Does your business need to register as a Consent Manager under the DPDP Act? No, not unless you intend to operate as a Consent Manager. Ordinary businesses that collect or process customers’ personal data do not need to obtain Consent Manager registration. They have separate obligations as Data Fiduciaries, organisations that determine why and how personal data is processed.
Consent Manager registration is meant for companies that want to provide a regulated service allowing individuals, known as Data Principals, to give, manage, review and withdraw their consent through a single, accessible and interoperable platform.
The registration framework under Section 6(9) of the Digital Personal Data Protection Act, 2023 (DPDP Act), and Rule 4 of the DPDP Rules, 2025, commenced on 13 November 2026. Eligible companies may apply to the Data Protection Board of India (DPBI), subject to the prescribed registration conditions and the application requirements published by the Board.
However, registration is only one part of the wider DPDP implementation timeline. 13 May 2027 is another important date. Most of the Act’s substantive provisions and the remaining operational rules, including the main obligations applicable to Data Fiduciaries, are scheduled to commence on that date.
For companies planning to become registered Consent Managers, the eligibility requirements are substantial. The applicant must be a company incorporated in India, have a minimum net worth of ₹2 crore, and demonstrate the required technical, operational, financial and governance capabilities.
Meeting this threshold alone does not guarantee eligibility. The company must satisfy all the conditions in Part A of the First Schedule, including management integrity, adequate business prospects, conflict-of-interest safeguards and independent certification of its platform.
This guide explains who needs Consent Manager registration, who is eligible to apply, the reported 17-document checklist, how the DPBI application process works, and what obligations apply after registration.
Consent Manager Registration in India: Quick Facts
The key legal provisions, eligibility requirements and implementation dates at a glance.
| Governing legislation | Digital Personal Data Protection Act, 2023 |
|---|---|
| Registration provision | Section 6(9) |
| Applicable rule | Rule 4, DPDP Rules, 2025 |
| Registration authority | Data Protection Board of India (DPBI) |
| Registration framework commenced | 13 November 2026 |
| Main DPDP compliance commencement | 13 May 2027 |
| Who needs registration? | Companies intending to operate as Consent Managers |
| Eligible applicant | Company incorporated in India |
| Minimum net worth | ₹2 crore |
| Eligibility conditions | First Schedule, Part A |
| Ongoing obligations | First Schedule, Part B |
| Official DPBI website | dpbi.gov.in |
| Reported readiness checklist | 17 documents across five categories |
2. Consent Manager vs. Consent Management Platform vs. Licence
The terms Consent Manager, Consent Management Platform and Consent Manager licence are often used as if they mean the same thing. Under the DPDP Act, they don’t.
2.1 What Is a Consent Manager Under the DPDP Act?
Section 2(g) of the DPDP Act defines a Consent Manager as a person registered with the Data Protection Board of India (DPBI) who acts as a single point of contact. Through an accessible, transparent and interoperable platform, it lets a Data Principal give, manage, review and withdraw consent.
Under Section 6(7), a Data Principal may use a Consent Manager for these purposes. Section 6(8) makes the Consent Manager accountable to the Data Principal and requires it to act on the Data Principal’s behalf, subject to the prescribed obligations. This makes it a regulated role with duties to individuals, not just a software product.
Sections 6(7) and 6(8) are scheduled to commence on 13 May 2027. The registration requirement under Section 6(9) commenced earlier, on 13 November 2026.
2.2 Consent Manager vs. Consent Management Platform (CMP)
A Consent Management Platform is software that businesses use to show privacy notices, collect consent, record preferences and handle withdrawals. A registered Consent Manager is a different thing: a company that has met the prescribed conditions and obtained registration from the DPBI.
| Basis | Consent Management Platform | Registered Consent Manager |
|---|---|---|
| What it is | Software used to manage consent workflows. | A regulated role under the DPDP Act. |
| Main users | Businesses and compliance teams. | Data Principals and participating Data Fiduciaries. |
| Registration with the DPBI | Not required for the software itself. | Required under Section 6(9). |
| Eligibility conditions | Depend on the product and business model. | Must satisfy First Schedule, Part A. |
Can a CMP provider become a registered Consent Manager? Yes, if it meets every condition, including the ₹2 crore net worth, technical and operational capacity, governance safeguards and independent certification of its platform. Selling consent software does not, on its own, make a company a registered Consent Manager. Buyers should not assume that a CMP vendor is registered either. The DPBI is required to publish the particulars of registered Consent Managers on its website, so check there.
