Ch IPreliminary
S.1 Short title and commencementS.2 DefinitionsS.3 Application and scopeCh IIObligations of Data Fiduciary
S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data FiduciaryCh IIIRights and duties of Data Principal
S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data PrincipalCh IVSpecial provisions
S.16 Transfer outside IndiaS.17 ExemptionsCh VData Protection Board of India
S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the ChairpersonCh VIBoard powers and procedure
S.27 Powers and functions of the BoardS.28 Procedure followed by the BoardCh VIIAppeal and dispute resolution
S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertakingCh VIIIPenalties
S.33 Penalties and the ScheduleS.34 Penalties to Consolidated FundCh IXMiscellaneous
S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other ActsDPDP Rules 2025
Rule 4 is short. The detail sits in the First Schedule. This page sets out the official text, what each part says, when it takes effect and, with dates, what the Data Protection Board has and has not yet published. It is a reference page. For the wider picture of the role, see the Consent Manager guide.
In short
Rule 4 lets a company incorporated in India that meets the conditions in Part A of the First Schedule apply to the Data Protection Board to be registered as a Consent Manager, and it makes the Part B obligations binding on a registered Consent Manager. Rule 4 takes effect on 13 November 2026. Taking effect is not the same as being able to apply: Rule 4(1) leaves the application particulars to whatever the Board publishes on its website, and the Part A item 9 standards are also for the Board to publish. As of 11 October 2026 we found no official publication of either, and no registered Consent Manager.
Each row says what the law provides for, then whether we found an official publication. “Not found” means not found in the sources listed under Primary sources. It is not proof that nothing exists.
| Item | Where the law provides for it | Status |
|---|---|---|
| Rule 4 and Section 6(9) in force | Rule 1(3), G.S.R. 846(E); G.S.R. 843(E), paragraph (b) | Not yet. Scheduled for 13 November 2026. |
| Application particulars and documents | Rule 4(1): “as the Board may publish in this behalf on its website” | Not found. |
| Data protection standards and assurance framework | First Schedule, Part A, item 9(a): “as may be published by the Board on its website from time to time” | Not found. |
| Particulars of registered Consent Managers | Rule 4(2)(a): the Board publishes them on its website on registration | Not found. Rule 4 is not yet in force, so no registration under it exists. |
| Appointment of the Board’s Chairperson and Members | Section 19(2); Rule 17 | Not confirmed. MeitY invited applications on 6 May 2026 to prepare a panel for the Search-cum-Selection Committee. A Lok Sabha answer of 12 August 2026 cited a 6 June 2026 Employment News advertisement and named no appointees. |
An applicant has nothing to file until the Board publishes the particulars Rule 4(1) refers to, and cannot obtain the independent certification in item 9 until the standards exist. Until the Board publishes the particulars of a registered Consent Manager, a claim that a vendor is “registered” cannot be checked against an official source.
We reviewed the Act, the Rules and both commencement notifications on meity.gov.in, the Lok Sabha answer, and MeitY’s May 2026 recruitment circular and advertisement. MeitY’s data-protection-framework page and the Board’s own website could not be read with our tools, so check them directly before relying on a “not found”.
Rule 4 of the Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), 13 November 2025), headed “Registration and obligations of Consent Manager”. The middle column is the text as notified. The right column is a plain reading.
| Sub-rule | Official text | Plain reading |
|---|---|---|
| 4(1) | A person who fulfils the conditions for registration of Consent Managers set out in Part A of First Schedule may apply to the Board for registration as a Consent Manager by furnishing such particulars and such other information and documents as the Board may publish in this behalf on its website. | Only an applicant that meets Part A can apply. What to furnish is whatever the Board publishes on its website. |
| 4(2) | On receipt of such application, the Board may make such inquiry as it may deem fit to satisfy itself regarding fulfilment of the conditions set out in Part A of First Schedule, and if it (a) is satisfied, register the applicant as a Consent Manager, under intimation to the applicant, and publish on its website the particulars of such Consent Manager; or (b) is not satisfied, reject the application and communicate the reasons for the rejection to the applicant. | The Board decides after any inquiry it thinks fit. Approval means registration and publication of the particulars. Rejection must come with reasons. The text sets no fee, form or decision deadline. |
| 4(3) | The Consent Manager shall have obligations as specified in Part B of First Schedule. | Part B applies to every registered Consent Manager. |
| 4(4) | If the Board is of the opinion that a Consent Manager is not adhering to the conditions and obligations under this rule, it may, after giving an opportunity of being heard, inform the Consent Manager of such non-adherence and direct the Consent Manager to take measures to ensure adherence. | First step on non-compliance: a hearing, notice of the failure, and a direction to fix it. |
| 4(5) | The Board may, if it is satisfied that it is necessary so to do in the interests of Data Principals, after giving the Consent Manager an opportunity of being heard, by order, for reasons to be recorded in writing, (a) suspend or cancel the registration of such Consent Manager; and (b) give such directions as it may deem fit to that Consent Manager, to protect the interests of the Data Principals. | Second step: suspension or cancellation by a reasoned order, after a hearing, where needed to protect Data Principals. |
| 4(6) | The Board may, for the purposes of this rule, require the Consent Manager to furnish such information as the Board may call for. | The Board can demand information from a Consent Manager. |
An applicant must meet every condition. Items 1 and 4 are objective tests. Items 2, 3, 5, 6 and 8 call for the Board’s judgement. Item 9 depends on standards the Board has yet to publish.
