A registered consent manager that lets people see and withdraw data permissions
TL;DR Revokely is a consent manager under India's DPDP Rules - one app where a person sees which companies hold permission to use their data, and withdraws it in a tap. Companies pay to plug in, because the law lets users route consent through registered managers. Registration opens in November 2026.
Indians hand personal data to dozens of apps, from social networks to lenders, through consent screens nobody reads. The DPDP Act gives every person rights to access, correct and erase their data and to have grievances addressed[1], but using those rights means hunting for a different form at every company.
Companies face the mirror problem. They must record consent, show what each request was for and honour withdrawals, with penalties of up to ₹250 Cr for security failures[1]. Most have no clean record of who agreed to what, and when.
What it does, in regulatory terms: a Consent Manager registered with the Data Protection Board of India under the DPDP Rules 2025. It routes consent between people and companies but must not be able to read the personal data being shared[2].
You sign in once and see every company that has asked for your consent through Revokely, the purpose stated and the date. You can give, review or withdraw any consent, and the company receives the change through an API. The app keeps the records for at least seven years, as the rules require[3].
Reframe - the seed wanted users to own their data as NFTs and trade it. That runs into two walls. NFTs are virtual digital assets taxed at 30% on transfer with 1% TDS and no loss set-off[4], which kills small trades. And selling data across purposes cuts against DPDP's purpose-bound consent. The consent-manager route keeps the goal of user control over data and gives it a legal basis.
The user pays nothing. Data fiduciaries pay integration fees and a per-consent or per-active-user charge, much like how RBI's account aggregators act as consent managers for financial data[5]. My assumption is ₹2–8 lakh a year per mid-size company, and it needs testing. Mind the rule barring conflicts of interest - fiduciaries can't own you[3].
MeitY notified the DPDP Rules on 13 November 2025. Rule 4, on consent-manager registration, takes effect on 13 November 2026, and the wider obligations on 13 May 2027[2]. The first registered managers will set the interface that companies integrate with, which is a big head start.
There is no public figure for consent-manager revenue in India, because the category doesn't exist yet. The closest analogue is the account-aggregator system, where consents are per purpose and revocable[5].
Demand will be driven by compliance deadlines and not by consumer pull, so count the companies that must comply rather than users.
Account aggregators already do this for financial data under RBI rules[5]. Global consent-management platforms sell cookie banners and preference centres to companies, but they work for the company and aren't neutral managers registered with the Board. Large Indian privacy-tech vendors may apply too.
The gap is a user-facing, neutral manager outside finance.
| Difficulty | Hard (55/100) |
| Starting capital | ₹3–5 Cr |
| Time to launch | 12–18 months |
The rules require a company incorporated in India with net worth of at least ₹2 Cr, independent certification of the platform and Board approval for any change of control[2][3]. The technical bar is real too. You need interoperable APIs, audit trails and security good enough to survive a breach inquiry.
Yes. You can't operate as a consent manager without registering, and the bar is high.
Building this outside India? The categories above usually have a local equivalent, so check with your own regulator.
Don't let AI near the personal data itself or make compliance calls. The rules bar you from reading shared data, and a wrong summary of a legal purpose can mislead users.
Want to work out the AI layer for Revokely? Talk to Yash →
Here's what can go south -
This is only for a team with privacy-law, security and enterprise-sales depth and enough capital to meet the net-worth rule. I wouldn't touch it as a consumer-app founder. Before registering, prove that five data fiduciaries will sign letters of intent to integrate and pay once Rule 4 is live.
Plan for roughly ₹3–5 Cr, including the ₹2 Cr net worth the rules require, certification and enterprise sales.
Yes. You must register with the Data Protection Board of India under the DPDP Rules 2025 and meet its net-worth and certification conditions.
The registered consent manager role is specific to India's DPDP Rules. Elsewhere, consent tools are usually sold as compliance software, so check what your own privacy law requires.
The free Revokely validation kit has the line-by-line capital breakdown, the effort scoring, the registration checklist, a 14-day validation sprint with pass/fail targets, a 90-day launch plan, 10 interview questions for compliance heads and users, and 5 assumptions to test. Download the kit →
Thinking about building Revokely or something close to it? The make-or-break work is signing paying companies before the registration capital is committed, and that's exactly the kind of plan I help founders put together. If you need a hand, you know where to find me. Talk to Yash →
For illustration only. Names are fictional and ideas hypothetical; sourced facts are real but may be out of date. Nothing here is legal, financial or professional advice, and Yash Khatri is not personally liable for any use of it. Read the full disclaimer.