Rule 4: Registration and Obligations of Consent Manager

Quick summary

What Rule 4 says

• A person meeting the First Schedule, Part A conditions may apply to the Board for registration as a Consent Manager.
• The Board may inquire into the application and either register the applicant (publishing its details) or reject it with reasons.
• A registered Consent Manager has ongoing obligations under First Schedule, Part B.
• If the Board finds a Consent Manager isn't adhering to conditions or obligations, it can, after a hearing, direct corrective measures — or suspend or cancel the registration and give directions to protect Data Principals' interests.
• The Board can require a Consent Manager to furnish any information it calls for.

Breaking it down

Two things are worth separating clearly: getting registered, and staying registered.

Getting registered is a real bar, not a formality. First Schedule, Part A requires the applicant to be a company incorporated in India, with a net worth of at least ₹2 crore, sound financial condition and management, directors and key personnel with a reputation for fairness and integrity, and an independently certified interoperable consent platform. This is designed to keep Consent Managers financially and operationally credible — not something a small startup can spin up overnight.

Staying registered means real, ongoing duties. Once registered, a Consent Manager must (among other things): let a Data Principal give, manage, review and withdraw consent across the Data Fiduciaries onboarded to its platform; keep a record of consents given, denied or withdrawn, and notices, for at least seven years; avoid conflicts of interest with the Data Fiduciaries it works with; and act in a fiduciary capacity toward the Data Principal — meaning its duty runs to the individual, not to the companies paying to be onboarded.

The Board keeps ongoing oversight. This isn't a one-time registration check. The Board can inquire, demand information, and — after giving the Consent Manager a chance to be heard — suspend or cancel a registration, or issue corrective directions, if things go wrong.

Why this rule matters

Consent Managers are meant to make consent easier for individuals, who might otherwise juggle separate consent settings across dozens of apps. Rule 4 is what keeps that promise credible: it stops just anyone from setting up a consent-management platform, and holds registered ones to a fiduciary standard once they're in.

Real-world example

Who needs to care about this rule

• Companies actively planning a Consent Manager product — this rule is your registration checklist.
• Data Fiduciaries deciding whether to integrate with a Consent Manager once the framework is operational, rather than building consent infrastructure entirely in-house.

Common questions

Related rules