Consent Manager Registration Framework Comes into Effect; MeitY Secretary Launches Online Registration Portal

1. At a Glance

• The Consent Manager Registration Framework under the DPDP Act, 2023 came into effect on 13 November 2026. MeitY launched the portal dpbi.gov.in for companies to apply [1].
• A Consent Manager is registered with the Data Protection Board of India (DPBI). It lets Data Principals give, manage, review and withdraw consent on an accessible, transparent and interoperable platform. It is accountable to the Data Principal [1].
• This is one stage in the phased rollout of the DPDP framework. Data Principals' rights, Data Fiduciaries' obligations and the Board's inquiry and penalty processes follow on 13 May 2027 [1].
• UPSC relevance: Right to Privacy, data governance, digital public infrastructure (DPI), and how regulators are designed (GS-II and GS-III).

2. Why in the News

• 13 Nov 2026: the Consent Manager registration framework came into force, and the MeitY Secretary launched the online registration portal dpbi.gov.in [1].
• Only companies incorporated in India with a minimum net worth of ₹2 crore, plus adequate technical, operational and financial capacity, can register [1].
• The trigger comes from the DPDP Rules, 2025, which set an 18-month phased compliance timeline [2].

3. Background & Evolution

• 3 Aug 2023: the DPDP Bill, 2023 was introduced in Lok Sabha [4].
• 11 Aug 2023: the Bill received Presidential assent and became Act No. 22 of 2023 [3].
• Nov 2025: the DPDP Rules, 2025 were notified after nationwide consultation, giving full effect to the Act. PIB's backgrounder gives 14 Nov 2025 as the notification date [2].
• Phase I (Nov 2025): a fully digital DPBI with four members was set up. Appeals against the Board go to TDSAT [2].
• Phase II (13 Nov 2026): Consent Manager registration opened on dpbi.gov.in [1].
• Phase III (13 May 2027, scheduled): Data Principals' rights, Data Fiduciaries' obligations, and the Board's inquiry and penalty processes [1].

4. Core Static Facts

Key terms [1]:

• Data Principal: the individual whose personal data it is, and who holds consent rights.
• Data Fiduciary: the entity that handles personal data and carries obligations under the Act.
• Consent Manager: a registered intermediary, accountable to the Data Principal, that runs the consent platform.

5. Multi-Dimensional Analysis

Legal / Constitutional

• Gives statutory form to informational privacy. Consent is at the centre of the framework [1].
• Layered structure: the Act sets the principles, and the Rules (2025) handle operations through phased notification [1][2].
• Appellate review by TDSAT puts an existing tribunal to use rather than creating a new one [2].

Governance / Ethical

• The Consent Manager's duty runs to the Data Principal, not the Fiduciary, which addresses the "consent fatigue" and dark-pattern problems [1].
• A transparent, publicly listed registry of Consent Managers builds trust and accountability [1].
• Concern: the Board is set up by the executive and has only 4 members [2], which raises questions about its independence and capacity.

Economic

• Creates a new regulated market for consent-tech firms. The ₹2 crore net-worth floor [1] filters out under-capitalised entrants but may shut out small start-ups.
• Phased timelines [1][2] give firms time to prepare for compliance before penalties apply.

Scientific / Technological

• The interoperable platform requirement [1] fits India's DPI approach of open, cross-platform consent flows.
• The digital-by-design Board [2] allows online filing, hearings and processing.

Administrative

• Sequencing (Board, then Consent Managers, then rights and penalties) [1][2] avoids enforcement before the institutions exist.
• Bottleneck risk: one small Board handling registration, inquiries and penalties from May 2027 onward [1][2].

6. Recent Developments (last 12–18 months)

• Nov 2025: DPDP Rules, 2025 notified; a 4-member digital DPBI constituted; 18-month phased timeline begins [2].
• 13 Nov 2026: Consent Manager registration framework took effect [1].
• 13 Nov 2026: the MeitY Secretary launched the dpbi.gov.in registration portal [1].
• 13 May 2027 (upcoming): Data Principals' rights, Fiduciaries' obligations and the Board's inquiry and penalty processes take effect [1].

