India Opens Consent Manager Registration Portal With ₹2 Crore Minimum Net Worth Requirement

India has opened an online registration portal for companies seeking to become Consent Managers under its Digital Personal Data Protection (DPDP) framework. Applicants must have a net worth of at least ₹2 crore, although that financial threshold is only one of several conditions they must satisfy before being registered.

The registration framework took effect on November 13, 2026. The Ministry of Electronics and Information Technology (MeitY) announced on November 14 that Secretary S. Krishnan had launched the portal at dpbi.gov.in, allowing eligible Indian companies to apply to the Data Protection Board of India. The government announcement says the Board will evaluate applications and publish details of companies that qualify.

For individuals, the intended service is a way to handle permissions for the use of personal data through a registered intermediary. A Consent Manager would help people give, review, manage or withdraw consent using an interoperable platform, rather than necessarily dealing with each participating organisation separately. The portal being opened now, however, is for companies applying to offer that service, not an announcement that every consumer can already use one.

This distinction matters for the rollout. Companies can submit applications under the new framework, but the Board retains responsibility for deciding whether they meet the registration conditions. The ministry did not identify any newly approved Consent Managers in its announcement.

The ₹2 crore requirement is a financial floor, not the whole test

Under Rule 4 and the First Schedule of the Digital Personal Data Protection Rules, 2025, an applicant must be a company incorporated in India. Its technical, operational and financial capacity must be sufficient to meet the obligations of a Consent Manager, and its management and financial position must meet prescribed standards.

The ₹2 crore figure is a minimum net-worth requirement, not a government registration fee or a revenue target. The rules define net worth for this purpose as total assets less liabilities shown in the applicant’s books. A company cannot qualify merely by reporting annual sales above that amount if it does not meet the required balance-sheet measure.

Regulators may also examine whether an applicant has an adequate business outlook and capital structure, and whether its directors and senior management have a sound record of fairness and integrity. The proposed operations must serve the interests of the people whose personal data is involved. Corporate documents must also contain safeguards dealing with the conflicts of interest addressed by the rules.

An independent certification requirement makes this more than a financial eligibility exercise. The applicant’s interoperable platform must be certified against the data-protection standards and assurance framework the Board may publish, and appropriate technical and organisational measures must be in place. The wording leaves room for the Board’s published standards to shape what prospective providers must demonstrate.

An application is subject to the Board’s assessment, including inquiries it considers necessary. Rule 4 allows the Board to register a qualifying company and publish its details, or reject an applicant and communicate the reasons. Registration would therefore represent a regulatory decision, not simply completion of an online form.

Consent services come with strict limits on data access

Consent Managers are meant to administer permissions without reading the underlying personal data they help users share. The First Schedule requires that information made available or transferred through the arrangement must not be readable by the Consent Manager itself. That separation is central to the model: the intermediary handles the consent process, while the participating data fiduciaries handle the personal data.

The rules illustrate the mechanics with a banking example. A person could use a Consent Manager’s platform to authorise access to a bank statement, including where the statement is held by one participating bank and requested by another. It is an example of how the system is designed to work, not a claim that any particular bank or service has already connected to a registered platform.

Record-keeping is another explicit obligation. A Consent Manager must maintain records of consent given, denied or withdrawn, the notices linked to those requests and relevant sharing of personal data. Individuals must be able to access the records, and may request information in a machine-readable form under the terms of service. The records generally have to be retained for at least seven years, subject to longer periods agreed with the user or required by law.

Providers must offer their services through a website or app, maintain reasonable security safeguards and act in a fiduciary capacity toward the individuals using them. The rules prohibit subcontracting or assigning the performance of their statutory obligations. They also require measures to prevent conflicts of interest involving the data fiduciaries served by the platform, including relationships involving directors, senior executives and financial interests.

Transparency extends to ownership and governance. Registered Consent Managers must make specified information about promoters and leadership accessible, along with details of shareholders holding more than 2% and certain other financial interests. They must maintain audit mechanisms and report on compliance to the Board. A transfer of control by sale, merger or other means requires the Board’s prior approval.

These obligations give the regulator continuing oversight after the initial application. Where requirements are not met, Rule 4 provides for directions to correct non-compliance and, after an opportunity to be heard and reasons recorded in writing, suspension or cancellation of registration where necessary to protect individuals.

Registration begins ahead of the next DPDP compliance phase

The portal launch fits into India’s staged introduction of the DPDP regime. The law was enacted in 2023, while the implementing rules were notified on November 13, 2025. Those rules scheduled the Consent Manager registration provisions to take effect one year later, ahead of a wider set of requirements eighteen months after the notification.

According to MeitY’s November 14 announcement, important provisions covering individuals’ data rights, obligations for organisations that determine how personal data is processed, and the Board’s inquiry and penalty processes are scheduled to come into effect on May 13, 2027. Opening registration now gives prospective Consent Managers a route to seek approval before that larger phase, but does not mean the rest of the framework has already taken effect.

The new process applies to firms seeking the specific regulated role of Consent Manager. It should not be confused with a general registration requirement for every business handling personal information, or with the consent choices that individuals will ultimately exercise through approved services. The rules establish separate duties for those who determine the purposes of data processing and those who provide the consent-management platform.

For companies considering an application, the published conditions point to practical questions beyond financing: whether the platform can interoperate with participating organisations, how it will keep personal data unreadable to the intermediary, and whether ownership and management arrangements can satisfy conflict-of-interest restrictions. The Board’s eventual publication of registered providers will show which applicants have cleared those checks.