Consent manager portal goes live without DPBI members
The Data Protection Board of India has activated its registration portal for consent managers to enhance data protection. This initiative comes as the regulations outlined in the Digital Personal Data Protection rules begin to take effect. Compani...
The Data Protection Board of India's registration portal for consent managers went live on Friday, even as board members are yet to be appointed and key official guidelines remain unclear.
New Delhi | Bengaluru: The Data Protection Board of India's (DPBI) registration portal for consent managers under India's data protection regime went live late on Friday night, despite the board members not yet being selected. However, companies that build privacy and data protection compliance software and experts pointed out that the key official guidelines remain unclear.
Provisions concerning consent managers under the Digital Personal Data Protection (DPDP) rules, 2025 came into effect on Friday, exactly 12 months after the rules were notified. Set to be neutral intermediaries or single point of contact for individuals to give, manage, review and withdraw data consent across multiple organisations, consent managers are emerging as the cornerstone of a compliance-as-a-service market that could reach ₹10,000 crore over the next three years in India.
"DPBI was constituted by law when the rules were notified a year back and the government is close to selecting the chairperson and four full-time members. The Department of Legal Affairs is currently vetting a few prospective candidates," a government official said.
Infographic image.Set to be a statutory compliance watchdog tasked with investigating reported data breaches, DPBI will be armed with powers to impose penalties up to ₹250 crore on data fiduciaries for failing to implement reasonable security safeguards to prevent personal data breaches. However, reviewing and approving applications from consent managers to be registered is a more immediate priority for the quasi judicial body.
DPBI would have to be an operational body to examine the applications, ascertain whether companies have conflict of interest and then take decisions, companies aspiring to register as consent managers said.
Maulik Bengali, chief executive, IQWorks, an AI-native platform focused on data privacy, compliance and cyber governance, told ET, "A few things about eligibility and process still need clarifying first. DPDP Rules require a consent manager to have no conflict of interest with the data fiduciaries it serves, and it isn't yet clear whether that covers a company that already sells consent tools to fiduciaries, as we do with ConsentIQ."
