Rule 4 — Registration and Obligations of Consent Manager

The Act's own definition of Consent Manager — a person registered with the Board who acts as a single point of contact enabling a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent, interoperable platform — makes registration mandatory in principle. Rule 4 is where that principle gets built into an actual gate: eligibility conditions before the door, ongoing obligations once inside, and standing supervisory power that follows a Consent Manager for as long as it's registered.

Getting in the door — Rule 4(1) and 4(2), First Schedule Part A

A person may apply for registration only if it meets the conditions in Part A of the First Schedule. Those conditions set a genuinely high bar: incorporation as a company in India, a minimum net worth of two crore rupees, sound financial standing and management, adequate business prospects and capital structure, directors and senior management with a clean reputation for fairness and integrity, and constitutional documents — the memorandum and articles of association — that lock in the conflict-of-interest obligations from Part B and can only be amended with the Board's prior approval. The applicant also needs independent certification that its consent platform meets the Board's published data-protection standards. On receipt of an application, Rule 4(2) lets the Board make whatever inquiry it thinks fit; if satisfied, it registers the applicant and publishes the particulars; if not, it rejects the application and has to give reasons. Nothing about this process is self-declared — a group entity of a Data Fiduciary, or a Data Processor, branding itself a Consent Manager doesn't clear Part A's independence requirements just because the product works.

What registration actually obligates — Rule 4(3), First Schedule Part B

Once registered, a Consent Manager takes on the obligations in Part B of the First Schedule, and they go well past the consent-capture interface itself. It has to let a Data Principal give, manage, review and withdraw consent, support both consent given directly and consent routed through another onboarded Data Fiduciary, and give the Data Principal access to her own consent records in machine-readable form on request — retained for at least seven years. It has to ensure the personal data it helps route isn't itself readable by the Consent Manager, take reasonable security safeguards, and never subcontract or assign its statutory obligations. And it has to act in a fiduciary capacity toward the Data Principal, actively avoid conflicts of interest with the Data Fiduciaries onboarded to its platform, and publish transparency disclosures about its own ownership and management. Part B treats a consent platform as fiduciary infrastructure, not a product funnel — neutrality between the Data Principal and every Data Fiduciary on the platform is the obligation, not a nice-to-have feature.

The Board doesn't stop watching after registration — Rule 4(4), 4(5), 4(6)

If the Board thinks a Consent Manager isn't adhering to Rule 4's conditions or obligations, it can — after giving the Consent Manager a hearing — flag the non-adherence and direct corrective measures. If it's satisfied that stronger action is necessary in the interests of Data Principals, it can, again after a hearing and by a reasoned written order, suspend or cancel the registration outright, and issue whatever directions it thinks fit to protect those Data Principals. And it can require the Consent Manager to furnish any information it calls for, at any time, for the purposes of this rule. This is active, ongoing oversight — a Consent Manager's registration is conditional for as long as it holds it, not a one-time credential.

Why this matters in practice

Because Rule 1(3) delays Rule 4 itself until one year after the Rules were published — around 13 November 2026 — there is, as of today, no mechanism by which any applicant can actually be registered as a Consent Manager. Every platform describing itself as one before that date, or claiming imminent registration, is describing a status that doesn't yet legally exist. This matters for procurement decisions now: organisations evaluating a consent-management platform should test it against Part A's independence and Part B's fiduciary-duty requirements before assuming it will clear registration when the window opens, not after.

Illustration: a bank's own technology subsidiary builds a consent-capture platform and offers it to sister companies within the group as a "Consent Manager." Even with strong technical features, Part A's independence conditions and Part B's conflict-of-interest obligations are built to catch exactly this structure — a Consent Manager acting as a neutral single point of contact can't simultaneously be an affiliate of the Data Fiduciaries it's meant to sit between.

How Rule 4 connects to the rest of the Rules and the Act

Rule 4 gives operational teeth to the Consent Manager definition in Section 2(g) of the Act, and its registration process — separate from every other Rule's eighteen-month timeline — is the one exception on its own middle schedule. Once a Consent Manager exists, the notice and consent mechanics in Rule 3 apply to what it presents to Data Principals just as they would to a Data Fiduciary presenting notice directly, and Rule 6's security safeguards obligation applies to it as well through Part B's own security clause.