India's Data Protection Law Takes Effect in Phases, Consent Manager Registration Under the DPDP Rules

India’s data protection framework moves from legislation to operation through the Digital Personal Data Protection Rules, 2025, notified as G. S. R. 777(E) in the Gazette of India on 14 November 2025. These Rules give practical effect to the Digital Personal Data Protection Act, 2023, and their commencement is staged, with different provisions taking effect on different dates. One of the most significant operative milestones for the technology sector is the registration regime for consent managers. For technology platforms, privacy-tech vendors and large data fiduciaries, this is a concrete compliance trigger: incorporation in India, a minimum net worth threshold, independent certification of an interoperable platform, and ongoing governance duties.

This explainer sets out who must register, what the eligibility criteria require, the post-registration obligations, and how fiduciaries should prepare for the broader obligations that follow.

Who this is for: in-house counsel, TMT and privacy-tech founders, product and compliance teams in fintech, health and e-commerce, and investors. What you’ll get: step-by-step clarity on consent manager registration, eligibility thresholds, certification and governance requirements, a practical compliance checklist, and a roadmap for the data fiduciary obligations that follow.

Executive summary: what changes and why it matters

The headline is straightforward but consequential. The DPDP Rules, 2025 set out a phased commencement schedule, so that different categories of obligation come into force at different times. The provision dealing with consent manager registration is among the regime’s first operative requirements. This is the point at which indias data protection law starts bite in an operational sense: for the first time, a category of regulated intermediary must satisfy fixed eligibility criteria and register before it can lawfully operate.

The entities most immediately affected are consent-management platforms and privacy-tech vendors that intend to act on behalf of data principals. To qualify, an applicant must be a company incorporated in India, meet a minimum net worth of not less than two crore rupees, and hold independent certification of its interoperable platform, as specified in the First Schedule to the Rules. Large data fiduciaries that plan to rely on registered consent managers for consent capture and management should also treat these developments as a trigger to review their vendor arrangements.

The broader suite of core obligations under the Rules, notice, consent mechanics, breach reporting and data principal rights, follows on a later date under the phased schedule, giving organisations a staggered runway to build compliant systems.

Quick timeline: phased enforcement under the DPDP Rules

The DPDP Rules, 2025 commence different provisions on different dates. Understanding the sequence is essential to planning, because the consent manager regime arrives ahead of the bulk of the substantive fiduciary obligations. The practical takeaway is that privacy-tech vendors and platform builders face an earlier compliance horizon, while data fiduciaries have a slightly longer runway before the core processing obligations apply to them.

• On notification (14 November 2025). Certain foundational provisions of the Rules, including commencement, definitions and specified administrative matters, took effect on notification in the Gazette of India Extraordinary.
• Consent manager registration. The provisions governing registration of consent managers, including the eligibility criteria in the First Schedule, come into force on the date specified in the Rules’ phased commencement schedule. Counsel should confirm the exact date against the Gazette text and MeitY guidance.
• Core fiduciary obligations. The remaining core obligations, covering notice, consent, security safeguards, breach reporting and data principal rights, become operative on a later date under the phased rollout, understood to be approximately 18 months after notification. Verify the precise date against the official text.

Action for counsel: build a monitoring process now. The Data Protection Board of India, the Ministry of Electronics and Information Technology (MeitY) and the Press Information Bureau (PIB) are the authoritative channels for registration portals, forms, technical standards and transitional guidance. Do not assume the Board’s registration infrastructure is live until a government source confirms it, and confirm each commencement date against the Gazette.

Who is a “consent manager”? Legal definition and scope

The Digital Personal Data Protection Act, 2023 defines a “consent manager” as a person registered with the Data Protection Board who acts as a single point of contact to enable a data principal to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform. In commercial terms, these are consent-management platform operators that sit between individuals and the organisations processing their personal data, acting on behalf of the data principal rather than the data fiduciary. The function is designed to give individuals a single, portable interface for the permissions they grant across many services.

The DPDP Rules establish that a person seeking to operate in this capacity must register with the Data Protection Board of India and must satisfy the conditions and obligations set out in the First Schedule. The practical consequence is that consent management in India becomes a regulated, registration-gated activity. You cannot simply launch a consent-management platform and begin acting for data principals; you must first demonstrate that you meet the eligibility conditions and commit to the continuing obligations prescribed in the Schedule.

