Rule 4
DPDP Consent Manager registration starts 13 Nov 2026
Rule 4 of the DPDP Rules comes into force on 13 November 2026. Here is what it says, what is still missing, and who should care.
Short answer
Rule 4 of the DPDP Rules, 2025 (G.S.R. 846(E)), on registration and obligations of Consent Managers, comes into force on 13 November 2026, one year after the Rules were published (Rule 1). The First Schedule (Part A) conditions include being a company incorporated in India with a net worth of not less than ₹2 crore. As of 4 November 2026 the application form has not been published, and no Board members have been appointed yet.
What changes on 13 November 2026
The DPDP Rules, 2025 (G.S.R. 846(E)) were notified on 13 November 2025 and start in three phases under Rule 1. Rule 4, on registration and obligations of Consent Managers, is the only rule in the second phase. It comes into force on 13 November 2026.
Rules 1, 2 and 17 to 21 have applied since publication. Rules 3, 5 to 16, 22 and 23 follow on 13 May 2027. So Rule 4 starts six months before the core obligations of Data Fiduciaries.
A Consent Manager is a person registered with the Data Protection Board who acts as a single point of contact for a Data Principal to give, manage, review and withdraw consent, through an accessible, transparent and interoperable platform (s.2). It is accountable to the Data Principal (s.6(8)) and must be registered with the Board (s.6(9)).
What Rule 4 and the First Schedule ask for
- Registration with the Data Protection Board (Rule 4).
- Conditions in the First Schedule, Part A, which include being a company incorporated in India.
- A net worth of not less than ₹2 crore (First Schedule, Part A).
- The Board can suspend or cancel a registration after giving a hearing (Rule 4).
Part A lists further conditions. Read the full Schedule in the Gazette text, with counsel, before you plan an application. Our Rule 4 explainer walks through it.
As of 4 November 2026 the application form has not been published, and no Chairperson or Members of the Board have been appointed. Wait for the official process before you file anything, and treat unofficial offers to register you with care.
Who should care
| Who | Why it matters | What to do now |
|---|---|---|
| Companies planning to be Consent Managers | Registration under Rule 4 is the entry route | Check incorporation and net worth against the First Schedule, and track the form |
| Data Fiduciaries | Under s.6(7) a Data Principal may act through a Consent Manager; consenting directly to you remains possible | Keep your own notice and consent records, and plan for consent that may later arrive through a Consent Manager |
| DPOs and legal teams | Partner claims about Consent Manager status need checking | Ask whether a partner is registered or only plans to apply |
Integration planning for Data Fiduciaries
You do not need a Consent Manager to meet DPDP. You still give notices (s.5, Rule 3) and must prove notice and consent (s.6(10)). If your users start to act through Consent Managers, your records should reflect consent given or withdrawn that way too.
- Keep one consent record per person and purpose, with an event log.
- Make withdrawal as easy as giving consent (s.6(4)), and stop processing within a reasonable time after it (s.6(6)).
- Ask any partner that says it is a Consent Manager for its registration details once registration opens.
- Plan this alongside the core obligations that begin on 13 May 2027, using our May 2027 checklist.
s.6(6) requires you, and your processors, to stop processing within a reasonable time after a withdrawal. Map how a withdrawal made through a Consent Manager would reach each system that holds the data.
Update log
- 4 Nov 2026: published. We will update this post when the application form is published.
How TruePrivacy helps
TruePrivacy is software for Data Fiduciaries. It is not a registered Consent Manager. Its consent management keeps a record per person and purpose, an event log of every grant, withdrawal, rejection and update, and consent receipts.
Data Principals can manage preferences and withdraw consent in the privacy center, and notice campaigns send notices by email to existing users. Our Consent Manager vs CMP guide explains where each fits.
When does Consent Manager registration start under DPDP?
Rule 4 comes into force on 13 November 2026, one year after the DPDP Rules, 2025 were published (Rule 1).
What net worth does a Consent Manager need?
The First Schedule (Part A) requires a net worth of not less than ₹2 crore, among other conditions that include incorporation in India.
Can I apply to be a Consent Manager today?
Not yet. As of 4 November 2026 the application form has not been published, and the Board has no members yet.
Do Data Fiduciaries have to work with a Consent Manager?
No. Under s.6(7) a Data Principal may give, manage, review or withdraw consent through a Consent Manager; consenting directly to the fiduciary remains possible.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin