Introduction
The Digital Personal Data Protection (DPDP) framework introduces an interesting institutional mechanism called a Consent Manager. Unlike an ordinary consent collection tool, a Consent Manager is intended to provide individuals with a platform through which they can give, manage, review and withdraw their consent for the processing of personal data.
However, becoming a registered Consent Manager is not open to every technology company or startup.
The Digital Personal Data Protection Rules, 2025 prescribe a minimum net-worth requirement of ₹2 crore, along with several other eligibility conditions. This financial threshold raises an important question: why has the Government introduced such a significant entry requirement for an entity whose primary function is to facilitate consent management?
1. What is a Consent Manager under the DPDP framework?
Section 2 of the DPDP Act, 2023 defines a Consent Manager as a person registered with the Data Protection Board of India who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform.
In simple terms, a Consent Manager acts as an independent interface between individuals and the organisations seeking consent to process their personal data.
For example, an individual may maintain accounts with several banks, insurance companies and digital platforms. Instead of managing consent separately across different organisations, the individual may use a registered Consent Manager to manage consent through one platform.
The objective is to give individuals greater control over their personal data.
2. Why is the ₹2 crore net-worth requirement significant?
Part A of the First Schedule to the DPDP Rules, 2025 prescribes the conditions for registration as a Consent Manager.
One of these conditions expressly requires the applicant to have a net worth of not less than ₹2 crore.
Importantly, the Rules define net worth as:
The aggregate value of total assets reduced by the value of liabilities appearing in the company’s books of account.
Therefore, net worth is not the same as annual turnover, revenue, cash balance or the amount of investment received from investors.
A company may generate substantial revenue but still fail to satisfy the prescribed net-worth requirement.
Similarly, a startup receiving significant funding does not automatically qualify unless its net worth, calculated in accordance with the prescribed definition, meets the threshold.
3. Is ₹2 crore the only eligibility requirement?
No. Meeting the financial threshold is only one part of the registration process.
The applicant must also satisfy several other conditions:
- It must be a company incorporated in India.
- It must have adequate technical, operational and financial capacity.
- Its financial condition and general management must be sound.
- Its directors, key managerial personnel and senior management must have a reputation for fairness and integrity.
- Its memorandum and articles of association must contain provisions ensuring compliance with specified obligations relating to conflicts of interest.
- Its proposed operations must be in the interests of Data Principals.
- Its interoperable platform must undergo independent certification against the applicable standards and assurance framework.
These requirements demonstrate that registration is not intended to be a mere formality.
The applicant must establish that it has the financial strength, technical infrastructure and governance structure necessary to operate as a trusted consent management institution.
4. Why does the Government require financial strength?
A Consent Manager is expected to perform functions that have significant implications for individuals’ privacy and autonomy.
Consider a situation where an individual uses a Consent Manager to withdraw consent previously given to several organisations.
The platform must be capable of securely processing the withdrawal instruction, maintaining appropriate records and facilitating the relevant consent-management process.
A technical failure, prolonged service disruption or inadequate security infrastructure could undermine the individual’s ability to exercise control over personal data.
Financial capacity becomes important for several reasons.
First, technological infrastructure. A Consent Manager needs a secure and interoperable platform capable of communicating with different Data Fiduciaries.
Second, cybersecurity. Maintaining secure systems, conducting audits and implementing organisational safeguards require sustained investment.
Third, operational continuity. Individuals should not lose access to their consent records merely because the platform faces financial difficulties.
Fourth, institutional accountability. The Consent Manager must maintain records, address grievances and comply with regulatory requirements.
The financial threshold can therefore be understood as a regulatory safeguard intended to reduce the risk of undercapitalised entities entering a sensitive institutional role.
5. Does this requirement create barriers for startups?
Yes, it potentially does.
A technology startup may have an excellent consent-management product, strong technical expertise and an innovative business model but may not possess a net worth of ₹2 crore.
Such a startup would not satisfy the prescribed financial condition for registration in its existing form.
This may favour established technology companies, well-funded ventures and businesses with substantial financial backing.
At the same time, the requirement may reduce the number of entities entering the market without adequate resources.
The regulatory challenge is to strike a balance between encouraging innovation and ensuring that Consent Managers remain reliable and accountable.
6. Does having ₹2 crore net worth guarantee registration?
Absolutely not.
The Rules provide that an eligible applicant may apply to the Data Protection Board. The Board may conduct an inquiry to satisfy itself that the conditions prescribed in Part A of the First Schedule have been fulfilled.
If satisfied, it may register the applicant and publish its particulars.
If not satisfied, it may reject the application and communicate the reasons.
Therefore, ₹2 crore net worth is a minimum eligibility condition, not an automatic entitlement to registration.
Conclusion
The ₹2 crore net-worth requirement is an important feature of India’s proposed consent-management ecosystem.
It reflects the regulatory expectation that a Consent Manager should not merely operate as a technology intermediary but should function as a financially sound, technically capable and trustworthy institution.
For startups considering entry into this sector, financial eligibility, governance, interoperability and independent certification must be considered together.
Ultimately, the success of the Consent Manager framework will depend not simply on how many entities obtain registration, but on whether individuals can genuinely rely on these platforms to exercise meaningful control over their personal data.
