Technology companies are building consent-management systems for India’s new privacy regime, but uncertainty over registration rules, commercial viability and the yet-to-be-formed Data Protection Board is keeping potential intermediaries on the sidelines.
Tech companies are weighing whether to step into a new role under India’s privacy law as the first registration window for consent managers approaches on 13 November 2026, even though the regulator that will oversee the process has not yet been formed and detailed guidance is still missing. The uncertainty has left many firms in a holding pattern as they assess whether the economics, compliance burden and possible conflicts of interest make the business model worthwhile.
The consent manager framework sits at the heart of the Digital Personal Data Protection regime. It is designed to give people a single place to grant, review, change or withdraw permission for the use of their personal data across multiple organisations. Under the rules, the role is intended for neutral intermediaries rather than companies collecting consent solely for their own services, and the registration process is due to open before the wider compliance deadline for data fiduciaries in May 2027.
For now, the strongest activity is in the technology layer rather than the intermediary role itself. CAMS chief financial officer Ram Charan Sesharaman said the company’s consent management stack, ConsenPro, has already drawn more than 15 implementations, with particularly strong demand from banking, financial services and insurance clients, including capital-market firms and non-banking financial companies. He said industry estimates point to more than ₹10,000 crore in DPDP-related technology and compliance spending over the next three years, with consent architecture and governance alone accounting for about ₹1,000 crore, but added that CAMS would prefer to remain a technology supplier rather than become the regulated intermediary.
IDfy chief operating officer Malcolm Gomes said Privy by IDfy is already handling more than 50 live enterprise deployments across banking, insurance, healthcare and retail, but declined to say whether the company would apply for registration. Gomes said implementation of the law looks very different from sector to sector because data systems vary widely, adding that fewer than four in ten enterprises have mapped their data and the third parties handling it, while nearly 80 per cent have not yet put DPDP-aligned privacy governance frameworks into operation. Shashank K, co-founder of Redacto, said firms such as his are well placed to serve as consent managers, although he said the market still needs clarity on who can apply and how the model will be monetised.
Maulik Bengali, founder and chief executive of IQWorks, said his company is actively evaluating whether to seek registration because its platform was built for the DPDP Act, the accompanying rules and MeitY’s electronic consent framework. But he said the final answer may depend on how the Data Protection Board interprets each application, particularly if a company both sells consent-management software and acts as an intermediary. Shahana Chatterji, partner at Shardul Amarchand Mangaldas & Co, said the framework is likely to create short-term operational uncertainty around both platform design and revenue models, and that strict eligibility rules mean few entities are likely to rush to apply. Industry sources say large consulting and law firms may stay out of the market altogether to avoid conflicts, while government sources have said the constitution and composition of the Data Protection Board will be announced soon.
Disclaimer: This article is intended to inform and educate, not to recommend or endorse any financial product, investment or strategy. Please consider your own financial circumstances and seek professional advice where appropriate before making financial decisions.