2.3 Consent Manager Licence in India: Is a Licence Required?
Many people search for a “Consent Manager licence in India.” The DPDP framework does not use that word. Section 6(9) requires every Consent Manager to be registered with the Board, subject to the prescribed conditions. Rule 4 of the DPDP Rules, 2025 sets out how that registration works, with the eligibility conditions in the First Schedule.
So when someone refers to a Consent Manager licence, they mean DPBI registration. There is no separate licence to obtain.
How does this relate to RBI Account Aggregators? An NBFC-Account Aggregator is regulated separately by the Reserve Bank of India and holds an RBI Certificate of Registration. Consent Managers are registered with the DPBI under the DPDP Act. The two frameworks are separate, though their functions may overlap when financial data is involved. If your platform will handle financial information, take legal advice on how both regimes apply to you.
3. Who Is Eligible to Register as a Consent Manager in India?
Businesses researching a Consent Manager licence in India should first understand the eligibility requirements for formal registration. Under Rule 4 and Part A of the First Schedule of the DPDP Rules, 2025, the applicant must be a company incorporated in India and satisfy all nine prescribed conditions.
Meeting these conditions makes a company eligible to apply. It does not guarantee that the Data Protection Board of India (DPBI) will approve the application. The Board may make its own inquiries before deciding whether the applicant fulfils the requirements.
3.1 The 9 Eligibility Conditions for Consent Manager Registration
The First Schedule, Part A of the DPDP Rules, 2025 sets out the following nine conditions:
| No. | Eligibility condition | What it means for applicants |
|---|---|---|
| 1 | Indian incorporation | The applicant must be a company incorporated in India. |
| 2 | Technical, operational and financial capacity | The company must have sufficient capacity and resources to fulfil its responsibilities as a Consent Manager. |
| 3 | Sound financial condition and management | The company’s financial condition and the general character of its management must be sound. |
| 4 | Minimum net worth of ₹2 crore | The applicant must have a net worth of at least ₹2 crore. |
| 5 | Adequate business prospects and capital structure | The likely volume of business, capital structure and earning prospects must be adequate. |
| 6 | Management reputation and integrity | Directors, Key Managerial Personnel (KMP) and senior management must have a general reputation and record of fairness and integrity. |
| 7 | Conflict-of-interest provisions | The company’s Memorandum of Association (MoA) and Articles of Association (AoA) must contain provisions to ensure compliance with specified conflict-of-interest obligations. |
| 8 | Protection of Data Principals’ interests | The proposed operations must be in the interests of Data Principals. |
| 9 | Independent platform certification | The interoperable platform and relevant technical and organisational measures must be independently certified against the standards and assurance framework published by the Board. |
These are statutory conditions under Part A of the First Schedule. The Board may make inquiries to determine whether the applicant satisfies them before deciding the application.
3.2 Indian Incorporation and the ₹2 Crore Net-Worth Requirement
The applicant must be a company incorporated in India. A proprietorship, partnership or Limited Liability Partnership (LLP) cannot apply in its own name under this requirement.
The company must also maintain a minimum net worth of ₹2 crore.
The DPDP Rules define net worth as the aggregate value of the company’s total assets minus its liabilities, as appearing in its books of accounts. It is not the same as annual turnover, funding received or the amount available in the company’s bank account.
Important: Meeting the ₹2 crore net-worth requirement alone is not sufficient. The applicant must satisfy all nine eligibility conditions.
For supporting financial documents, applicants should check the information and documents published by the Board under Rule 4. Financial statements and supporting Chartered Accountant (CA) certifications may be relevant to demonstrating compliance with the financial requirements.
The specific document requirements are covered in Section 5: The 17-Document Readiness Checklist. Treat that checklist as an application-preparation aid and verify it against the latest instructions published by the Board.
3.3 MoA, AoA and Conflict-of-Interest Clauses
One requirement that company founders and legal teams should pay particular attention to is the company’s constitutional documents: the Memorandum of Association (MoA) and Articles of Association (AoA).
Under Part A, Condition 7, these documents must contain provisions requiring compliance with Part B, Items 9 and 10. They must also provide for policies and procedures to ensure those obligations are followed. These provisions can be amended only with the Board’s prior approval.
The two obligations address different aspects of conflict of interest:
- Part B, Item 9: Conflicts with Data Fiduciaries. The Consent Manager must avoid conflicts of interest with Data Fiduciaries, including conflicts involving their promoters and Key Managerial Personnel.
