A recent list of "government-registered" Consent Managers turns out to mean Companies Act incorporation, not Data Protection Board registration. Here's what the law actually requires, and why the honest count is zero.
June 2026 · 6 min read
A platform recently published a piece titled something like "List of Govt-Registered Consent Managers in India." Eight companies, clean logos, confident framing — positioned as the definitive map of India's consent-manager landscape ahead of DPDPA taking effect.
We read it closely. Then we read the disclaimer at the bottom.
"For the purposes of this list, 'Government registered' refers to entities that are formally incorporated as companies under the laws of the Government of India."
That's Companies Act incorporation. Not Data Protection Board registration. Not DPDPA Consent Manager registration. Not anything connected to Section 6(9) of the Act.
So here's the actual answer to the actual question.
Zero. Not eight. Not one. Zero — because registration isn't open yet, and won't be until at least 13 November 2026. Anyone describing themselves as a "government-registered Consent Manager" before that date isn't describing their DPDPA status. They're describing the fact that they filed incorporation paperwork.
"Consent Manager" has a precise legal meaning under the DPDPA and the DPDP Rules 2025. It isn't a product category, a marketing label, or something you become by shipping a consent banner.
Under Section 6(9), a Consent Manager is a registered entity through which a Data Principal can give, manage, review, and withdraw consent across multiple Data Fiduciaries through a single, interoperable platform. The Consent Manager is accountable to the Data Principal, not the Data Fiduciary — and that distinction is the whole point of the design.
To qualify as a Consent Manager under DPDPA, an entity has to:
This is a regulated role, not a feature toggle, and not something you can add as a module.
Consent Manager registration with the Board opens on 13 November 2026 — exactly twelve months after the DPDP Rules were notified on 13 November 2025. The Rules are explicit that Consent Manager provisions come into force twelve months post-notification. Until that date, no entity can be registered, reviewed, or assessed by the Board.
Every company calling itself a Consent Manager today — registered or otherwise — is describing a product, not a legal status. That's fine as far as it goes. Conflating the two isn't a small error — it does a real disservice to every Data Fiduciary trying to make an informed decision in an already complicated regulatory environment.
Some read the DPDPA framework as saying Consent Manager registration isn't mandatory at all — that a Data Fiduciary can pick any tool, registered or not, to manage consent. We won't argue against that reading outright.
What we will say: if you pick an unregistered Consent Manager and that choice comes under Board scrutiny later, the burden of that decision sits entirely with you, the Data Fiduciary. The registration framework exists specifically to create accountability. Opting outside it doesn't remove that accountability — it just relocates it back onto you. Weigh the consequence before you decide.
The eight companies span a US-headquartered GDPR tool, KYC and identity-verification products, a listed cybersecurity firm, eSign infrastructure players, and an AI-driven data-redaction startup. Several are legitimate, serious products. None are Board-registered Consent Managers, because that registration framework doesn't exist yet for anyone to be registered under.
What the list actually shows is which companies have incorporated in India and are positioning ahead of November 2026. That's a fair observation to make. Calling it a government registration list is not.
Since Board registration isn't open, here's what's actually worth evaluating in a consent platform today.
Is it built for DPDPA, or adapted from GDPR? The two frameworks differ structurally — legitimate-use processing under DPDPA has no real GDPR equivalent, and the 2D consent matrix (one-time versus recurring, legitimate use versus business case) doesn't map onto GDPR's legal-basis model at all. Platforms built around GDPR have to be reverse-engineered to fit India's framework, and it shows in the product.
Does it handle India-specific rights correctly? Section 14's right to nominate a representative in the event of incapacitation is unique to DPDPA. Does the platform actually support it, or is it missing entirely?
Does discovery go past scanning existing databases? Finding PII already sitting in a database is table stakes. The harder problem is finding PII collection points inside application source code — forms, API parameters, third-party SDK calls — before that data ever reaches a database. Code-level discovery is what makes consent configuration accurate rather than approximate. Is it offered?
Is data processed and stored in India? DPDPA's data-localisation expectations, combined with how sensitive consent records are, make hosting outside the region a hard no for serious compliance.
Is breach handling human-led, or fully automated? The 72-hour Board notification obligation isn't a box to auto-tick. A breach notification fired without human review of scope, attribution, and regulatory language is a liability, not a compliance action. Some platforms have confirmed fully automated notification with no human gate. We think that's the wrong design decision to plan around.
Is the vendor actually preparing to register on day one? Who is building toward the governance structure, interoperability standards, and Board-compliant architecture a real Consent Manager registration will require — versus who's built a product and is hoping the label fits later?
Does your advisor have a conflict of interest in what they're recommending? The DPDPA and MeitY's framework for Consent Managers explicitly contemplates avoiding material pecuniary relationships that could compromise independence. That same standard should apply to whoever is advising you on which tool to pick. If the firm recommending a platform has equity, referral fees, or a reseller arrangement with it, that's a conflict worth asking about directly before you act on the recommendation.
truConsent is India's Privacy Intelligence Suite, built for DPDPA from the ground up — not a GDPR tool with an India checkbox added, not a KYC platform with a bolted-on consent module, not a cybersecurity company treating this as an upsell.
On transparency: as far as we know, we're the only consent platform already publishing the transparency disclosures expected of a registered Consent Manager, publicly, on our own site today — you can read them at truconsent.io/why-truconsent. We're not waiting for 13 November to start behaving like a registered entity, and we won't call ourselves registered until we actually are. We're building toward Consent Manager registration with the Board, and we intend to be among the first registered when the window opens.
If you're evaluating consent platforms ahead of DPDPA's enforcement window, ask every vendor on every list one direct question: "Are you registered as a Consent Manager with the Data Protection Board of India?" The honest answer from every platform in the market today is no — registration opens 13 November 2026. Any other answer is either a misunderstanding of the framework, or language designed to sound like more than it is.
If you're evaluating a platform on the strength of a "registered" claim, our CMP evaluation service checks exactly this kind of claim against what's actually verifiable.
30 minutes to talk through your specific data footprint — no obligation.
Book a Consultation