| Item | Condition (official wording) | Note |
|---|---|---|
| 1 | The applicant is a company incorporated in India. | “Company” has the meaning in the Companies Act, 2013 (Schedule note (b)). An individual, a partnership or a foreign company does not qualify. |
| 2 | The applicant has sufficient capacity, including technical, operational and financial capacity, to fulfil its obligations as a Consent Manager. | No numeric test is given. |
| 3 | The financial condition and the general character of management of the applicant are sound. | Judgement-based. |
| 4 | The net worth of the applicant is not less than two crore rupees. | Net worth means total assets less liabilities as shown in the applicant’s books of accounts (Schedule note (c)). That is ₹2 crore at a minimum. |
| 5 | The volume of business likely to be available to and the capital structure and earning prospects of the applicant are adequate. | Judgement-based. |
| 6 | The directors, key managerial personnel and senior management of the applicant company are individuals with a general reputation and record of fairness and integrity. | Applies to the people, not only the company. |
| 7 | The memorandum of association and articles of association contain provisions requiring that the obligations under items 9 and 10 of Part B are adhered to, that policies and procedures are in place to ensure such adherence, and that such provisions may be amended only with the previous approval of the Board. | The conflict-of-interest safeguards must be written into the company’s constitutional documents, and locked against change without Board approval. |
| 8 | The operations proposed to be undertaken by the applicant are in the interests of Data Principals. | Judgement-based. |
| 9 | It is independently certified that (a) the interoperable platform of the applicant to enable the Data Principal to give, manage, review and withdraw her consent is consistent with such data protection standards and assurance framework as may be published by the Board on its website from time to time; and (b) appropriate technical and organisational measures are in place to ensure adherence to such standards and framework and effective observance of the obligations under item 11 of Part B. | No standards or framework found published, so this cannot yet be certified. The text does not say who may certify. |
These bind a registered Consent Manager (Rule 4(3)). The wording below follows the official text closely.
| Item | Obligation |
|---|---|
| 1 | Enable a Data Principal using its platform to give consent to processing by a Data Fiduciary onboarded onto the platform, either directly to that Data Fiduciary or through another onboarded Data Fiduciary that holds the data with her consent. |
| 2 | Ensure that the manner of making available or sharing the personal data is such that its contents are not readable by the Consent Manager. |
| 3 | Maintain on its platform a record of consents given, denied or withdrawn; notices preceding or accompanying requests for consent; and sharing of her personal data with a transferee Data Fiduciary. |
| 4 | Give the Data Principal access to that record; on her request and in accordance with its terms of service, provide the information in machine-readable form; and keep the record for at least seven years, or for such longer period as the Data Principal and the Consent Manager agree or as law requires. |
| 5 | Develop and maintain a website or app, or both, as the primary means through which a Data Principal accesses its services. |
| 6 | Not sub-contract or assign the performance of any of its obligations under the Act and the Rules. |
| 7 | Take reasonable security safeguards to prevent personal data breach. |
| 8 | Act in a fiduciary capacity in relation to the Data Principal. |
| 9 | Avoid conflict of interest with Data Fiduciaries, including in respect of their promoters and key managerial personnel. |
| 10 | Have measures to ensure no conflict of interest arises because its directors, key managerial personnel or senior management hold a directorship, financial interest, employment or beneficial ownership in Data Fiduciaries, or have a material pecuniary relationship with them. |
| 11 | Publish in an easily accessible manner, on its website or app: its promoters, directors, key managerial personnel and senior management; every person holding more than two per cent of its shares; every body corporate in which any of those individuals holds more than two per cent of the shares, as on the first day of the preceding calendar month; and any other information the Board directs in the interests of transparency. |
| 12 | Have effective audit mechanisms to review, monitor, evaluate and report to the Board, periodically and when the Board directs, on its technical and organisational controls, its continued fulfilment of the registration conditions, and its adherence to its obligations under the Act and the Rules. |
| 13 | Not transfer control of the company, by sale, merger or otherwise, except with the Board’s previous approval and subject to any conditions it specifies. |
Item 3 requires a record, item 4 requires access to it and retention for at least seven years, and item 12 requires an audit mechanism. The words “tamper-proof” and “immutable” do not appear in Part B.