7. Prelims Hooks

• The DPDP Act, 2023 is Act No. 22 of 2023 [3].
• Presidential assent to the DPDP Act: 11 August 2023 [3].
• The DPDP Bill, 2023 was introduced in Lok Sabha on 3 August 2023 [4].
• Consent Managers register with the Data Protection Board of India, not with MeitY directly [1].
• Minimum net worth to register as a Consent Manager: ₹2 crore [1].
• Only companies incorporated in India can register as Consent Managers [1].
• Registration portal: dpbi.gov.in [1].
• Consent Manager framework effective: 13 November 2026 [1].
• Rights, obligations and penalty processes: 13 May 2027 [1].
• The Data Protection Board of India has four members and is fully digital [2].
• Appeals against Board decisions lie to TDSAT [2].
• The DPDP Rules provide 18 months of phased compliance [2].
• A Consent Manager is accountable to the Data Principal [1].
• The DPBI publishes the list of registered Consent Managers on its website [1].

8. The Board That Registers Consent Managers Answers to the Government

• Who picks the referee matters, because the government is also a player
• The central government sets up the Data Protection Board of India (DPBI) [4].
• Board members can be re-appointed [4]. PRS warns that this may affect how independently the Board works [4].

• The reason is simple. A member who wants a second term may hesitate to rule against the government that will decide on that term.

• This matters more here than in most sectors

• Government departments are among the biggest handlers of personal data. In the Act's words, they act as a Data Fiduciary (anyone who collects and uses your personal data).

• A Board that depends on the government for its jobs has to decide complaints that may involve that same government.

• The other side, stated fairly

• The Board's decisions are not final. They can be appealed to TDSAT, an existing tribunal [2].

• But an appeal only fixes a bad decision after it is made. It does nothing about a Board that is too cautious to open an inquiry in the first place.

• A small Board now has a new licensing job

• The Board has 4 members [2]. It must now assess every Consent Manager application and keep the public list of registered firms [1].
• From 13 May 2027, the same 4 members also take on inquiries and penalties [1]. Registration work and enforcement work will compete for the same few people.

9. Why a Consent Dashboard Cannot Stop State Data Use

• A Consent Manager can only manage consent that exists
• Its job is to help you give, review and withdraw consent [1].
• But the Act lets the State skip several of its rules in certain cases, such as national security [4].

• When the State uses data under one of these exemptions, it does not need your consent. So you have nothing to withdraw on any dashboard.

• PRS flags the risk directly

• The exemptions may allow the State to process data without proper checks. That may violate the right to privacy [4].

• The State could also collect and keep more data than the stated purpose needs [4].

• Why this matters for an answer

• The Consent Manager gives the individual real control over private companies.
• It gives almost no control over the State. Any claim that it "shifts power to the individual" holds only for the private side of the data economy.

10. What the RBI Account Aggregator Model Already Teaches

• India has run a consent intermediary before, in finance
• RBI licenses Account Aggregators as a type of NBFC (non-banking financial company). They move your financial data between banks and lenders [5].

• An Account Aggregator cannot fetch, share or transfer your financial data without your explicit consent [5].

• The ₹2 crore floor is copied from that model

• An Account Aggregator needs a minimum net owned fund of ₹2 crore [5]. Net owned fund means the company's own money, after losses are subtracted.

• A Consent Manager needs a minimum net worth of ₹2 crore [1]. So the DPDP framework uses a finance-sector entry bar for all sectors.

• What made the RBI model work: one fixed format for consent

• RBI requires every consent to follow a standard format set out in its Directions [5]. RBI calls this a "consent artefact": a digital record of what data you agreed to share, with whom, and for how long.
• Because every firm uses the same format, one bank can read another firm's consent request.

• The DPDP framework asks for an "interoperable" platform [1]. The sources do not say who sets the common format or what it contains.

• MeitY and the DPBI should publish one consent format, as RBI did

• If each Consent Manager builds its own format, "interoperable" stays only a word.

• The Account Aggregator Directions show how a regulator can write the standard format into the rules themselves [5].

• An open question to watch: one firm, two regulators

• A firm that is both an Account Aggregator and a Consent Manager would answer to RBI [5] and to the DPBI [1].
• The sources do not say how the two sets of rules will fit together. That gap is worth raising in an answer on the regulator's design.

11. Six Months of Registration With No Penalties Behind It

• The licence comes first, the rules that give it force come later
• Consent Managers can register from 13 November 2026 [1].
• The Board's inquiry and penalty powers start only on 13 May 2027 [1].

• In those six months, a registered Consent Manager that fails the Data Principal (the person whose data it is) cannot be put through the Board's penalty process.

• Demand will also be slow at first

• Data Fiduciaries' duties also begin only in May 2027 [1]. Until then, companies have little legal reason to connect to a Consent Manager.

• So new Consent Managers may have a licence but few users.

• How to use the gap well

• The Board can use these six months for the slow, technical work: setting the common consent format and testing whether different platforms can talk to each other.
• Then, when penalties begin, firms will be judged against a clear standard.