- Part B, Item 10: Interests of the Consent Manager’s leadership. The company must have measures to prevent conflicts arising when its own directors, KMP or senior management hold a directorship, financial interest, employment or beneficial ownership in a Data Fiduciary, or have a material pecuniary relationship with one.
In practical terms, the company should review its existing MoA and AoA before applying. Generic conflict-of-interest language may not be enough if it does not address the specific obligations in Part B, Items 9 and 10.
3.4 Protecting Data Principals’ Interests and Independent Certification
Two further conditions require careful attention when preparing the application.
Condition 8: Operations must serve Data Principals’ interests
The proposed business operations must be in the interests of Data Principals. This means the company’s operating model should demonstrate how it will enable individuals to manage their consent without compromising their interests.
This requirement is closely related to the Consent Manager’s responsibility to act in a fiduciary capacity towards the Data Principal under Part B, Item 8. Applicants should therefore ensure that their operational policies and supporting declarations clearly explain how they will protect Data Principals’ interests.
Condition 9: Independent certification of the platform
The applicant must obtain independent certification covering two areas:
- Its interoperable platform must be consistent with the data protection standards and assurance framework published by the Board.
- Appropriate technical and organisational measures must be in place to ensure compliance with those standards and framework, and effective observance of Part B, Item 11, which deals with transparency and public disclosures.
This is not simply a routine software audit or a general security certification. The certification must address the requirements specified in the First Schedule.
Check the latest position before applying: The availability and current version of the Board’s published technical standards and assurance framework should be verified directly on the DPBI website. Do not assume that a general security certificate or an existing platform audit automatically meets this requirement.
Applicants should confirm the applicable certification process and supporting evidence before proceeding with the application.
For a practical breakdown of the financial, governance, technical and operational documents to prepare, see Section 5: The 17-Document Readiness Checklist.
4. Startups, LLPs and Foreign Companies: Can They Apply for Consent Manager Registration?
The DPDP Rules do not provide a separate registration category or exemption for startups, LLPs or foreign companies. The key requirement is that the applicant must be a company incorporated in India and must satisfy all nine eligibility conditions under Part A of the First Schedule.
Here is how this requirement applies to different business structures.
4.1 Can an Indian Startup Register as a Consent Manager?
Startup recognition or DPIIT registration does not provide an exemption from these requirements. The company must meet the same eligibility conditions as any other applicant.
4.2 Can an LLP Apply for Consent Manager Registration?
The application would need to be made by that Indian-incorporated company, which must independently satisfy all nine eligibility conditions.
4.3 Can a Foreign Company Apply?
The Rules do not, in this condition, set out a separate eligibility test for foreign shareholders. Any proposed foreign investment or ownership structure should be reviewed separately for compliance with applicable Indian company and foreign investment laws.
4.4 Can an Existing CMP Provider Apply?
Merely offering consent-management software to businesses does not automatically make the provider a registered Consent Manager. Registration is required for the regulated Consent Manager role, not simply for providing CMP software.
5. The 17-Document Readiness Checklist for Consent Manager Registration
The DPBI portal’s reported Check Readiness checklist contains 17 documents grouped into five categories: governance, financial, technical, operational capacity, and fairness and integrity.
These documents help demonstrate that the applicant meets the eligibility conditions under Part A of the First Schedule and has the capacity to fulfil its responsibilities as a Consent Manager.