This is why indias data protection law starts bite so sharply for the privacy-tech sector. Many organisations have built, or are building, consent orchestration tools. Those that wish to act as consent managers in the statutory sense must align their corporate form, capital position, certification and governance with the First Schedule. Product and legal teams should identify at an early stage whether their offering falls within the consent manager definition, because if it does, the registration pathway and its conditions apply in full.

Eligibility and registration requirements: First Schedule, Part A

Part A of the First Schedule sets the conditions an applicant must meet to be registered as a consent manager. These are gating criteria: an applicant that does not satisfy them is not eligible to register, and therefore not entitled to operate in the regulated role. The requirements fall into three broad categories, financial and corporate standing, technical certification, and governance.

Net worth and incorporation requirements under indias data protection law starts bite regime

Two eligibility conditions anchor the financial and corporate test. First, the applicant must be a company incorporated in India. This is a threshold corporate-form requirement and has direct consequences for foreign-owned privacy-tech businesses, which must establish an Indian corporate vehicle to qualify. Second, the First Schedule specifies a minimum net worth of not less than two crore rupees. This capital adequacy filter is intended to ensure that registered consent managers have the financial substance to discharge their duties and bear the responsibilities of acting on behalf of data principals.

For founders and finance teams, the implication is that capitalisation and balance-sheet planning must be completed well before any application. Where a group holds the requisite net worth at parent level but not within the Indian operating entity, restructuring or capital injection may be necessary to meet the threshold within the registered company itself. Counsel should verify the precise computation of net worth against the Gazette text and any subsequent Board guidance before relying on an internal calculation.

Independent certification and technical standards

Beyond financial standing, the First Schedule contemplates certification of the consent manager’s platform and its interoperability. The policy rationale is that consent signals should be portable and machine-readable across the ecosystem, so that a data principal’s choices made through one platform can be recognised and acted upon consistently. A consent platform that cannot demonstrate interoperability would not meet the eligibility standard.

In practice, this means platform builders should treat certification as a procurement and engineering workstream in its own right. That includes identifying recognised certification bodies as and when the Board or MeitY publishes details, scoping the technical standards the platform must satisfy, and commissioning an independent audit against those standards. Because the exact certification mechanics and the identity of accredited certifiers may be clarified through later guidance, teams should build evidentiary records now, architecture documentation, interoperability test results and audit trails, so that certification can be obtained efficiently when the pathway is confirmed.

Governance, board and local presence expectations

Registration as a consent manager is not only a one-off capital and certification exercise; it carries governance expectations consistent with the role of a trusted intermediary. Applicants should expect to demonstrate appropriate board oversight, internal accountability for data principal interests, and the operational capacity to manage consent records and respond to requests. For foreign operators, the incorporation requirement effectively dictates the available routes to compliance.

• Indian subsidiary. Incorporate a wholly owned Indian company that holds the required net worth and seeks registration in its own name.
• Joint venture. Partner with an Indian entity to form a local company that meets the incorporation and capital conditions.
• Local incorporation of the operating business. Where the consent manager function is central, establish and capitalise the Indian operating company directly rather than servicing India from an offshore entity.

For each route, conduct due diligence on net worth computation, certification readiness, data handling expectations and the contractual relationship between the Indian registered entity and any offshore technology provider. Confirm the final requirements against the First Schedule and Board guidance before committing to a structure.

Obligations after registration: First Schedule, Part B

Registration is the beginning, not the end, of a consent manager’s compliance life. Part B of the First Schedule sets out the continuing obligations that apply once a platform is registered. These obligations define the operational discipline that distinguishes a regulated consent manager from an ordinary technology vendor, and they should shape product design, recordkeeping and internal controls.

Acting on behalf of data principals and recordkeeping

A registered consent manager acts in the interests of, and on behalf of, data principals. That fiduciary-flavoured posture informs every downstream obligation. The Schedule contemplates that the consent manager maintain records of consents given, managed and withdrawn, so that there is an auditable account of the permissions flowing through the platform. The records a consent manager keeps are the primary evidence that it has discharged its duties, and they are likely to be central to any supervisory review.

Practically, platforms should design their recordkeeping to capture the data principal’s choices, the fiduciaries to whom consent relates, the scope and purpose of each consent, and the timeline of any changes or withdrawals. Where the Rules prescribe specific record types or retention periods, those must be followed exactly; where they do not, teams should retain records for a period that supports demonstrable accountability and seek local counsel on an appropriate retention policy. Clear, tamper-evident logs are the backbone of this obligation.

