DPDP Act registration: only Consent Managers register

If you collect customer data, you may wonder whether you must register with the Data Protection Board or hold a licence under the DPDP Act. This page answers from the text of the Act and Rules. It covers the DPDP Act and Rules only. Other laws can ask a business to register for their own purposes, and we did not check them here. The sections on the law are cited in the Sources box.

The short answer

The Act and Rules provide for the registration of one kind of person: the Consent Manager. They do not ask any other business that handles personal data to register with the Board or to hold a licence. Elsewhere these words are used in other senses, for example State benefits such as a licence or permit, a licence number used to identify a customer, or a customer’s own account. No provision creates a register of businesses or a licence to process personal data.

Who has to register: Consent Managers

A Consent Manager is a person registered with the Board who acts as a single point of contact for a person to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform. The Act says every Consent Manager must be registered with the Board on the conditions the Rules set. The Rules let a person who meets the conditions in the First Schedule apply to the Board, which either registers the applicant or rejects the application with reasons. Among the conditions, the applicant must be a company incorporated in India with a net worth of not less than two crore rupees.

The rules on registering Consent Managers come into force on 13 November 2026, one year after the notifications published on 13 November 2025. You need to register only if you want to act as a Consent Manager. Using one is the choice of the person whose data it is. Consent Managers: what starts on 13 November 2026 covers it in full.

Who is notified: Significant Data Fiduciaries

The Central Government may notify a Data Fiduciary, or a class of Data Fiduciaries, as a Significant Data Fiduciary. It decides after assessing factors that include the volume and sensitivity of the personal data processed and the risk to the rights of people. A business does not apply to become one and does not declare itself one. The notification is the government’s act.

A Significant Data Fiduciary’s extra duties include appointing a Data Protection Officer who is based in India and answers to its board or similar body, and an independent data auditor. They also include periodic Data Protection Impact Assessments and audits. Under the Rules, it must do an assessment and an audit once in every twelve months from the date it is notified and have a report of the significant observations sent to the Board. These duties start on 13 May 2027. None of the sources we hold names a business as notified. Check the Gazette for a notification that names your business or your class.

Who does what, in one table

What other businesses do instead

A business that is neither of these does not register. If the Act covers its processing, it meets the duties of a Data Fiduciary, which start on 13 May 2027. These include notice with each consent request, reasonable security safeguards, breach reports, erasure when the purpose ends, a published contact, and a published grievance period of at most 90 days. The government can also notify businesses, including startups, that some duties do not apply to; none of the sources we hold contains a notification of that kind for startups or other businesses. Separately, the Rules lift some duties on children’s data for listed classes, such as clinical establishments and educational institutions. Registration is not the way to be excused.

• Does the DPDP Act apply to my business?
• The DPDP Act for small businesses that collect customer or lead data
• The timeline: 13 Nov 2025, 13 Nov 2026, 13 May 2027

Because the Act and Rules provide no registration or licence of this kind for ordinary businesses, if someone tells you that you must register under the DPDP Act, ask which provision says so.