DPDP Consent Manager Registration: Eligibility, Conditions and Application Checklist

Hero Summary

Under India's Digital Personal Data Protection (DPDP) Act, 2023, a Consent Manager is a registered intermediary that gives individuals a single, accessible, and interoperable place to give, manage, review, and withdraw their consent across organizations. The DPDP Rules, 2025 let a company apply to the Data Protection Board of India for registration under Rule 4, which comes into force one year after the Rules were published — in mid-November 2026. To qualify, an applicant must meet the conditions in Part A of the First Schedule, including being an Indian-incorporated company with a net worth of not less than two crore rupees, and must then comply with the ongoing obligations in Part B, such as keeping consent records for at least seven years and avoiding conflicts of interest with data fiduciaries. This guide explains each requirement, the application process, and what the framework means for businesses that are not applying.

Executive Summary

Consent Managers are one of the more unusual features of the DPDP framework: instead of every organization building its own consent screen and every individual managing dozens of separate permissions, the law provides for registered, independent intermediaries that sit on the individual's side. This guide covers who a Consent Manager is, the eligibility conditions, the registration process, the continuing obligations, a practical readiness checklist for would-be applicants, and what ordinary data fiduciaries should do to prepare. It is based on the Act and the Rules as published and as reproduced by legal sources; the official Rules text, the Data Protection Board's own application requirements, and any further notifications are authoritative, and readers should confirm each requirement there before relying on it.

What is a Consent Manager?

The DPDP Act defines a Consent Manager as a person registered with the Data Protection Board who acts as a single point of contact to enable an individual — the "data principal" — to give, manage, review, and withdraw consent through an accessible, transparent, and interoperable platform. The Government of India's explainer on the Rules describes it as an entity that provides a single, transparent, and interoperable platform through which a data principal may give, manage, review, or withdraw consent, and states that Consent Managers must be companies based in India.

The Act also says a Consent Manager is accountable to the data principal and acts on their behalf. In practice this means a registered Consent Manager is meant to be on the individual's side of the relationship, not the organization's. Using one is the individual's choice.

When registration opens

Rule 1 of the DPDP Rules sets out a phased commencement. Rules 1, 2, and 17 to 21 took effect on publication in the Official Gazette; Rule 4, which governs Consent Manager registration, comes into force one year after publication; and most other substantive rules, covering notices, consent, security safeguards, breach intimation, children's data, and rights, come into force eighteen months after publication.

The Rules were notified in November 2025 (G.S.R. 846(E), dated 13 November 2025; the Government's explainer gives 14 November as the notification date), so Rule 4 takes effect in mid-November 2026 — 13 or 14 November, depending on which date counts as the Gazette publication date — and most other duties apply around mid-May 2027. The Rules say a person who meets the conditions may apply to the Board, with the particulars the Board publishes on its website. Public commentary in the months before the commencement date noted that the Board was still being constituted and that an application form and procedure had not been confirmed. Check the Board's website and MeitY and PIB announcements for the current position before preparing an application.

Eligibility: the First Schedule, Part A

Part A of the First Schedule sets the conditions an applicant must meet. As reproduced by legal sources, they are:

Condition	In plain terms
Indian company	The applicant is a company incorporated in India
Capacity	Sufficient technical, operational, and financial capacity to fulfil the obligations of a Consent Manager
Sound condition	Sound financial condition and sound character of management
Net worth	Net worth of not less than two crore rupees
Business viability	Adequate volume of business, capital structure, and earning prospects
Integrity	Directors, key managerial personnel, and senior management with a general reputation of fairness and integrity
Constitutional documents	The memorandum and articles of association contain provisions requiring adherence to key Part B obligations on conflicts of interest, with policies in place, changeable only with the Board's prior approval
Public interest	The proposed operations are in the interests of data principals
Independent certification	An independent certification that the interoperable platform conforms to the technical standards the Board publishes, and that the applicant's technical and organizational measures ensure adherence to Part B requirements

The net worth requirement

The net worth condition is stated as "not less than two crore rupees". Net worth is defined for this purpose as the aggregate value of total assets, reduced by the value of liabilities, as shown in the applicant's books of accounts. A few points:

• Most sources agree on two crore rupees. One source I reviewed gave a higher figure; the figure in the Schedule text as reproduced elsewhere is two crore, and applicants should confirm it against the official Rules text.
• Meeting it does not guarantee registration. The Board assesses all of Part A, not just the financial threshold.
• Plan for it to be met on audited numbers. Because net worth is taken from the books of accounts, keep clean, auditable financial statements ready.

How registration works (Rule 4)

Under Rule 4, as reproduced by legal sources:

1. Application. A person who meets the Part A conditions may apply to the Data Protection Board for registration as a Consent Manager, with the particulars the Board publishes on its website.
2. Inquiry. The Board may make whatever inquiry it considers fit to satisfy itself that the conditions are met.
3. Decision. If satisfied, the Board registers the applicant, informs them, and publishes the Consent Manager's particulars on its website. If not satisfied, it rejects the application and communicates the reasons.
4. Ongoing supervision. A registered Consent Manager must meet the Part B obligations. If it does not, the Board can, after giving an opportunity to be heard, direct it to take corrective measures. Where it considers it necessary in the interests of data principals, the Board can, after a hearing and by a reasoned written order, suspend or cancel registration and give directions to protect data principals.
5. Information requests. The Board can require a Consent Manager to furnish information it calls for.