Consent portability and interoperability requirements

Interoperability is not merely an eligibility criterion at registration; it is a continuing operational requirement. The consent-management platform must be able to communicate consent signals in a form that other participants in the ecosystem can recognise and act upon. This is what makes consent portability real for the individual, the ability to manage permissions in one place and have those choices honoured across services. Consent managers should therefore maintain and update their interoperability capabilities as standards evolve, and keep their certification current.

Restrictions on data use and permitted acts

A consent manager’s role is to facilitate and manage consent, not to exploit the data that passes through its platform for its own purposes. The Schedule accordingly restricts how a consent manager may use the personal data it handles, confining it to the permitted acts associated with its function. The practical effect is a strict purpose limitation: product and commercial teams must ensure that no secondary monetisation, profiling or unrelated processing creeps into the platform’s design. Building these restrictions into the technical architecture, rather than relying on policy alone, is the most defensible approach.

What a consent manager may and may not do: comparison table

The framework distinguishes between several roles in the data ecosystem, and conflating them is a common source of risk. The table below contrasts the consent manager with the data fiduciary and the data processor across registration, duties, technical controls and liability. It is intended as an orientation aid; the governing detail sits in the DPDP Rules, the First Schedule and the Digital Personal Data Protection Act, 2023.

The essential point is that a consent manager is a distinct, registration-gated role that acts for the individual, whereas a data fiduciary decides why and how personal data is processed, and a data processor merely acts on a fiduciary’s instructions. A fiduciary that relies on a consent manager does not transfer its own statutory responsibilities; it layers a regulated intermediary on top of its own obligations under the Act.

Practical steps for platform-builders and vendors

As indias data protection law starts bite, consent-management platform operators should treat the period before the consent manager provisions commence as a structured readiness programme rather than a last-minute scramble. The eligibility criteria require corporate, financial, technical and governance preparation that cannot be completed overnight.

• Corporate structuring. Confirm or establish an Indian incorporated entity to hold the registration, and resolve any group restructuring needed to house the consent manager function locally.
• Capitalisation. Ensure the registered entity meets the two crore rupee net-worth threshold, with documentation that supports the computation.
• Certification readiness. Scope the technical standards for an interoperable consent platform and prepare the evidence base for independent certification.
• Independent audit procurement. Identify and engage auditors or certification bodies as the accredited pathway becomes clear through Board or MeitY guidance.
• Interoperability testing. Build and test consent portability features so the platform can demonstrate recognised, machine-readable consent signals.
• Legal agreements and terms. Update platform terms, data principal-facing disclosures and fiduciary-facing contracts to reflect the consent manager role and Part B obligations.

Action for product teams: treat interoperability and certification as engineering deliverables with their own milestones. Because the precise certification mechanics may be confirmed through later Board guidance, build contingency into the roadmap so you can respond quickly once the pathway is published, without having to re-architect core systems.

How large data fiduciaries should prepare

While the consent manager regime is among the first triggers, the larger compliance burden for most organisations arrives when the remaining core obligations come into force under the phased schedule. Data fiduciaries, the organisations that decide the purpose and means of processing personal data, should use the window to build and test the systems and documentation these obligations require. The reason indias data protection law starts bite matters to fiduciaries even now is that many of these workstreams depend on arrangements with registered consent managers, which only become available once registrations open.

The core obligations maturing under the later phase broadly cover the provision of clear notice to data principals, lawful consent mechanisms, security safeguards, breach reporting and the fulfilment of data principal rights. The Act and Rules also impose additional obligations on entities classified as Significant Data Fiduciaries, including data protection impact assessments, periodic audits and the appointment of a Data Protection Officer. Translating these into practice involves several parallel workstreams:

• Notice and consent flows. Draft and implement plain-language notices and consent capture journeys that meet the Act’s standards, and align them with any consent manager integration.
• Data protection impact assessments. Conduct DPIAs for higher-risk processing, particularly where Significant Data Fiduciary obligations may apply.
• Breach response playbooks. Establish detection, escalation and reporting processes so that breach notification obligations can be met promptly.
• Data principal rights handling. Build the operational capacity to receive, verify and action access, correction, erasure, nomination and grievance requests.
• Contracts with consent managers. Negotiate service agreements and SLAs with registered consent managers covering recordkeeping, interoperability, security and liability.