12. Anchors for Answers

• Data: ₹2 crore minimum net worth for a Consent Manager [1], the same figure as the ₹2 crore net owned fund floor for an RBI Account Aggregator [5]. A 4-member Board [2] handles registration and, from May 2027, penalties [1].
• Report/Committee: PRS Legislative Brief on the DPDP Bill, 2023. It flags wide State exemptions and Board re-appointment as risks to privacy and independence [4].
• Law/Case: DPDP Act, 2023 (Act No. 22 of 2023) [3]; Justice K.S. Puttaswamy v Union of India (2017), which recognised privacy as a fundamental right.
• Comparison: The RBI Account Aggregator framework fixes one standard consent format in its Directions [5]. The DPDP Consent Manager framework requires "interoperability" but has not yet published a common format [1].

13. Mains Relevance

• GS-II: Government policies and interventions; statutory and regulatory bodies; fundamental rights (privacy).
• GS-III: IT and computers; challenges to internal security through communication networks (data security).
• GS-IV (secondary): ethics of consent, transparency and accountability in governance.
• Question stems: 1. The Consent Manager model seeks to shift the balance of power in the data economy towards the individual. Critically examine in the context of the DPDP framework. (15 marks) 2. Discuss the rationale and challenges of the phased implementation of the Digital Personal Data Protection Act, 2023. (10 marks) 3. Evaluate the institutional design of the Data Protection Board of India with respect to independence, capacity and accountability. (15 marks)

14. Related Topics to Study Next

• Puttaswamy judgment (2017): the constitutional basis of the right to privacy that the DPDP Act puts into practice.
• RBI Account Aggregator framework: an earlier sector-specific consent-manager model in finance.
• DEPA (Data Empowerment and Protection Architecture): the design basis for interoperable consent flows.
• IT Act, 2000 and the proposed Digital India Act: the wider digital regulatory framework alongside DPDP.
• TDSAT: the appellate forum for DPBI decisions [2].
• RTI Act and DPDP interplay: a live debate over limits on disclosure of personal information.
• EU GDPR: a comparative benchmark (consent standards, independent DPAs).
• India Stack / DPI: interoperability principles shared with Aadhaar, UPI and DigiLocker.

15. NCERT Concepts to Revise

• Consent manager (Polity): The central subject: a registered intermediary through which people give, manage and withdraw consent.
• Digital Personal Data Protection Act 2023 (Polity): The parent law whose consent, duties and penalty framework is being rolled out in phases.
• DPDP Rules 2025 (Polity): The rules that set the 18-month phased timeline and the Consent Manager registration conditions.
• Data Protection Board of India (Polity): The body that registers Consent Managers, and later inquires and penalises; its independence and capacity are debated.
• Data principal (Polity): The individual who owns the data and to whom a Consent Manager is accountable.
• Data fiduciary (Polity): The entity handling personal data, whose duties begin in May 2027 and which includes government departments.
• Right to privacy (Polity): The fundamental right that the DPDP framework gives statutory form, with consent at its centre.
• K.S. Puttaswamy case (Polity): The 2017 judgment that made privacy a fundamental right and anchors answers on data protection.
• Account Aggregator (Economy): An earlier RBI consent-based model whose ₹2 crore entry bar and standard consent format the note compares.
• Telecom Disputes Settlement and Appellate Tribunal (Polity): The existing tribunal that hears appeals against Data Protection Board decisions.
• Digital public infrastructure (Polity): The interoperable consent platform fits India's approach of shared public digital systems.
• India Stack (Polity): Consent-based data sharing is a layer of India Stack, alongside Aadhaar, UPI and DigiLocker.

16. Common Errors / Trap Areas

• Registering authority: Consent Managers register with the Data Protection Board, not MeitY. MeitY is the nodal ministry [1].
• Act vs Rules year: the Act is from 2023, the Rules from 2025, and Consent Manager registration from 2026 [1][3]. Don't mix them up.
• Phase confusion: penalties and Data Principal rights are not yet in force. They start on 13 May 2027 [1].
• Accountability direction: the Consent Manager is accountable to the Data Principal, not the Data Fiduciary [1].
• Eligibility: foreign entities and LLPs or individuals don't qualify. Only Indian-incorporated companies with ₹2 crore net worth do [1].
• Notification date of the Rules: PIB says 14 Nov 2025 [2], but the 13 Nov 2026 / 13 May 2027 milestones [1] count from 13 Nov 2025. Use the PIB figures as given.