Rule 4Notice, Consent & Consent Managers
Registration and obligations of Consent Managers
What the Rule sets out
A Consent Manager must be an Indian-registered company meeting prescribed technical, financial and governance standards, and must maintain an interoperable, auditable record of every consent given, managed, and withdrawn through its platform.
What this means in practice
- If you plan to operate as a Consent Manager (rather than just integrate with one), expect a formal registration process with the Board, not a self-certification.
- Most Data Fiduciaries will only need to integrate with a registered Consent Manager's API, not build one themselves.
Summarised for practical use from the publicly notified DPDP Rules, 2025. Confirm exact clause text against the official Gazette notification before relying on it for compliance decisions.