Action for counsel: sequence vendor-contract updates so that agreements with consent managers can be executed soon after registrations open, and well before the core obligations take effect. Leaving contract negotiation to the final weeks risks gaps in consent capture and recordkeeping precisely when the obligations become enforceable.

What to watch: the Data Protection Board and next guidance

The Data Protection Board of India is the body with which consent managers must register. At the time of writing, organisations should treat the Board’s operational readiness, including the availability of a registration portal and prescribed forms, as a matter to be confirmed by official sources rather than assumed. The prudent approach is to prepare fully so that an application can be filed as soon as the mechanism is live.

Expected Board and government deliverables to monitor include a registration portal and forms, clarificatory FAQs, technical standards for interoperable platforms, any list of recognised certification bodies, and transitional guidance for applicants. Keep a standing watch on the Gazette of India (egazette.gov.in), MeitY (meity.gov.in) and PIB (pib.gov.in) for authoritative updates, and update internal compliance plans each time new guidance is published.

Risks, enforcement and penalties: a practical view

Operating as a consent manager without meeting the registration and First Schedule requirements, or failing to discharge Part B obligations after registration, exposes an organisation to enforcement and supervisory risk under the DPDP framework. The Act provides for monetary penalties imposed by the Data Protection Board following inquiry, with the quantum determined in accordance with the Schedule to the Act and the factors set out in it. Beyond regulatory consequences, there is significant contractual exposure: fiduciaries relying on a consent manager will expect robust representations, warranties and indemnities, and any failure in consent integrity can ripple through those relationships. Reputational fallout is a further, often underestimated, cost, consent management touches the trust layer of the entire ecosystem.

Action for counsel: allocate risk clearly in contracts, consider appropriate indemnities between fiduciaries and consent managers, and evaluate insurance cover for data-related liabilities. Build compliance evidence from day one so that the organisation can demonstrate diligence if challenged.

Recommended checklist and template next steps for counsel

The following condensed checklist is designed for in-house and external counsel coordinating a consent manager registration or fiduciary readiness programme. It can be adapted directly into a project plan.

1. Incorporation. Confirm an Indian incorporated entity to hold the registration and resolve any group restructuring.
2. Board approvals. Secure internal approvals for capitalisation to the two crore rupee threshold and for the registration application.
3. Certification tender. Issue an RFP for independent certification and audit of the interoperable platform.
4. Technical readiness. Complete interoperability testing and assemble the certification evidence base.
5. Vendor SLA clauses. Prepare model clauses covering recordkeeping, interoperability, security, data-use restrictions and liability.
6. Notice and consent text. Draft data principal-facing notices and consent language ahead of the core fiduciary obligations.
7. Monitoring log. Establish a watchlist process for Gazette, MeitY and PIB updates on Board guidance.

For broader support, see our overview of TMT lawyers in India, and plan internal links to a forthcoming DPDP Act and Rules explainer, a consent manager registration checklist, and a data fiduciary compliance roadmap as those resources are produced.

Conclusion and monitoring log

India’s data protection law takes effect in phases under the DPDP Rules, 2025, and the consent manager regime is among the first operative tests of readiness for the privacy-tech sector and the fiduciaries that depend on it. The immediate priorities are clear: confirm Indian incorporation, meet the two crore rupee net-worth threshold, secure independent certification of an interoperable platform, and build the recordkeeping and governance that Part B of the First Schedule demands. Fiduciaries should run a parallel programme for the core obligations arriving under the later phase, aligning notices, consent flows, breach response and vendor contracts in good time.

Keep a live monitoring log of Gazette, MeitY and PIB announcements so that your compliance plan tracks each new piece of guidance, confirm every commencement date against the official text, and seek qualified local counsel before finalising any structure or application. This article is provided for informational purposes and is not a substitute for advice tailored to your circumstances.

To discuss registration strategy or fiduciary readiness, contact a Global Law Experts TMT specialist.

Sources

1. Gazette of India (eGazette), official portal
2. Ministry of Electronics & Information Technology (MeitY)
3. India Code, repository of Acts
4. Press Information Bureau (PIB), Government of India
5. Bar Council of India
6. Supreme Court of India, official website