5.1 Complete List of 17 Documents
| No. | Group | Document | What to Prepare |
|---|---|---|---|
| 1 | Governance | Certificate of Incorporation | A copy of the company’s Certificate of Incorporation issued by the Registrar of Companies (RoC). |
| 2 | Governance | Memorandum of Association (MoA) | The company’s current MoA, containing the required provisions relating to conflict-of-interest obligations. |
| 3 | Governance | Articles of Association (AoA) | The company’s current AoA, containing the required provisions relating to conflict-of-interest obligations. |
| 4 | Financial | Audited financial statements | Audited financial statements for the last three financial years, where available. |
| 5 | Financial | Annual turnover certificates | Certificates from a practising Chartered Accountant (CA) confirming the company’s annual turnover for the last three financial years. |
| 6 | Financial | Net-worth certificate | A certificate from a practising CA confirming that the company’s net worth is at least ₹2 crore. |
| 7 | Technical | System architecture overview | A technical overview covering interoperability, security safeguards, hosting and infrastructure, consent lifecycle, data-blind design, record-keeping and availability. |
| 8 | Operational capacity | Statement of operational capacity | A statement explaining the company’s capacity to perform its responsibilities as a Consent Manager. |
| 9 | Operational capacity | Description of KMP and senior management | Details of the company’s Key Managerial Personnel (KMP) and senior management. |
| 10 | Operational capacity | Governance structure and Board constitution | Details of the company’s governance structure and constitution of its Board. |
| 11 | Operational capacity | Conflict-of-interest policy | The company’s policy for identifying, preventing and managing conflicts of interest. |
| 12 | Operational capacity | Internal audit and compliance monitoring plan | A plan explaining how internal audits and compliance monitoring will be carried out. |
| 13 | Operational capacity | Business continuity plan | A plan explaining how the company will maintain or restore essential operations during disruptions. |
| 14 | Operational capacity | Business and capability plan | The company’s business and capability plan. |
| 15 | Operational capacity | Capital structure | Details of the company’s capital structure, including promoters and every shareholder holding more than 2% of its share capital. |
| 16 | Fairness and integrity | Fit and proper declaration | A declaration covering the directors, KMP and senior management. |
| 17 | Fairness and integrity | Declaration on Data Principals’ interests | A declaration confirming that the company’s proposed operations will be conducted in the interests of Data Principals. |
The five categories contain three governance documents, three financial documents, one technical document, eight operational capacity documents and two fairness and integrity documents.
5.2 Important Notes Before Preparing the Documents
Financial documents for newer companies
The reported portal guidance provides flexibility for companies that have not completed three financial years:
- Companies operating for less than three years can submit the financial statements available since incorporation.
- Companies that have not completed their first financial year can submit a provisional Profit and Loss (P&L) statement certified by a practising CA.
MoA and AoA review
Before submitting the application, have your company secretary or legal adviser review the MoA and AoA against the requirements in Part A, Condition 7. The documents must address the conflict-of-interest obligations under Part B, Items 9 and 10, and the relevant provisions can be amended only with the Board’s prior approval.
Capital structure and the 2% shareholder disclosure
The reported application checklist asks for the company’s capital structure, including promoters and every shareholder holding more than 2% of the share capital.
This application disclosure should not be confused with a separate ongoing obligation. Under Part B, Item 11, a registered Consent Manager must also publish specified ownership and management information, including details of every person holding more than 2% of its shares, in an easily accessible manner on its website or app. The disclosure obligation applies after registration and is broader than simply submitting the capital structure document.
5.3 Independent Platform Certification: An Additional Requirement to Verify
There is an important requirement that applicants should not overlook.
- The platform complies with the data protection standards and assurance framework published by the Board.
- Appropriate technical and organisational measures are in place to follow those standards and framework and effectively observe Part B, Item 11.
However, the reported 17-document checklist does not list a separate document titled “Independent Certification Report”.
This means applicants should verify whether the certification is requested separately in the online application form or through additional instructions from the Board.
What about the technical standards?
As of 14 November 2026, reports indicated that the Board’s technical standards and assurance framework had not yet been published. This status may change, so check the DPBI website for the latest publication before arranging certification.
5.4 Pre-Application Sign-Off
Before starting the online application, make sure your team has completed these checks:
- All 17 documents are prepared in the latest format specified by the DPBI portal.
- The financial statements and CA certificates are available and consistent with the company’s records.
- The MoA, AoA and conflict-of-interest policy have been reviewed together.
- The capital structure and declarations are accurate and up to date.
- The independent certification requirement and the latest Board-published standards have been checked.
Once the documents are ready, the next step is to complete the readiness check and submit the application through the DPBI portal.
6. Technical and Data-Blind Architecture Requirements for a Consent Manager
A Consent Manager is not simply a website where users accept or reject consent requests. It must operate an interoperable platform that allows Data Principals to give, manage, review and withdraw consent while ensuring that the Consent Manager cannot read the contents of the personal data it facilitates sharing.
The DPDP Rules, 2025 establish these requirements under Part A, Condition 9 and Part B of the First Schedule. Applicants should therefore consider technical compliance while designing their platform, rather than treating it as a feature to add after development.
6.1 What Is an Interoperable Consent Management Platform?
Interoperability means that different systems can communicate and work with each other through compatible processes and technical arrangements.