The text I reviewed sets no fixed deadline for the Board to decide an application, so applicants should not assume one.

Ongoing obligations: the First Schedule, Part B

Registration is the start, not the end. Part B sets continuing obligations, summarized here from legal sources:

• Consent routing platform. Enable a data principal to give, manage, review, and withdraw consent for processing by the data fiduciaries onboarded with the Consent Manager, through an accessible and interoperable platform, with a website or app, or both, as the primary point of access.
• Records. Maintain a record of consents given, denied, or withdrawn, notices relating to them, and the sharing of personal data with transferee data fiduciaries, and keep those records for at least seven years, or longer if agreed with the data principal or required by law.
• Access for the individual. Give data principals access to their records in a machine-readable form.
• Fiduciary duty. Act in a fiduciary capacity in relation to the data principal.
• Data protection of its own. Apply reasonable security safeguards, and structure the platform so the personal data passing through it is not readable by the Consent Manager.
• No sub-contracting of its obligations.
• Conflict of interest. Avoid conflicts of interest with data fiduciaries, including through promoters, directors, key managerial personnel, and senior management holding directorships, financial interests, employment, or beneficial ownership in data fiduciaries.
• Transparency of ownership. Publish its promoters, directors, key managerial personnel, and senior management, and every person holding more than two percent of its shares.
• Audit. Maintain effective audit mechanisms and report to the Board periodically.
• Change of control. Control of the Consent Manager cannot be transferred, by sale, merger, or otherwise, without the Board's prior approval.

Application readiness checklist

For an organization considering applying:

1. Entity. Confirm you are, or will form, a company incorporated in India. A partnership or foreign entity does not qualify.
2. Net worth. Calculate net worth from your books and confirm it meets the threshold with headroom, supported by audited accounts.
3. Governance. Document the board, key managerial personnel, and senior management, with evidence of integrity and good standing.
4. Independence. Map every director, officer, and shareholder interest in any data fiduciary, and remove or manage conflicts. Draft the constitutional-document provisions and policies the Schedule requires.
5. Platform. Design the consent platform for interoperability, with the Board's technical standards in view once published, and plan for the independent certification.
6. Security and architecture. Design so that personal data transiting the platform is not readable by you, with strong security safeguards.
7. Records. Build record-keeping for consents, notices, and data-sharing events with seven-year retention and machine-readable export.
8. Ownership disclosure. Prepare the public disclosure of promoters, directors, management, and holders of more than two percent.
9. Audit. Set up an audit programme and a reporting routine to the Board.
10. Application. Watch for the Board's published application particulars and prepare the supporting documents in advance.
11. Legal review. Have counsel confirm every requirement against the official Rules text and the Board's notices before filing.

What it means for businesses that are not applying

Most organizations will never become Consent Managers, but they are still affected:

• Individuals may route consent through one. A data principal can choose to give, manage, and withdraw consent through a registered Consent Manager, so organizations should plan to interoperate with them rather than assume every consent happens on their own screen.
• Consent records and withdrawal must stay in step. If someone withdraws consent through a Consent Manager, the organization has to honour it across its own systems. That depends on knowing where the data is. See Data Mapping and Records of Processing Under DPDP and DPDP Data Retention and Erasure.
• Using a Consent Manager is not a requirement, and your own notice and consent obligations remain. See Consent Management Under DPDP and the DPDP Compliance Checklist.
• Vendor choices matter. Be careful about describing a tool as a "Consent Manager" unless it is registered with the Board; the Board publishes the particulars of registered ones.

What a Consent Manager is not

• It is not a consent banner or cookie tool that an organization deploys on its own website. A registered Consent Manager is an independent intermediary on the individual's side.
• It is not a certification of an organization's compliance. Using one does not make a data fiduciary compliant.
• It is not the same as a data fiduciary's own consent records, which the data fiduciary must still keep and be able to produce.

How Threat ResQ fits

Threat ResQ does not offer Consent Manager services and is not a Consent Manager. PrivacyIQ, Threat ResQ's privacy management platform, does not manage consent either; its documented capabilities include a data inventory covering data assets, processing activities, and data flows, technical discovery, explainable findings mapped to DPDP obligations, a technical readiness view, evidence, privacy requests, vendor governance, and an incident register. It is a platform that supports a privacy programme: it is not a certifying authority and does not grant or imply a "DPDP compliant" status. Threat ResQ's Compliance Consulting service supports organizations with regulatory readiness.

FAQ

Who can register as a Consent Manager under the DPDP Rules? A company incorporated in India that meets the conditions in Part A of the First Schedule — including sufficient technical, operational, and financial capacity, sound management with integrity, a net worth of not less than two crore rupees, constitutional provisions on conflicts of interest, and independent certification of its platform — and that the Data Protection Board registers after inquiry.

What is the net worth requirement for a Consent Manager? Not less than two crore rupees, calculated as total assets minus liabilities as shown in the applicant's books of accounts. Confirm the figure against the official Rules text, and note that meeting it does not by itself guarantee registration.

When can companies apply to become Consent Managers? Rule 4 comes into force one year after the Rules were published in the Official Gazette, which puts it in mid-November 2026. Check the Data Protection Board's website for its application particulars and procedure.

How long must a Consent Manager keep consent records? At least seven years, or longer if agreed with the data principal or required by law.

Do businesses have to use a Consent Manager? No. Using one is the individual's choice, and organizations remain responsible for their own notice, consent, and withdrawal obligations, so they should plan to work with registered Consent Managers rather than appoint one.