Rule 4
DPDP Rule 4: Consent Manager registration
Rule 4 sets how a company registers with the Data Protection Board as a Consent Manager and what it must keep doing once registered. It starts on 13 November 2026.
Short answer
Rule 4 of the DPDP Rules, 2025 (G.S.R. 846(E)) governs the registration and obligations of Consent Managers and starts on 13 November 2026 (Rule 1). The conditions in Part A of the First Schedule include being a company incorporated in India with a net worth of not less than ₹2 crore, and the Board can suspend or cancel a registration after giving a hearing. As of 4 November 2026 the application form has not been published and the Board has no members.
When Rule 4 starts
Rule 1 brings Rule 4 into force one year after the Rules were published, on 13 November 2026. It is the only rule that starts on that date.
Rule 4 gives effect to s.6(9): the Act says every Consent Manager must be registered with the Board, and Rule 4 sets the registration and the obligations that follow.
| Date | What happens |
|---|---|
| 13 November 2025 | Rules published as G.S.R. 846(E); definitions and the Board's set-up start (Rules 1, 2 and 17 to 21) |
| 13 November 2026 | Rule 4 starts: registration and obligations of Consent Managers |
| 13 May 2027 | Core obligations for Data Fiduciaries begin (Rules 3, 5 to 16, 22 and 23) |
Who can apply
Rule 4 requires a Consent Manager to register with the Board. The conditions in Part A of the First Schedule include:
- being a company incorporated in India; and
- a net worth of not less than ₹2 crore.
Part A sets further conditions, so read it in full with counsel and your auditors. A Consent Manager must also fit the s.2 definition: a single point of contact for Data Principals, working through an accessible, transparent and interoperable platform. Registration is for a company that wants to act as a Consent Manager; a Data Fiduciary does not need it to collect its own consents.
What registration brings with it
- Accountability to the Data Principal (s.6(8)).
- Continuing obligations under Rule 4 and the First Schedule.
- A published grievance response period of no more than 90 days (Rule 14(3)).
- Grievance redressal that Data Principals must exhaust before going to the Board (s.13(3)).
- Oversight by the Board, which can suspend or cancel a registration after giving a hearing.
What is still missing on 4 November 2026
The application form has not been published, and no Chairperson or Members of the Board have been appointed. Treat any offer to “apply now” with care, and check with counsel before you commit money to an application.
What prospective applicants can do now:
- 01Check eligibility
Confirm incorporation in India and a net worth of not less than ₹2 crore with your auditors, and read every Part A condition.
- 02Design the platform
Build for the s.2 test: accessible, transparent and interoperable, letting people give, manage, review and withdraw consent.
- 03Set up grievance redressal
Decide your grievance response period, no more than 90 days, and how you will keep to it.
- 04Watch for the form
Track the Gazette and MeitY for the application form and for Board appointments.
What Rule 4 means for Data Fiduciaries
For a Data Fiduciary, Rule 4 means that some people may later give or withdraw consent through a registered Consent Manager (s.6(7)). Direct consent remains possible, and your duty to prove notice and consent stays with you (s.6(10)).
| Role | Main duties |
|---|---|
| Consent Manager | Lets the Data Principal give, manage, review and withdraw consent; accountable to the Data Principal (s.6(8)); runs its own grievance redressal (s.13(3), Rule 14(3)) |
| Data Fiduciary | Gives the notice (s.5, Rule 3); proves notice and consent (s.6(10)); stops processing within a reasonable time after withdrawal (s.6(6)) |
The difference between a registered Consent Manager and consent software is set out in Consent Manager vs CMP and on Consent Managers under the Act.
How TruePrivacy helps
TruePrivacy is consent management software for Data Fiduciaries; it is not a registered Consent Manager. Consent management keeps a consent record per person and purpose with an event log and consent receipts, and the grievance desk runs grievances against the 90-day limit.
Read how TruePrivacy approaches Consent Managers, and our registration explainer for the background.
When does Consent Manager registration open?
Rule 4 starts on 13 November 2026 (Rule 1). As of 4 November 2026 the application form had not been published.
Can I apply to be a Consent Manager now?
Not yet. The form has not been published and the Board has no members. Be wary of any “apply now” offer.
Must a Consent Manager be an Indian company?
Yes. The conditions in Part A of the First Schedule include being a company incorporated in India, with a net worth of not less than ₹2 crore.
Can a Consent Manager's registration be cancelled?
Yes. The Board can suspend or cancel a registration after giving the Consent Manager a hearing.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin