Follow us on Google News
India’s new Consent Manager framework came into force on November 13, opening the registration process to eligible entities seeking recognition under the Digital Personal Data Protection (DPDP) framework. The rules allow qualifying organisations to apply to the Data Protection Board for registration, establishing a distinct regulatory category for entities that manage consent on behalf of individuals.
The framework sets Consent Managers apart from conventional consent management service providers by defining their role as representatives of individuals, referred to as Data Principals under the DPDP framework, rather than technology service providers working for businesses.
A conventional consent management platform may provide services to a company and use information generated through its operations for analytics. A registered Consent Manager, however, is expected to act in the interests of the individual whose consent it handles. This places the organisation in a position of accountability to the Data Principal and requires it to meet specific regulatory and operational standards.
How Does A Consent Manager Differ From Conventional Platforms?
One of the central requirements under the new framework is that a registered Consent Manager must be data-blind. Personal data shared through its platform must not be readable by the Consent Manager itself, distinguishing the role from conventional platforms that may have access to or examine information passing through their systems.
This requirement has significant implications for organisations already operating consent-related technology. Having an established consent management platform does not automatically qualify a company for registration. Its relationship with individuals, access to personal data and the technical design of its platform will all determine whether it meets the prescribed conditions.
Under the framework, a Consent Manager is expected to function as an independent intermediary acting on behalf of the Data Principal, rather than as a technology vendor serving the interests of a business. The distinction makes independence and the protection of individual interests central to the registration requirements.
What Conditions Must Applicants Meet?
Eligible applicants must have a minimum net worth of ₹2 crore. They must also ensure that their directors and key managerial personnel meet the prescribed fit-and-proper criteria.
Independence from Data Fiduciaries is another key eligibility condition. Applicants must incorporate this requirement into their Articles of Association. Any amendment to the relevant provisions will require approval from the Data Protection Board.
Applicants must also obtain independent certification of their platforms. The requirement places technical compliance alongside corporate governance, making it necessary for organisations to demonstrate that their platform design and operational structure meet the standards prescribed under the framework.
The rules further require registered Consent Managers to retain consent records for at least seven years. This creates an ongoing record-keeping responsibility, extending beyond the initial activity of obtaining or managing consent.
What Obligations Apply After Registration?
Registration does not mark the end of the compliance process. Registered Consent Managers will remain subject to audit and reporting requirements and must obtain the Board’s approval before making changes in control.
The Data Protection Board has the authority to issue directions to registered Consent Managers and can suspend or cancel their registration. It can also reject applications from entities that fail to satisfy the prescribed eligibility conditions.
These provisions establish continuing regulatory oversight of the organisations operating in this category. Registered entities must maintain the required standards relating to governance, independence, platform certification and record retention throughout their operations.
The framework therefore makes registration the beginning of an ongoing compliance process, with the Board retaining powers to monitor and take action against registered entities that do not meet their obligations.
FCRF Launches CP-FRM to Build India’s Next Generation of Fraud Risk Professionals
What Should Prospective Applicants Prepare?
The registration process is structured around a three-stage application flow, accompanied by a detailed mapping of the nine eligibility conditions to the supporting evidence applicants will need to provide. The framework also identifies 13 separate compliance obligations that registered Consent Managers must fulfil after receiving approval.
For organisations considering an application, preparation will need to cover both corporate governance and technical requirements. Independence provisions, the eligibility of directors and key managerial personnel, financial thresholds and platform certification will need to be considered alongside the design of the consent management system.
The sequence of preparation is important because organisations cannot rely solely on existing technology or previous experience in providing consent-related services to establish their eligibility. Their overall structure and operational model must also align with the requirements for acting independently on behalf of Data Principals.
With the rules taking effect on November 13, eligible organisations can now begin the registration process. Their immediate priority will be to assess whether their financial position, governance arrangements, independence and platform design satisfy the conditions for recognition as a registered Consent Manager under India’s DPDP framework.
