Eligible Indian Firms Can Now Apply for Registration as Consent Managers Under DPDP Act

Photo: IANS

New Delhi: The government has opened the registration process for eligible companies seeking to operate as Consent Managers under the Digital Personal Data Protection (DPDP) Act, 2023, in a move aimed at giving citizens greater control over how their personal data is used.

IT Secretary S. Krishnan on Saturday launched an online portal through which eligible companies can submit applications for registration as Consent Managers.

The initiative is part of the phased implementation of the DPDP framework and marks a step towards establishing a system that allows individuals, referred to as Data Principals under the Act, to manage consent relating to their personal information.

According to the IT Ministry, the framework enables eligible entities to seek registration and prepare to provide consent management services.

Companies incorporated in India with adequate technical, operational and financial capabilities can apply, provided they have a net worth of at least Rs 2 crore. These eligibility conditions are intended to ensure that registered entities have the resources to deliver secure, reliable and accountable services.

Applications can be submitted to the Data Protection Board of India through the newly launched portal. The Board will examine each application against the prescribed requirements before granting registration to qualifying companies. The names of registered Consent Managers will be published on the Board’s website.

A Consent Manager is an entity registered with the Data Protection Board that provides an accessible, transparent and interoperable platform for individuals to give, review, manage and withdraw consent for the processing of their personal data.

The framework is designed to strengthen trust and accountability in India's digital ecosystem, with registered Consent Managers being accountable to the individuals whose data they help manage.

Other key provisions of the DPDP Act, covering the rights of Data Principals, obligations of Data Fiduciaries, and the Board’s inquiry and penalty mechanisms, are scheduled to come into force on May 13, 2027.