Consent Manager registration: who should register and the ₹2 crore rule
Registration opens around 13 November 2026. If you plan to operate a Consent Manager, the eligibility bar is high — and the prep work starts now.
What a Consent Manager is — and is not
The DPDP framework introduces a new institutional role: the Consent Manager. It is a registered, accountable intermediary that acts as a single point of contact through which a data principal can give consent, see where their consent is active, and withdraw it across many Data Fiduciaries at once. Think of it as a consent dashboard for the individual, sitting between people and the organisations that process their data.
It is important to be clear about who this concerns. Being a Data Fiduciary that obtains consent does not make you a Consent Manager. The Consent Manager is a separate, regulated business that other organisations and individuals rely on to broker and record consent. Most companies will use or integrate with Consent Managers rather than become one.
The registration timeline
The DPDP Rules 2025 follow a phased rollout. The Data Protection Board and the administrative and penalty provisions are already in force. The Consent Manager registration pathway is expected to open around 13 November 2026 — twelve months into the transition — ahead of the broader substantive obligations that become enforceable on 13 May 2027. For anyone intending to operate as a Consent Manager, that November 2026 date is the milestone to plan backwards from.
The eligibility bar
The Rules set conditions designed to admit only serious, capable operators. The applicant must be a company incorporated in India, which means foreign entities would typically need a local presence before applying. It must demonstrate a minimum net worth of ₹2 crore, signalling financial stability and the ability to manage consent at scale. And it must have the technical infrastructure to securely manage consent artifacts, ensure interoperability across many fiduciaries' systems, and maintain high data-security standards — a requirement that in practice points towards recognised certifications such as ISO 27001 or SOC 2, robust governance, and independent assurance of the platform.
The Board reviews each application against these criteria, may seek clarifications, and registers the company if satisfied. Because the financial and technical thresholds cannot be assembled overnight, organisations that wait until late 2026 to begin preparing risk missing the readiness bar when the window opens.
Why this is a genuine opportunity — for the right players
Consent management is becoming a structural layer of India's digital economy. Every consumer-facing fiduciary will need credible consent capture, records, and withdrawal flows, and many will prefer to plug into a trusted Consent Manager rather than build and defend that machinery themselves. For a well-funded technology company with strong security credentials, registering as a Consent Manager is a path into that layer. For everyone else, the takeaway is simpler: understand how Consent Managers will fit your consent architecture so you can integrate cleanly when the ecosystem goes live.
What to do now
If you are considering registering, start by confirming your corporate structure is India-incorporated, evidencing the ₹2 crore net-worth position, and commissioning the security certifications and interoperability assurance the Board will expect — these are long-lead items. If you are a Data Fiduciary that will merely use a Consent Manager, focus instead on getting your own consent notices, records, and withdrawal flows in order so integration is straightforward.
Frequently asked questions
When does Consent Manager registration open?
Under the phased DPDP Rules 2025 timeline, the Consent Manager registration pathway is expected to open around 13 November 2026 — twelve months after the administrative provisions took effect, and ahead of the 13 May 2027 enforcement of the broader substantive obligations. The Board will publish the application form and required documents on its website.
What are the eligibility requirements to register as a Consent Manager?
The applicant must be a company incorporated in India, demonstrate a minimum net worth of ₹2 crore, and have the technical infrastructure to securely manage consent artifacts with interoperability and strong data security. In practice this points towards recognised security certifications, sound governance, and independent assurance of the platform.
Does my company need to register as a Consent Manager?
Most companies do not. Being a Data Fiduciary that collects consent is different from being a Consent Manager, which is a separate regulated intermediary. The vast majority of organisations will integrate with or rely on registered Consent Managers rather than become one. Only well-capitalised, technically capable businesses that intend to operate consent infrastructure as a service should plan to register.
Plan your Consent Manager strategy
Whether you intend to register or simply integrate, Niti Bharat's free Consent Manager Registration Guide walks through the eligibility criteria, timeline, and readiness steps.
Open the Registration Guide (Free)