Two notifications dated 13 November 2025 set the dates: the Rules (G.S.R. 846(E)) and the Act’s commencement notification (G.S.R. 843(E)).
| Commences | Provisions | Source |
|---|---|---|
| 13 November 2025 | Rules 1, 2 and 17 to 21. Act: Section 1(2), Section 2, Sections 18 to 26, Sections 35 and 38 to 43, and Section 44(1) and (3). | Rule 1(2); G.S.R. 843(E), paragraph (a) |
| 13 November 2026 | Rule 4 (with the First Schedule). Act: Section 6(9) (registration) and Section 27(1)(d) (the Board’s power to inquire into breach of a registration condition). | Rule 1(3); G.S.R. 843(E), paragraph (b) |
| 13 May 2027 | Rules 3, 5 to 16, 22 and 23. Act: Sections 3 to 5, Section 6(1) to (8) and (10), Sections 7 to 17, Section 27 except clause (d), Sections 28 to 34, 36 and 37, and Section 44(2). | Rule 1(4); G.S.R. 843(E), paragraph (c) |
For a Consent Manager this splits into two stages:
Between 13 November 2026 and 13 May 2027 Rule 4 is in force but the Board’s inquiry procedure (Section 28) and penalty provision (Section 33) are not. How the Board can act in that window is a question of legal interpretation. Take legal advice before relying on either reading.
Both notifications are headed 13 November 2025 and set “one year” and “eighteen months” from publication. We count from that date. The electronic copies carry an upload reference ending 14112025, so confirm with counsel if a one-day difference matters to you.
Section 2(g) defines a Consent Manager as a person registered with the Board. A claim of registration should therefore trace back to the Board.
Calling a consent-management platform or cookie banner “the Consent Manager”; saying “government-registered” with no Board entry to point to; or claiming a registration dated before Rule 4 takes effect on 13 November 2026.
Several claims in circulation are not supported by the text. Each row gives the official position.
| What you may read | The official position |
|---|---|
| Every business must use a Consent Manager. | Section 6(7) says a Data Principal may give, manage, review or withdraw consent through one. Rule 4 does not oblige a Data Fiduciary to use or integrate with one. |
| Every business must register as a Consent Manager. | Rule 4 lets an applicant that meets Part A apply. It is for companies that want to operate as a Consent Manager. |
| A consent-management platform or cookie banner is a Consent Manager. | Section 2(g) defines a Consent Manager as a person registered with the Board. A platform is not registered by default. |
| Consent records must be tamper-proof or immutable. | Part B items 3 and 4 require a record, access to it and seven-year retention. Those words are not in the text. |
| The Board has opened registration. | Rule 4(1) leaves the application particulars to the Board to publish. We found no such publication as of 11 October 2026. |
| A list of registered Consent Managers exists. | Not found. Rule 4(2)(a) provides for publication once a registration is made. |
Whatever happens with registration, a Data Fiduciary keeps its own duties on notice, consent, records and withdrawal. See where yours stand.
A company incorporated in India with a net worth of not less than ₹2 crore that meets the other Part A conditions, including independent certification of its platform under item 9. The Board decides each application under Rule 4(2).
Not as far as we found. Rule 4 takes effect on 13 November 2026, and Rule 4(1) leaves the application process to what the Board publishes on its website. As of 11 October 2026 we found no such publication.
No. Section 6(7) says a Data Principal may give, manage, review or withdraw consent through a Consent Manager. Nothing in Rule 4 obliges a Data Fiduciary to adopt or integrate one, and your own duties on notice, consent and records stay with you.
No. Only a person registered with the Board is a Consent Manager (Section 2(g)). A platform vendor could apply if it is a company incorporated in India that meets Part A, and it would become a Consent Manager only on registration.
At least seven years, or for such longer period as the Data Principal and the Consent Manager agree or as law requires (Part B, item 4).
After a hearing it can tell the Consent Manager about the non-adherence and direct it to fix it (Rule 4(4)). Where necessary in the interests of Data Principals, and after a hearing, it can suspend or cancel the registration by a reasoned order (Rule 4(5)). It can also require information (Rule 4(6)). The Act’s penalty provisions commence on 13 May 2027.
Yes. Rule 14(3) requires every Data Fiduciary and Consent Manager to publish a grievance redressal process that responds within a reasonable period not exceeding 90 days, and Section 13 gives Data Principals the right to a grievance mechanism. Both commence on 13 May 2027.
Last verified: 11 October 2026. This is general information about the DPDP Act and Rules, not legal advice. dpdpactindia.in is an independent resource, is not affiliated with any government body or any consent-technology vendor, and does not register or approve Consent Managers.
Newsletter
Know what changed. Know what to do next.
Practical updates on India's DPDP Act: important regulatory developments, implementation priorities and tools you can use at work.
Consultant-led and partner-backed.