India's Digital Personal Data Protection (DPDP) framework introduces a new role in the way individuals manage their personal information: the Consent Manager.
The idea is straightforward. Individuals should have a way to give, review, manage and withdraw consent for the processing of their personal data through a platform they can access and control.
For businesses looking to operate in this space, however, the opportunity comes with specific regulatory, technical, financial and governance responsibilities.
The Digital Personal Data Protection Rules, 2025, set out the conditions for registration, the responsibilities of a Consent Manager and the documentation applicants need to prepare. With Rule 4 coming into effect on 13 November 2026, organisations considering registration should start by understanding what the process actually involves.
What is a Consent Manager under the DPDP Act?
Under the DPDP Act, a Consent Manager is a person registered with the Data Protection Board of India who provides a platform through which a Data Principal can give, manage, review and withdraw consent.
In practical terms, consider an individual who wants to share personal information with a bank or another service provider.
Instead of managing every consent interaction separately, the individual can use a Consent Manager's platform to provide or withdraw consent. The platform acts as an accessible interface between the individual and the Data Fiduciary.
However, the role is not simply to collect consent on behalf of businesses.
A Consent Manager must act in a fiduciary capacity towards the Data Principal, avoid conflicts of interest and ensure that the individual's personal data remains protected. The Rules also require the platform to be interoperable and designed so that the Consent Manager cannot read the contents of personal data being shared.
This distinction is important because the Consent Manager is expected to operate in the interests of the individual, rather than function as an extension of the Data Fiduciary.
Understanding the Consent Manager Registration process is therefore important for organisations planning to enter this space and demonstrate their readiness to meet the requirements under the DPDP framework.
Consent Manager Eligibility Criteria: Who Can Apply?
Not every organisation can apply simply because it has developed a consent management solution.
Part A of the First Schedule of the DPDP Rules, 2025, specifies the eligibility conditions that applicants must meet.
An applicant must:
1. Be a company incorporated in India
The applicant must be an Indian-incorporated company.
2. Demonstrate sufficient operational, technical and financial capacity
The organisation must demonstrate that it has the resources and capabilities required to fulfil its responsibilities as a Consent Manager.
3. Have a sound financial position and management
The financial condition of the applicant and the general character of its management must be sound.
4. Maintain a minimum net worth of ₹2 crore
The applicant must have a net worth of at least ₹2 crore. Under the Rules, net worth is calculated as the aggregate value of total assets reduced by liabilities, as reflected in the company's books of accounts.
5. Demonstrate adequate business prospects
The expected volume of business, capital structure and earning prospects must be adequate.
6. Have suitable leadership
Directors, Key Managerial Personnel (KMPs) and senior management must have a general reputation and a record of fairness and integrity.
7. Address conflict-of-interest requirements in the company's constitutional documents
The Memorandum of Association (MoA) and Articles of Association (AoA) must contain provisions requiring adherence to the applicable conflict-of-interest obligations. Changes to these provisions require prior approval of the Board.
8. Ensure that proposed operations serve the interests of Data Principals
The proposed business and operating model must be designed in the interests of individuals whose consent is being managed.
9. Obtain independent certification of the platform
The interoperable platform must be independently certified against the data protection standards and assurance framework published by the Board. Appropriate technical and organisational measures must also be in place.
These are registration conditions, not merely recommendations. Applicants should evaluate each one before beginning the application process.
Conditions for registration of Consent Manager
Documents Required for DPDP Consent Manager Registration
Meeting the eligibility conditions is only one part of the process. Applicants must also demonstrate their readiness through supporting documentation.
The Data Protection Board of India's prerequisite document checklist groups the requirements across governance, financial, technical, operational and integrity-related areas.
Here is what organisations should prepare.
1. Governance documentation
The first set of documents establishes the applicant's legal identity and corporate governance arrangements.
-
Certificate of Incorporation
-
Memorandum of Association (MoA)
-
Articles of Association (AoA)
The MoA and AoA require particular attention. They must include the relevant conflict-of-interest provisions specified under the Rules, including the requirement for prior Board approval before amending those provisions.
2. Financial documentation
Applicants need to demonstrate that they meet the financial requirements and have the resources to operate as a Consent Manager.
The documents include:
-
Audited financial statements or balance sheets for the last three financial years, or all available financial statements for companies incorporated more recently.
-
Annual turnover certificates for the last three financial years, issued by a practising Chartered Accountant.
-
Net worth certificate confirming a minimum net worth of ₹2 crore, issued by a practising Chartered Accountant.
The checklist also specifies alternative documentation for organisations that have not completed their first financial year or do not have audited financial statements.
3. Technical documentation
A Consent Manager's platform is central to its responsibilities. Therefore, its technical architecture needs to be clearly documented.
