Rule 4
Consent Manager vs consent management platform
The names sound alike, but one is a regulated role under the Act and the other is software. Mixing them up leads to wrong buying and compliance decisions.
Short answer
A Consent Manager is a person registered with the Data Protection Board (s.6(9), Rule 4), accountable to the Data Principal (s.6(8)), who acts as a single point of contact for people to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform. A consent management platform (CMP) is software a Data Fiduciary runs to collect and record consent for its own purposes. Rule 4 comes into force on 13 November 2026, and its conditions include being a company incorporated in India with a net worth of not less than ₹2 crore; the application form is not published yet.
Side by side
| Aspect | Registered Consent Manager | Consent management platform (CMP) |
|---|---|---|
| What it is | A legal role defined in the Act (s.2) | A category of software |
| Who it serves | The Data Principal, to whom it is accountable (s.6(8)) | The Data Fiduciary that runs it |
| Registration | Must be registered with the Board (s.6(9), Rule 4) | No registration |
| Eligibility | Conditions in Part A of the First Schedule, including a company incorporated in India and a net worth of not less than ₹2 crore | None under DPDP |
| Scope | A single point of contact across fiduciaries, through an interoperable platform | One fiduciary's websites, apps and records |
| Oversight | The Board can suspend or cancel registration after a hearing (Rule 4) | Your own governance; you remain responsible as the fiduciary |
| Start date | Rule 4 in force from 13 November 2026; form not published yet | Available now |
How the two fit together
Under s.6(7), a Data Principal may give, manage, review or withdraw consent through a Consent Manager. That is an option for the person; consenting directly to you remains possible, so you still need your own consent flow.
Whichever route a person uses, you as the Data Fiduciary must give a notice (s.5) and be able to prove notice and consent (s.6(10)). A CMP is one way to do that for consent given directly to you.
A Consent Manager does not take over your duties as a fiduciary. You still decide purposes, stop processing after a withdrawal (s.6(6)), erase when the purpose is served (s.8(7)) and answer requests.
When you need which
- 01You collect consent on your own website or app
You need a consent management capability, built or bought. That is a CMP.
- 02You want to be people's single point of contact across many companies
That is the Consent Manager role. It needs Rule 4 registration and the First Schedule conditions.
- 03People may manage their consent to you through a Consent Manager
Plan how consents and withdrawals made through registered Consent Managers will reach your records, once any are registered.
- 04You only process data for your own purposes
You need a CMP, not registration.
What we know about Rule 4 registration
- Rule 4 comes into force on 13 November 2026 (Rule 1).
- Consent Managers register with the Board; the conditions are in Part A of the First Schedule.
- The conditions include being a company incorporated in India and a net worth of not less than ₹2 crore.
- The Board can suspend or cancel a registration after giving a hearing.
- The application form is not published yet, and the Board has no members yet.
Registration under Rule 4 is not yet possible in practice. If a product is described as a DPDP Consent Manager, ask the provider whether it is registered under Rule 4 or is a CMP.
Questions to ask a provider
- Are you registered with the Board as a Consent Manager, or are you software we run?
- Who are you accountable to: us, or the Data Principal?
- Where are consent records stored, and can we export them?
- Does each consent record show the notice version, purpose, action and time?
- How easily can a person withdraw consent?
- If you describe yourself as a Consent Manager, can you show your Rule 4 registration?
How TruePrivacy helps
TruePrivacy is a consent management platform: software you run as a Data Fiduciary. It is not a registered Consent Manager and is not accountable to Data Principals under s.6(8).
Consent management keeps purposes, a consent record per person and purpose, an event log, receipts and a preference page. The consent banner and SDKs for iOS, Android and React Native collect consent on your properties, and notice campaigns re-consent existing users by email. Related tool: the consent checklist.
Is a CMP the same as a Consent Manager under DPDP?
No. A Consent Manager is registered with the Board under Rule 4 and accountable to the Data Principal (s.6(8)). A CMP is software a fiduciary runs.
Must people use a Consent Manager?
No. Section 6(7) says a Data Principal may act through a Consent Manager; consenting directly to the fiduciary remains possible.
What net worth does a Consent Manager need?
Not less than ₹2 crore, among the First Schedule conditions, which also require a company incorporated in India (Rule 4).
When can companies apply to be Consent Managers?
Rule 4 comes into force on 13 November 2026, but the application form is not published yet and the Board has no members.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin