Rule 4 · Section 6(7)
Prepare for DPDP Consent Managers (Rule 4)
A Consent Manager acts for the Data Principal, not for you. Here is what Rule 4 changes, and what your own consent record still has to do.
Sample workspace
Consent record DP-••5106
- Loan applicationGiven
- Credit bureau checkGiven
- Marketing emailsWithdrawn
- Proof of consents.6(10)
Event log
- Consent given on example.com
- Receipt issued
- Marketing emails withdrawn on preference page
Short answer
A Consent Manager is a person registered with the Data Protection Board who lets a Data Principal give, manage, review and withdraw consent through an accessible, transparent and interoperable platform (s.6(7) to (9)). Rule 4 comes into force on 13 November 2026; its conditions include being a company incorporated in India with a net worth of not less than ₹2 crore, and the application form is not published yet. Because a Data Principal may use a Consent Manager, consent given directly to you remains possible, and you still have to prove notice and consent (s.6(10)).
What TruePrivacy gives you today
Whichever route a Data Principal uses to consent, the Data Fiduciary must still be able to prove notice and consent (s.6(10)). Your own consent record is what you show, so it needs to be complete before any Consent Manager is involved.
A consent record per person and purpose, with every grant, withdrawal, rejection and update logged.
Consent receipts and an audit trail exportable as CSV.
A preference page and privacy center where people change their choices with you directly.
An API and webhooks for connecting TruePrivacy with your other systems.
How to prepare for Consent Managers
- 01Keep a complete direct record
Record consent per purpose, so you can prove notice and consent whichever route people use (s.6(10)).
- 02Watch for the form
Rule 4 comes into force on 13 November 2026, but the application form is not published yet. Follow Rule 4 for updates.
- 03Decide your approach
Decide with counsel whether and when you will accept consent through registered Consent Managers, and for which purposes.
- 04Map their consent to your purposes
When a Consent Manager is registered, ask how it will share consent changes with you, and map them to the purposes in your record. Keep the direct route open, since a Data Principal may still consent with you directly.
Mapped to the Act and Rules
| Duty | Section or rule | What TruePrivacy does |
|---|---|---|
| A Data Principal may act through a Consent Manager | s.6(7) | Keeps your direct consent record per person and purpose |
| Consent Manager accountable to the Data Principal | s.6(8) | Not applicable: TruePrivacy acts for you, the Data Fiduciary |
| Consent Manager registered with the Board | s.6(9), Rule 4 | TruePrivacy is not a registered Consent Manager |
| Withdraw consent as easily as it was given | s.6(4) | Preference page and privacy center |
| Prove notice and consent | s.6(10) | Event log, consent receipts and an exportable audit trail |
TruePrivacy is not a Consent Manager
TruePrivacy is compliance software for Data Fiduciaries and is not a registered Consent Manager. No Board members have been appointed yet and the application form is not published. Check with counsel before relying on any Consent Manager arrangement.
The Board can suspend or cancel a Consent Manager's registration after a hearing (Rule 4), so plan for consent records to stay usable if an arrangement ends. The Consent Manager vs CMP guide sets out the difference in more detail.
Works with
Is a Consent Manager the same as a consent management platform?
No. A Consent Manager is registered with the Board under Rule 4 and acts for the Data Principal. A consent management platform is software a Data Fiduciary uses to record consent.
Do I have to use a registered Consent Manager?
No. Section 6(7) says a Data Principal may act through a Consent Manager, so consent given directly to you remains possible.
When can a Consent Manager apply?
Rule 4 comes into force on 13 November 2026, but the application form is not published yet. Conditions include being a company incorporated in India with a net worth of not less than ₹2 crore.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin