DPDP Act Implementation Kicks Off: Why the Consent Manager Regime and ₹2 Crore Net Worth Threshold Signal a Compliance Revolution for Indian Tech

The Infrastructure of Consent Goes Live

The Digital Personal Data Protection Act, 2023, has finally moved from legislative text to operational reality. On 13 November 2026, the Ministry of Electronics and Information Technology (MeitY) operationalised the registration portal for Consent Managers—the specialised intermediaries tasked with operationalising data principal consent under Section 2(g) of the Act. With a stringent ₹2 crore minimum net worth requirement and a mandate for Indian incorporation, the government has signalled that consent management will not be a casual compliance checkbox but a capital-intensive, professionally managed infrastructure layer.

For technology companies and IP-heavy platforms, this development is transformative. The Act’s consent architecture—requiring free, specific, informed, unconditional, and unambiguous agreement—now demands technical integration with registered Consent Managers. This creates an immediate compliance imperative: businesses must redesign user interfaces, renegotiate data processing agreements, and prepare for the 13 May 2027 deadline, when substantive obligations under Sections 4-17 take full effect.

Regulatory Readiness Without Regulatory Presence

Curiously, the Consent Manager portal has gone live despite the Data Protection Board of India (DPBI) remaining unconstituted. This administrative anomaly—opening registration before appointing the adjudicatory body’s members—suggests the government is prioritising market preparation over institutional completeness. For practitioners, this creates a peculiar limbo: entities can register as Consent Managers, but the enforcement mechanism that would penalise non-compliance remains headless.

This sequencing matters. Under Section 27, the DPBI holds powers to impose penalties up to ₹250 crore for data breaches and consent violations. The absence of Board members means that while the procedural infrastructure of data protection is being constructed, the adjudicatory teeth remain missing. Lawyers advising tech clients should note this gap: compliance frameworks built now must anticipate regulatory enforcement that could arrive retroactively once the Board is operational.

Clarifications and Constitutional Clouds

October 2026 brought two significant clarifications via the Removal of Difficulties Order. First, the government resolved ambiguities regarding consent for persons with disabilities, specifying that lawful guardians may provide consent where the data principal cannot. Second, and more critically for Significant Data Fiduciaries (SDFs), the Order replaced the vague term "audit" with "data audit" under Section 10(2)(a).

This semantic shift carries substantial weight. For SDFs—entities processing high volumes of sensitive data or notified by the government based on risk assessments—the requirement now clearly mandates specialised data protection audits, not merely financial or general compliance reviews. This aligns with the Act’s risk-based approach but raises the compliance bar significantly for tech platforms handling large-scale personal data.

Meanwhile, the constitutional challenge mounted by the Digital News Publishers Association (DNPA) before the Supreme Court threatens to reshape the Act’s application to journalism and digital media. The Court’s decision to issue notice in late October without granting an interim stay indicates judicial recognition of the Act’s immediate operational reality while acknowledging serious questions about press freedom under Article 19(1)(a). For IP and media lawyers, this litigation is crucial: the exemption for "journalistic purposes" under Section 3(c)(ii) remains contested terrain, and the RTI amendment implications continue to generate uncertainty regarding disclosure obligations.

Strategic Implications for Technology and IP Practices

The DPDP Act’s implementation timeline creates immediate workstreams for legal practitioners. Cross-border data transfer planning under Section 16, which restricts transfers to notified countries, requires immediate attention from SaaS providers and multinational tech companies. The interaction between DPDP compliance and existing IP licensing frameworks—particularly regarding data as an asset class—demands fresh contractual drafting.

Moreover, the ₹2 crore net worth threshold for Consent Managers creates a new market for compliance infrastructure. Traditional IT services companies and fintech players are likely candidates, but the capital requirements may exclude smaller startups, potentially creating an oligopoly in consent management. This concentration risk requires antitrust monitoring alongside data protection compliance.

For in-house counsel at technology firms, the message is clear: the era of "wait and watch" has ended. With government departments already under Cabinet Secretariat directives to map data processing and review safeguards, the compliance clock is ticking. The DPDP Act is no longer a theoretical framework but an operational reality that will define the Indian digital economy’s architecture for the next decade.