For a Consent Manager, this means its platform must enable a Data Principal to give consent to a Data Fiduciary onboarded onto the platform. Consent can be given directly to that Data Fiduciary or routed through another onboarded Data Fiduciary that maintains the individual’s personal data with their consent.
Example:
Suppose an individual maintains a bank account with Bank A and wants to share their bank statement with Bank B.
- Bank B sends a consent request through the Consent Manager’s platform.
- The individual reviews the request and decides whether to give consent.
- The Consent Manager facilitates the consent and sharing instruction.
- Bank A makes the authorised bank statement available to Bank B.
The Consent Manager facilitates the interaction but must not be able to read the contents of the bank statement. This direct or routed consent mechanism follows the illustration in Part B, Item 1 of the First Schedule.
For a practical comparison of consent management solutions available in India, see our guide to Top Consent Management Platforms (CMPs) in India for 2026.
As an additional technical reference, engineers may study the ReBIT specifications developed for the Account Aggregator ecosystem. They can offer useful insights into interoperable financial data-sharing systems, but they are not automatically mandatory technical standards under the DPDP Rules.
6.2 Data-Blind Architecture: The Consent Manager Must Not Read Personal Data
Part B, Item 2 requires the Consent Manager to ensure that the manner in which personal data is made available or shared is such that its contents are not readable by the Consent Manager.
The expression data-blind architecture is a commonly used shorthand for this requirement; it is not the wording used in the Rules.
For example, if an individual authorises the sharing of a bank statement, the Consent Manager may facilitate the consent and sharing process, but must not be able to read the account balance, transaction history or other contents of that statement.
Practical design considerations include:
- Separating consent-related records from the underlying personal data being shared.
- Designing system access so that platform personnel and systems cannot read the contents of shared personal data.
- Ensuring that the sharing mechanism does not expose the actual data to the Consent Manager.
Encryption and anonymisation are two different techniques that may be relevant to data protection. Read our explanation of Anonymization vs. Encryption to understand the distinction.
6.3 Consent Lifecycle and Record Management
The platform must support the entire consent lifecycle, rather than simply providing an initial consent button.
| Activity | What the Platform Should Enable |
|---|---|
| Give consent | Allow an individual to review a request and provide consent. |
| Deny consent | Record when an individual chooses not to approve a request. |
| Review consent | Allow individuals to review their existing consent decisions. |
| Manage consent | Provide access to relevant consent records and information. |
| Withdraw consent | Allow individuals to withdraw previously granted consent. |
Under Part B, Item 3, the Consent Manager must maintain records of:
- Consents given, denied or withdrawn.
- Notices preceding or accompanying consent requests.
- Sharing of personal data with a transferee Data Fiduciary.
Part B, Item 4 further requires the Consent Manager to:
- Give the Data Principal access to these records.
- Make the information contained in the records available in machine-readable form when requested, in accordance with its terms of service.
- Retain the records for at least seven years, or longer where agreed with the Data Principal or required by law.
Metadata (information describing an activity, such as when consent was given or withdrawn) can help establish traceability and accountability. Read more in our article on The Silent Role of Metadata in Consent Management and DPDP Enforcement.
6.4 Security Safeguards and Platform Availability
Under Part B, Item 7, a Consent Manager must take reasonable security safeguards to prevent personal data breaches.
Part B, Item 5 also requires the Consent Manager to develop and maintain a website, app or both as the primary means through which Data Principals access its services.
Practical measures to consider include:
- Access controls: Restrict access to platform systems and administrative functions to authorised users.
- Secure communication: Protect information exchanged between the Consent Manager and connected systems.
- Monitoring and logging: Maintain appropriate records of platform activities and security events.
- Availability and recovery: Plan for service disruptions, backups and restoration of essential services.
- Security testing: Assess the platform for vulnerabilities and address identified weaknesses.
6.5 Independent Certification: What Does the Rule Actually Require?
Part A, Condition 9 requires independent certification of two aspects:
- The interoperable platform used by Data Principals to give, manage, review and withdraw consent must be consistent with the data protection standards and assurance framework published by the Board.
- Appropriate technical and organisational measures must be in place to ensure adherence to those standards and framework and effective observance of the obligations under Part B, Item 11.
Why is Item 11 relevant?
Part B, Item 11 requires a registered Consent Manager to publish specified information on its website or app in an easily accessible manner. This includes details of its promoters, directors, Key Managerial Personnel, senior management, shareholders holding more than 2% of its shares, and certain shareholdings in other entities.
What about the Board’s technical standards?
