DPDP reference

Rule 4: Registration and obligations of Consent Manager

Last checked 6 Nov 2026

A person meeting Part A of the First Schedule may apply to the Board for registration as a Consent Manager (Rule 4(1)). Conditions include being a company incorporated in India with a net worth of at least two crore rupees, and independent certification of its interoperable platform (First Schedule, Part A).

Part B sets its obligations: acting in a fiduciary capacity for the Data Principal, not being able to read the data it passes, keeping records of consents, notices and sharing for at least seven years, not assigning its obligations, avoiding conflicts of interest, publishing ownership details and keeping audit mechanisms. The Board may suspend or cancel registration after a hearing (Rule 4(5)).

Applies to
A company that wishes to act as a Consent Manager. Other businesses meet this rule when a Data Principal uses one (s.6(7)).
Starts
13 Nov 2026 (Rule 1(3)).
Penalty
Up to ₹50 crore (s.33, Schedule item 7), with suspension or cancellation of registration under Rule 4(5).
Source
G.S.R. 846(E), Digital Personal Data Protection Rules, 2025, rule 4; G.S.R. 892(E), corrigenda

Questions

What net worth does a Consent Manager need?

Not less than two crore rupees (First Schedule, Part A, item 4).

How long must a Consent Manager keep records?

At least seven years, or longer if agreed with the Data Principal or required by law (First Schedule, Part B, item 4(c)).

Related

Next

Join early access

Not legal advice.