Consent Managers under the DPDP Act: what the new framework does

Context

PIB (14 November 2026) says the Consent Manager framework is part of the phased implementation of the DPDP framework. MeitY Secretary Shri S. Krishnan launched the portal dpbi.gov.in so that eligible Indian companies can apply to the Data Protection Board of India for registration. The step matters because consent is the base of the DPDP Act, 2023: before a person's data is used, the law expects the person to be able to give consent and to take it back. Registered Consent Managers are meant to make that exercise simple, transparent and interoperable across platforms.

1. Company applies on the portal ↓
2. Board assesses against requirements ↓
3. Qualifying company registered ↓
4. Name placed on public list ↓
5. Consent Manager serves Data Principals

The arguments for the framework

• A Consent Manager lets a Data Principal give, manage, review and withdraw consent through one accessible, transparent and interoperable platform.
• It is accountable to the Data Principal, which the release says strengthens trust and accountability in the digital ecosystem.
• Eligibility needs adequate technical, operational and financial capacity, including a net worth of at least Rs 2 crore, so only capable entities register.
• The list of registered Consent Managers will be public on the Board's website, supporting transparency.

The other side

The release shows that only one part of the law has started. The provisions on the rights of Data Principals, the obligations of Data Fiduciaries, and the Board's inquiry and penalty processes are scheduled to come into effect on 13 May 2027. Until then, consent managers can register but the full rights and penalty provisions are scheduled for a later date. This analysis rests on the official timeline and requirements.

Claim-check table

Essay and ethics use

• Consent is meaningful only when it can be given, reviewed and withdrawn with ease.
• Data fiduciaries hold a duty of trust toward the people whose data they hold.
• Use in essays on digital governance, privacy and trust (GS-II, GS-IV).

Conclusion

The framework starts the operational side of the DPDP regime with a registration route for Consent Managers. The rights, duties and penalty provisions follow on 13 May 2027, so the full picture is still to come. Students should note the date of the framework, the net worth condition and the role of the Board. The balance to watch is between easy consent for citizens and the capacity of registered entities to protect it.