The Rules make the certification requirement dependent on the data protection standards and assurance framework published by the Board on its website from time to time. Applicants should check the DPBI website for the latest publication and any certification instructions before finalising their platform architecture.
For more information about the Board’s role, registration framework and regulatory responsibilities, read our main guide: The Data Protection Board of India.
6.6 What Should Your Technical Architecture Document Cover?
The system architecture overview submitted with the application should explain how the platform addresses the relevant statutory requirements.
| Architecture Area | What to Explain |
|---|---|
| Platform design | How Data Principals access and use the website or app. |
| Interoperability | How the platform connects with onboarded Data Fiduciaries and facilitates direct or routed consent. |
| Data-blind mechanism | How the platform ensures that shared personal data is not readable by the Consent Manager. |
| Consent lifecycle | How consent can be given, denied, reviewed, managed and withdrawn. |
| Record management | How consent decisions, notices and sharing activities are recorded and made accessible. |
| Security controls | How reasonable safeguards are implemented to prevent personal data breaches. |
| Infrastructure and availability | How the platform is hosted, maintained and kept accessible. |
| Certification readiness | How the platform will be assessed against the Board’s published standards and assurance framework. |
These are recommended areas to explain in the architecture document, not a statutory list of mandatory technologies.
A Consent Manager should be able to demonstrate how its platform meets the legal requirements through its system design, operating processes and independent certification.
Once the platform and supporting documents are ready, the next step is to understand how to submit the registration application through the DPBI portal.
7. How to Register as a Consent Manager on the DPBI Portal: Step-by-Step Process
The Data Protection Board of India (DPBI) has introduced an online onboarding process for companies seeking registration as Consent Managers under the Digital Personal Data Protection Act, 2023 (DPDP Act).
Unlike a general business registration, this process requires the applicant company to first confirm that it meets specific legal conditions, verify its corporate identity and then submit company information, contact details and supporting documents for the Board’s consideration.
DPBI Consent Manager Registration Portal
The portal displays a four-stage application process:
- Company Details
- Company Contact Person Details
- Documents
- Review & Submit
Here is how to approach each stage.
Step 1: Confirm the Mandatory Eligibility Declarations
Before proceeding with the application, the portal asks the applicant to affirm three conditions:
- The applicant is a company incorporated in India.
- The net worth of the applicant is not less than ₹2 crore.
- The applicant’s Memorandum of Association (MoA) and Articles of Association (AoA) contain provisions requiring compliance with Items 9 and 10 of Part B of the First Schedule of the DPDP Rules, 2025. These provisions must also require suitable policies and procedures to ensure compliance, and can be amended only with the prior approval of the Data Protection Board of India.
If the company does not meet these conditions, it should not make an inaccurate declaration simply to access the next stage.
Step 2: Enter the Corporate Identification Number (CIN) and Verify Through OTP
The applicant is required to enter its Corporate Identification Number (CIN).
The CIN is the unique identification number allotted to a company by the Ministry of Corporate Affairs (MCA) at the time of incorporation.
After entering the CIN, the applicant must complete the OTP verification process.
Keep the company’s corporate details available and ensure that the person handling the application can complete the verification. Use the CIN of the actual applicant company, not the CIN of a parent company, group company or technology partner.
Step 3: Complete the Company Details Section
After CIN verification, the portal opens the first application stage: Company Details.
The screenshot of the live portal reviewed for this guide shows the following fields:
| Field | What the Applicant Should Provide |
|---|---|
| Corporate Identification Number (CIN) | The company’s CIN. |
| GST Number | The company’s GST registration number, where applicable. |
| Company Name | The registered legal name of the applicant company. |
| Date of Incorporation | The company’s official incorporation date. |
| Website URL | The company’s website address. |
| PAN Number | The applicant company’s Permanent Account Number. |
| Registered Address | The company’s registered office address. |
Fields marked with an asterisk (*) are mandatory. In the portal screen reviewed, CIN, company name and date of incorporation are marked as mandatory, while GST Number and Website URL are not marked mandatory.
Some corporate information may already appear after CIN verification. Check the displayed details carefully rather than assuming that pre-filled information is correct. Make sure the legal name, PAN, incorporation date and registered address match the company’s official records.
Step 4: Enter Company Contact Person Details
The second stage is Company Contact Person Details.
This section is intended to capture the contact particulars of the person handling the Consent Manager registration application on behalf of the company.
