MeitY Launches Registration Portal for DPDP Act Consent Managers

A Milestone in DPDP Act Implementation

The Ministry of Electronics and Information Technology (MeitY) has officially opened the registration portal for 'Consent Managers,' marking a significant step in the operationalization of the Digital Personal Data Protection (DPDP) Act, 2023. This move transitions the Act from a legislative framework into a functional regulatory environment, specifically targeting how personal data is managed and shared across India’s digital economy.

Under the DPDP Act, a Consent Manager is defined as a specialized entity that acts as a single point of contact for Data Principals (individual users) to give, manage, review, and withdraw their consent for data processing. These entities will be registered with the Data Protection Board of India and are expected to be accountable to the users, ensuring that data fiduciaries remain compliant with the law's transparency requirements.

Implications for Tech Startups and Fintech

For founders, the introduction of Consent Managers creates a twofold impact. First, it establishes a new niche for 'Privacy-Tech' startups. Companies can now build specialized platforms designed to handle consent management as a service, potentially integrating with existing Account Aggregator frameworks or creating standalone trust-based services. These entities will play a crucial role in reducing the compliance burden for other businesses by handling the technical and legal complexities of consent tracking.

Second, for existing Data Fiduciaries—startups that collect user data—this portal signals that strict enforcement is approaching. Startups will likely need to integrate with these registered Consent Managers to ensure their data collection practices meet the Act's standards for 'informed and unconditional' consent. This is particularly relevant for the fintech, healthtech, and e-commerce sectors, where sensitive personal data is central to the business model.

Next Steps for Compliance

The opening of the registration portal indicates that MeitY is accelerating the rollout of the broader DPDP rules. While the final detailed rules are still awaited, the infrastructure for the Data Protection Board is being prioritized. Investors and boards are advised to review their portfolio companies' data governance structures now. Being an early adopter of these consent frameworks could provide a competitive advantage in consumer trust, while a delay may lead to significant regulatory risks as the Data Protection Board begins its oversight functions.