Portal Opens For Consent Managers
Until November 13, 2026, a Consent Manager existed in the statute and in policy papers, but there was no live route to become one. Now there is.
Eligible companies can file through the Board's online portal, and the Board will process those applications under the framework that took effect that day. For lawyers advising technology, finance, health, retail and marketing clients, the question has turned practical — whether to build the capability in-house through a group entity, tie up with an applicant, or wait. That advice will turn on governance, security, interoperability and accountability to the Data Principal.
The first filings will set the pattern. They'll show how the portal works in practice, what disclosures and documents the Board actually asks for, and how long scrutiny takes. Firms that track those early applications closely will have a clearer read when the second wave of clients comes in.
What Consent Managers Actually Do
A Consent Manager sits between the individual and the business that wants to use the data. Under the Act's structure, the Data Principal is the individual to whom personal data relates. The Data Fiduciary is the business or other entity that decides why and how to process it.
In practice, the Manager gives a person one place to see, grant, review and withdraw consent across purposes and fiduciaries. A customer who shops online, uses a lending app, books diagnostic tests and joins loyalty programmes otherwise leaves consent scattered across dozens of check-boxes and privacy notices. A registered Consent Manager offers a single, auditable trail for all of it.
Businesses want cleaner proof. Consent must be free, specific, informed, unconditional and unambiguous, tied to a clear purpose with a notice that says what is collected and why. Withdrawal must be as easy as giving consent. Managing that across apps, websites, call centres and vendors is hard. A Consent Manager that keeps logs, consent receipts, timestamps and withdrawal signals cuts down disputes about whether consent was ever valid. It doesn't remove the fiduciary's own duties, but it creates one record both sides can point to.
October Order Clears Two Grey Areas
Shortly before the portal went live, the Ministry notified the Digital Personal Data Protection (Removal of Difficulties) Order, 2026 on October 5, 2026. It deals with consent for children and persons with disabilities, and with data audit for Significant Data Fiduciaries.
Those were two spots where businesses had been guessing. Rules for children's data touch every ed-tech platform, gaming company, toy seller and content service with users under eighteen. They also touch general platforms that don't target children but can't be sure children aren't signing up. Rules linked to persons with disabilities raise questions about who can consent on another person's behalf, and what safeguards apply when a guardian or lawful representative gives consent.
The Order doesn't rewrite the Act. As a removal-of-difficulties measure, it explains how those consent provisions are to work. Counsel now have to map existing flows against that explanation. Where age-gating is used, the wording, verification step and parental consent step need review. Where services are used by persons with disabilities, the authorisation and record-keeping steps need review. Contracts with Consent Managers will also need to say who captures guardian consent, where it's stored, and how withdrawal by a guardian is honoured.
The same Order speaks to data audit for Significant Data Fiduciaries, the higher tier that will face added duties once the May 2027 provisions start. Audit here means an independent check on whether processing, security and governance match what the law demands. Even though the full audit regime sits with the later start date, the October 5, 2026 wording tells large data handlers to get audit-ready. Data maps, retention schedules, security logs and vendor registers can't be built overnight.
May 2027 Brings Full Duties
The calendar is now fixed at both ends. November 13, 2026 brought the Consent Manager framework. May 13, 2027 is the slated date for the remaining provisions.
That second date is the one boards will ask about. Once fiduciary duties start, businesses will need purpose limitation, notice, consent management, security safeguards, breach intimation, retention discipline and grievance redressal in working order. Data Principals will be able to assert rights to access, correction, erasure, nomination and grievance redressal. The Board will be able to inquire into complaints and breaches and impose penalties.
Six months goes fast when consent notices have to be rewritten in plain language, translated where needed, embedded into product flows and linked to a Consent Manager dashboard. Companies that use this window to clean their data inventory will face May 2027 with far less disruption than those that leave it to the last quarter.
What Indian Businesses Should Do Now
Lawyers are already getting calls on whether to apply to become a Consent Manager, whether to integrate with one, and what to tell customers in the meantime. The answer turns on scale and data strategy.
A large bank, insurer, hospital chain or marketplace with millions of customers and repeated consent events has more reason to study registration or a deep integration. A smaller vendor with one simple newsletter list may need only tidy notice and consent records, plus a contract that allows a future plug-in to a Consent Manager.
Across both groups the immediate work is the same. List what personal data is collected, from where, for what stated purpose, and how long it's kept. Test current consent screens against the Act's standard of free, specific and informed consent with easy withdrawal. Review children's flows and flows used with guardians in light of the October 5, 2026 Order. And line up vendor contracts so a Consent Manager can be added without renegotiating the whole stack.
Boards should also price it. Consent Managers will charge for their services. Integration will need engineering time. Audit readiness for Significant Data Fiduciaries will need internal controls and possibly external assurance. Budgeting those items now avoids a scramble in early 2027.
Registration Is Only First Step
The Board's portal doesn't settle every question. Market practice on consent dashboards, data-sharing standards and grievance handling through Consent Managers will develop case by case. The Board's approach to applications, clarifications and rejections will shape the field, and further guidance under the Act and Rules will fill gaps.
For now the dates control the work. Consent Managers became a registrable role on November 13, 2026, with part of the detail clarified by the October 5, 2026 Order, and the full set of fiduciary duties, principal rights and penalty powers slated for May 13, 2027.