Before proceeding, identify an appropriate authorised contact person and keep their correct contact information available. Use an email address and mobile number that are actively monitored, as application-related communication may need to be handled through these details.
Do not enter an employee’s or consultant’s details without confirming that they are authorised to represent the applicant company for this process.
Step 5: Upload the Required Documents
The third stage is Documents.
This is where the applicant submits the supporting documents required for the registration application. The documents should establish the company’s legal identity, financial position, governance arrangements, management credentials, operational capacity and technical preparedness.
Before uploading, organise the documents using the 17-document readiness checklist in Section 5. This will help ensure that important supporting records are not missed.
Pay particular attention to:
- Whether the uploaded documents are current and legible.
- Whether the company name and CIN are consistent across documents.
- Whether financial figures match the relevant certificates and statements.
- Whether the MoA and AoA contain the required provisions.
- Whether the technical and operational information accurately describes the proposed Consent Manager platform.
Follow the file types, size limits and document-specific instructions displayed on the portal. These requirements can change, so the live application instructions should take precedence over any older checklist.
Step 6: Review the Application and Submit
The fourth and final stage is Review & Submit.
Before submitting, review the information entered in all three previous stages:
- Company Details
- Company Contact Person Details
- Documents
Check for incorrect corporate information, missing documents, inconsistent financial details and incomplete declarations. Correct any errors before making the final submission.
Once satisfied, submit the application through the portal. Save the acknowledgement or application reference generated after submission, along with a copy of the information and documents provided.
Step 7: What Happens After Submitting the Application?
Under Rule 4(2) of the DPDP Rules, 2025, the Board may make inquiries to satisfy itself that the applicant meets the conditions specified in Part A of the First Schedule.
There are two possible outcomes:
If the application is approved: The Board registers the applicant as a Consent Manager, informs the applicant and publishes the particulars of the registered Consent Manager on its website.
If the application is rejected: The Board communicates the reasons for rejection to the applicant.
The applicant should therefore retain its submission records and remain prepared to provide any additional information or clarification requested by the Board.
The Rules do not prescribe a fixed approval period for every application. Avoid relying on an assumed 30-day, 60-day or 90-day registration timeline unless the Board officially publishes one.
Quick Summary: DPBI Consent Manager Registration Process
| Stage | What You Need to Do |
|---|---|
| Eligibility confirmation | Affirm Indian incorporation, minimum ₹2 crore net worth and the required MoA/AoA provisions. |
| CIN verification | Enter the applicant company’s CIN and complete OTP verification. |
| Stage 1: Company Details | Provide and verify corporate information. |
| Stage 2: Contact Person | Enter the authorised company’s contact person’s details. |
| Stage 3: Documents | Upload the required supporting documents. |
| Stage 4: Review & Submit | Check the application and submit it. |
| Board scrutiny | Respond to any inquiry or request for additional information. |
| Final decision | The Board registers the applicant or rejects the application with reasons. |
https://dpbi.gov.in/cm-onboarding
Related reading: Before applying, review the eligibility conditions for Consent Manager registration and the 17-document checklist to understand what your company needs to prepare.
8. Cost of Consent Manager Registration in India
People asking about Consent Manager registration costs often confuse three different things: the fee paid to the Data Protection Board of India (DPBI), the ₹2 crore net-worth requirement and the cost of building and operating a compliant platform.
8.1 Is There a Government Application Fee?
Rule 4 of the DPDP Rules, 2025 does not specify an application or registration fee. It requires applicants to submit the particulars, information and documents specified by the Board.
We have not identified a confirmed official registration fee. Check the DPBI official website for any payment instructions. Do not rely on unofficial websites quoting a fee without referring to an official notification or instruction.
8.2 Is the ₹2 Crore Net Worth a Registration Fee?
Net worth, the difference between a company’s assets and liabilities, is a financial eligibility requirement, not an amount payable to the Board. A company with a net worth of ₹2.5 crore may meet this threshold without transferring any money to the DPBI.
The applicant must demonstrate its financial position through supporting records. The reported portal checklist also includes a net-worth certificate from a practising Chartered Accountant.
