should examine the registration requirements under Part A of the First Schedule to the DPDP Rules, 2025, and verify that they meet the prescribed conditions.

Step 2: Prepare the mandatory documents

Applicants should compile all documents in accordance with the Board’s registration readiness checklist. This includes corporate incorporation records, financial statements, technical architecture documentation, governance policies and management declarations.

Step 3: Submit the online application

Companies can access the DPBI’s registration portal, complete the online application form, upload the required documents and submit their applications for assessment.

What happens after DPDP Phase II?

The commencement of Consent Manager registration on 13 November 2026 marks the second phase of India’s DPDP Act implementation. The remaining provisions, including key obligations of Data Fiduciaries, the rights of Data Principals and the DPBI’s inquiry and penalty mechanisms, are scheduled to take effect on 13 May 2027.

Businesses should use this transition period to assess their personal data processing practices, review consent management arrangements and prepare for the next phase of regulatory obligations.

CLICK HERE: India’s DPDP Compliance Deadline Is Approaching: What Businesses Need to Do Before May 2027

Consent manager registration in India– FAQ

1. When did Consent Manager registration begin in India?

The Consent Manager registration framework under the DPDP Act, 2023, came into effect on 13 November 2026. The Data Protection Board of India (DPBI) launched an online portal to facilitate applications from eligible companies.

2. What is the minimum net worth required to register as a Consent Manager?

An applicant must have a minimum net worth of INR 20 million, supported by a certificate issued by a practising Chartered Accountant.

3. Can a foreign company apply for Consent Manager registration in India?

The registration framework specifies that applicants must be companies incorporated in India. A foreign entity that does not meet this local incorporation requirement cannot directly apply for Consent Manager registration in India.

4. How many documents are required for Consent Manager registration?

Applicants must prepare 17 mandatory documents covering corporate governance, financial standing, technical infrastructure, operational capacity, and fairness and integrity.

5. Where can companies apply for Consent Manager registration?

Eligible companies can submit their applications through the DPBI’s online portal.

6. When will the remaining provisions of India’s DPDP Act take effect?

The remaining provisions under the Digital Personal Data Protection (DPDP) Act covering Data Fiduciary obligations, Data Principal rights and the DPBI’s inquiry and penalty mechanisms are scheduled to take effect on 13 May 2027.