Rule 4
Registration and obligations of Consent Manager
Sets the route to registration as a Consent Manager, the Board’s power to reject, suspend or cancel it, and where the ongoing obligations live.
Read this before you cite anything here
These pages are a plain-English restatement, written to help you find the right provision and understand what it asks of you. They are not the text of the statute, and nothing here should be quoted as though it were. Section and rule numbers are exact, and every page names its source.
What it says
- 01
- A person meeting the conditions in Part A of the First Schedule may apply to the Board for registration as a Consent Manager. The Board may make inquiries and either register the applicant or reject the application with reasons recorded.
- 02
- The obligations of a registered Consent Manager are set out in Part B of the First Schedule.
- 03
- The Board may suspend or cancel a registration after giving an opportunity of being heard, and may call for information from a Consent Manager.
In practice
Two things follow from Part A and Part B being separate. The Rs 2 crore net worth and India-incorporation bar are registration gates, while the seven-year record retention and the rule that the Consent Manager cannot read the data are continuing conditions. And routing consent through a Consent Manager outsources the mechanism, not the burden: under s.6(10) the Data Fiduciary still has to prove notice and valid consent, which is a live question if a registration is later cancelled.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Rule 4 is not in force yet. If that date moves, or the Board says anything about how it will be read, you will get one email about it and nothing else.