8.3 What Should Companies Actually Budget For?
The larger expenses depend on the company’s existing infrastructure, platform and operational readiness.
| Cost Area | What It May Include |
|---|---|
| Legal and corporate | Updating the MoA, AoA, governance policies and declarations. |
| Financial | Audited statements and CA certificates. |
| Platform | Building or upgrading the platform and its interoperability with Data Fiduciaries. |
| Security and audit | Security safeguards, testing, internal audits and compliance monitoring. |
| Independent certification | Assessment against the Board’s standards under Part A, Condition 9. |
| People and operations | Technology, security, legal and compliance staff, hosting and support. |
There is no standard cost for these activities. Independent certification costs, in particular, cannot be reliably estimated until the Board’s applicable standards and assurance framework are confirmed.
Companies comparing existing technology solutions can also read our guide to Consent Management Platforms in India. However, using a CMP does not automatically qualify a company for Consent Manager registration.
Registration is also not the end of compliance. A registered Consent Manager must continue meeting its obligations under Part B of the First Schedule, which means ongoing expenditure on security, audits, operations and compliance.
10. Current Status of the Data Protection Board of India (DPBI): November 2026
The Data Protection Board of India (DPBI) has entered an important phase in the implementation of India’s Digital Personal Data Protection Act, 2023 (DPDP Act). In November 2026, the Board’s official website went live, providing a dedicated online presence for information and Consent Manager registration.
The launch of the website is an important step towards operationalising the Board’s responsibilities under the DPDP framework. Companies intending to register as Consent Managers can now refer to the official DPBI website for registration-related information and application instructions.
Key developments as of November 2026:
- Official website launched: The DPBI website is live at dpbi.gov.in.
- Consent Manager registration opened: The registration provisions under Section 6(9) of the DPDP Act and Rule 4 of the DPDP Rules, 2025, came into force on 13 November 2026.
- Online application facility: Companies can access the online Consent Manager registration process through the Board’s website.
- Readiness checklist: The registration portal provides a checklist of 17 supporting documents to help applicants prepare.
- Application tracking: Applicants can use the CIN-based status-check facility available through the portal.
The website going live does not mean that every part of the DPDP framework is already operational. The implementation timeline is staggered, with most remaining substantive provisions and Rules scheduled to commence on 13 May 2027.
Companies planning to apply should check the official DPBI website for the latest registration instructions, announcements and updates. The portal and its application requirements may change as the Board becomes fully operational.
Frequently Asked Questions About Consent Manager Registration in India
1. Can a Startup Register as a Consent Manager in India?
Yes, if it is a company incorporated in India and meets all nine conditions in Part A of the First Schedule, including the ₹2 crore net-worth requirement. Being a startup does not exempt a company from any condition. The reported portal checklist allows newer companies to submit the financial statements available since incorporation. If the first financial year is not complete, a provisional Profit and Loss statement certified by a practising Chartered Accountant may be submitted. Confirm the latest requirements on the DPBI portal.
2. Can an LLP Become a Registered Consent Manager?
No. The applicant must be a company incorporated in India, so an LLP cannot apply in its own name. An LLP that wants to apply would first need to establish an eligible company structure. Take professional advice on the appropriate legal process.
3. Can a Foreign Company Apply for Consent Manager Registration?
The applicant itself must be a company incorporated in India, so a foreign-incorporated entity cannot apply directly. The Rules do not set out a separate foreign ownership test in this eligibility condition. If foreign investment or ownership is involved, seek legal advice on compliance with applicable Indian company and foreign investment laws.
4. Is There a Registration Fee for Consent Manager Registration?
Rule 4 does not specify an application or registration fee, and we have not identified a confirmed official fee. Check the live DPBI website for any payment instructions. Do not rely on unofficial websites quoting a fee without an official source.
5. How Long Does DPBI Consent Manager Registration Take?
There is no stated registration timeline. Rule 4 allows the Board to examine the application and make inquiries before deciding. We have not identified an officially published processing period. Reports have also indicated that the portal opened before the Board’s membership was fully in place, so it remains unclear how quickly applications will be decided. Applicants should rely on official DPBI announcements rather than assume a fixed approval period.
6. Can an Existing CMP Provider Also Become a Registered Consent Manager?
Yes, if it meets every eligibility condition, including the minimum net worth, technical and operational capacity, the required provisions in its MoA and AoA, and independent certification of its platform. Selling consent-management software does not by itself make a company a registered Consent Manager.
7. What Happens If the DPBI Rejects a Consent Manager Registration Application?
Under Rule 4, if the Board is not satisfied that the applicant meets the eligibility conditions, it may reject the application and communicate the reasons to the applicant. We have not identified a confirmed official appeal or re-application procedure in the material reviewed. If an application is rejected, examine the reasons carefully and seek legal advice on the available options.