The applicant must submit a System Architecture Overview Document covering:
-
Platform overview
-
Interoperability framework
-
Security safeguards
-
Hosting and infrastructure
-
Consent lifecycle
-
Data-blind design
-
Record-keeping
-
Scalability and availability
The architecture should demonstrate how the platform will support the Consent Manager's obligations under the First Schedule.
4. Operational capacity and governance documentation
Applicants must also establish that they have the people, processes and management structure required to operate effectively.
The checklist includes:
-
Statement of Operational Capacity
-
Description of Key Managerial Personnel and Senior Management
-
Governance Structure and Constitution of the Applicant's Board
-
Conflict-of-Interest Policy
-
Internal Audit and Compliance Monitoring Plan
-
Business Continuity Plan
-
Business and Capability Plan
-
Capital Structure
These documents are particularly important because the Board needs to assess more than the applicant's technology. It also needs to understand how the organisation will manage its operations, responsibilities, risks and continuity.
5. Fairness and integrity documentation
The checklist also requires a Fit and Proper Declaration.
This is an undertaking concerning the general reputation, fairness and integrity of the applicant's directors, KMPs and senior management, including the absence of regulatory debarment.
A note on the document checklist: The supplied three-page prerequisite PDF states that there are 17 mandatory documents, but the copy provided displays numbered items 1–16. Applicants should verify the complete current checklist on the Board's registration portal before submission.
The Board specifies PDF as the accepted format, preferably machine-readable, with a maximum file size of 8 MB per document. Documents marked mandatory must be provided.
Consent Manager Responsibilities Under the DPDP Act
An organisation's responsibilities do not end once it receives registration.
Part B of the First Schedule sets out the obligations that a registered Consent Manager must continue to fulfil.
Some of the important responsibilities include:
1. Managing consent through an interoperable platform
The platform must allow Data Principals to give consent to Data Fiduciaries onboarded onto the platform, either directly or through another onboarded Data Fiduciary.
2. Maintaining data-blind operations
The manner in which personal data is made available or shared must ensure that its contents are not readable by the Consent Manager.
3. Maintaining consent records
The platform must maintain records of consent given, denied or withdrawn, notices accompanying consent requests and sharing of personal data with recipient Data Fiduciaries.
These records must be accessible to the Data Principal and maintained for at least seven years, or longer where agreed or required by law.
4. Ensuring security and business continuity
The Consent Manager must take reasonable security safeguards to prevent personal data breaches and maintain a website or application as the primary means of providing its services.
5. Managing conflicts of interest
The organisation must avoid conflicts of interest with Data Fiduciaries, including those arising through promoters, directors, KMPs and senior management.
6. Maintaining transparency and audit mechanisms
Information about promoters, directors, KMPs, senior management and specified shareholders must be published in an easily accessible manner. Effective audit mechanisms must also be maintained to periodically review technical and organisational controls, registration conditions and regulatory obligations.
These responsibilities make it clear that registration should be treated as the beginning of an ongoing governance and compliance commitment.
How Should Organisations Prepare Before Applying?
For organisations considering this opportunity, preparation should begin with an internal assessment rather than directly moving to application submission.
A practical starting point would be to work through the following areas:
It is also important to ensure that the information provided across different documents is consistent. For example, the business and capability plan should align with the proposed platform architecture, operational capacity and financial projections.
A gap in one area can affect the overall readiness of the application.
What Happens After an Application Is Submitted?
Under Rule 4 of the DPDP Rules, 2025, an eligible applicant may apply to the Data Protection Board of India by submitting the particulars, information and documents specified by the Board.
The Board may conduct an inquiry to satisfy itself that the applicant meets the prescribed conditions.
If satisfied, it may register the applicant and publish its particulars on its website. If it is not satisfied, it may reject the application and communicate the reasons.
Registration should therefore not be treated as automatic upon submission of the required documents. Applicants must be prepared to demonstrate that their organisation meets the conditions in practice.
The Board also has powers to require information, direct corrective measures and, where necessary in the interests of Data Principals, suspend or cancel registration after providing an opportunity of being heard.
Getting Consent Manager Registration Right
Registering as a Consent Manager is a significant step in India's evolving data protection ecosystem. It also places considerable responsibility on the organisation seeking registration.
A technically capable platform alone may not be sufficient. Applicants need to demonstrate financial strength, appropriate governance, operational capability, independent certification and a clear commitment to protecting the interests of Data Principals.
For organisations considering this role, the immediate priority should be to assess eligibility, review the corporate structure, evaluate platform readiness and prepare the supporting documentation well in advance.
The registration process begins with an application, but the responsibility begins with being ready to fulfil the role.
For organisations exploring Consent Manager registration, a structured review of technical architecture, security safeguards, governance arrangements and compliance documentation can help identify areas requiring attention before application submission.
