MeitY portal lets Indian firms register as DPDP consent managers

The Ministry of Electronics and Information Technology (MeitY) has opened the registration process for consent managers under the Digital Personal Data Protection (DPDP) Act, 2023. The framework took effect on 13 November, and IT Secretary S Krishnan launched an online portal, dpbi.gov.in, for companies to submit applications to the Data Protection Board of India (DPBI).

For ecommerce platforms, D2C brands and the data vendors that serve them, the immediate takeaway is straightforward: the plumbing for consent is now being built, and businesses will have to connect to it. The bigger obligations for companies that process personal data, known under the law as data fiduciaries, start on 13 May 2027.

What is a consent manager under the DPDP Act?

A consent manager is an entity registered with the DPBI that lets individuals, called data principals, give, review, manage and withdraw consent for the processing of their personal data through an interoperable platform. MeitY said the framework "enables data principals to exercise greater control over consent", and that it is part of the phased rollout of the DPDP framework.

Two things matter here. First, consent managers are accountable to the data principals, not to the businesses that collect data. Second, the platform must be interoperable, meaning a user's consent choices should work across services rather than being locked inside one app.

Companies incorporated in India with adequate technical, operational and financial capacity can apply. The minimum net worth requirement is ₹2 crore. The DPBI will assess applicants against the prescribed requirements, approve those that qualify, and publish a list of registered consent managers on its website.

Why does this matter for ecommerce and D2C brands?

Most ecommerce and D2C brands collect personal data at several points: account sign-up, checkout, newsletter pop-ups, app notifications, loyalty programmes, WhatsApp marketing and third-party analytics pixels. Each of those touchpoints is a consent question.

Under the DPDP Act, consent must be free, specific, informed, unconditional and unambiguous. A pre-ticked box buried in terms and conditions will not pass. Companies must also tell users why they are collecting the data and how it will be used. Data principals get rights to access, correct, erase and withdraw consent, and to nominate someone to exercise those rights in specified circumstances.

This is where consent managers come in. Instead of every brand running its own consent dashboard, users may manage permissions through registered intermediaries. For brands, that means consent records may need to travel across systems. If a customer withdraws consent through a consent manager, the brand's marketing and analytics stack should be able to reflect that quickly.

Krishna Chaitanya B, Chief Product Officer at Perfios, a financial technology and software company, said consent becomes "an operational control, not just a legal formality", with institutions needing to rethink how they capture, document and demonstrate consent across digital and physical channels, according to media reports. The same applies to retail marketers, who have long treated consent as a tick-box at checkout.

What should brands do before 13 May 2027?

The substantive obligations for data fiduciaries, including consent, security safeguards, data principal rights and breach reporting, come into force on 13 May 2027. That leaves roughly six months from now. The DPDP Rules, 2025, were notified in November 2025, according to media reports, and set out this phased timeline. The government received 6,915 inputs during consultation from startups, MSMEs, industry bodies, civil society groups, government departments and citizens, according to a Press Information Bureau backgrounder reported in the media.

For a D2C operator, a practical checklist looks like this:

• Map data flows: list every place personal data is collected, including apps, websites, offline stores, call centres and marketplaces.
• Separate purposes: distinguish data needed to fulfil an order or meet legal requirements from data used for marketing, profiling and cross-selling.
• Audit vendors: analytics firms, CRM providers, logistics partners and ad tech platforms that touch customer data need contracts that reflect the brand's accountability.
• Fix retention: identify what data is held, where, why and when it should be deleted, including in legacy databases and closed accounts.
• Prepare for breaches: data fiduciaries must notify affected individuals without delay and file a detailed report with the DPBI within 72 hours of becoming aware of a personal data breach, unless an extension is permitted.

The breach reporting requirement deserves attention. Under the DPDP Rules, a ransomware attack could trigger reporting if it causes a qualifying loss of access to personal data, even without evidence that data was stolen, according to a 12 November briefing by K7 CyberSecurity, as reported in the media. Penalties can reach up to ₹250 crore for failure to take reasonable security safeguards and up to ₹200 crore for failure to meet breach notification obligations. These are maximum statutory penalties and are not automatic.

Who wins and who loses?

Large marketplaces and well-funded D2C brands with in-house legal and technology teams will find the transition easier. They can afford consent management tools, data mapping exercises and vendor audits. Smaller D2C brands running on shoestring teams may struggle, which is one reason consent managers could become a useful outsourced layer.

The consent manager opportunity itself is likely to attract RegTech firms, identity verification companies and data privacy startups. The ₹2 crore net worth floor is low enough for specialists but high enough to deter hobbyist operators. The DPBI's approval process will decide how many actually make it to the public list.

There is also a competitive angle. Brands with robust consent practices may find their first-party data assets easier to use after May 2027, while those facing compliance gaps could see their marketing lists become harder to use. Those that have been disciplined about opt-ins stand to gain.

What to watch next

Three things. First, how quickly the DPBI approves the first batch of consent managers and what the public list looks like. Second, whether MeitY or the Board issues further guidance on how consent managers interoperate with data fiduciaries in practice. Third, how ecommerce and D2C trade bodies respond, given that the consultation process drew thousands of inputs from MSMEs and startups.

Malcolm Gomes, COO at IDfy and head of Privy by IDfy, told CNBC-TV18 that the gap in DPDP implementation is often not technology but alignment, with legal, technology, information security and business teams each understanding their own roles but needing a shared view of the organisation's data. That is a fair warning for retail operators. The six-month window will pass quickly.

The DPDP framework is being rolled out in phases. Consent manager registration is open now. The main compliance obligations begin on 13 May 2027.