13 November 2026 is a date for Indias data protection framework. Rule 4 of the Digital Personal Data Protection Rules, 2025 dealing with the registration and obligations of Consent Managers starts today.
For companies working with data this brings up an important question: what exactly is a Consent Manager allowed and expected to do?
A Consent Manager is not another privacy application or a tool that shows consent banners. It is a middleman meant to give people more control over how their personal data is handled.
What is a Consent Manager?
Section 2(g) of the DPDP Act 2023 describes a Consent Manager as a person registered with the Data Protection Board of India who acts as a point of contact to help a Data Principal give, manage, review and take back consent through an easy, clear and compatible platform.
In terms picture a person using five different digital platforms: an insurance app, an online shopping site, a health app, a bank app and an investment app.
Than going through the consent settings of each platform individually the person should be able to manage consent through one common Consent Manager interface.
That is the idea behind the system.
Registration is the step
Rule 4 creates a formal registration process.
Under Part A of the First Schedule an applicant has to meet conditions, including:
- Being a company in India.
- Having good financial and operational ability.
- A minimum net worth of ₹2 crore.
- Management with a reputation for fairness and honesty.
- A certified compatible platform.
The applicant has to apply to the Board with the information and documents the Board needs.
The Board can check the application. Register the applicant if it is satisfied the conditions are met. Registration is not automatic just because an organization meets the requirements.
What can a registered Consent Manager do?
The main job is to help with consent management on behalf of the Data Principal.
The law expects the following jobs:
First helping with consent.
The platform should let people give consent to Data Fiduciaries through the Consent Manager.
Second managing consent.
People should be able to manage the permissions they have given than losing control after the first time they give consent.
Third reviewing consent.
A Data Principal should be able to look at the consent-related information and records kept through the platform.
Fourth helping with withdrawal.
The person should have a way to take back consent through the Consent Manager. The withdrawal must be. Shown in the right process.
Fifth, keeping records.
The Consent Manager must keep records of consent and sharing of data through its platform. These records are important for being open and responsible.
Can a Consent Manager. Use personal data on its own?
This is a point.
A Consent Manager is supposed to act in a way for the Data Principal. It is not meant to become another business intermediary that uses information for unrelated purposes.
The First Schedule also has rules about conflicts of interest and being separate from Data Fiduciaries.
The Consent Manager must avoid conflicts with its owners, directors, important people and senior staff. It must also share information about ownership and management.
Its job is to help the person control their consent not to have rights over the persons personal data.
What responsibilities start now?
Rule 4 and the First Schedule create duties for registered Consent Managers, including:
- Building and keeping a website or app as the main way to get services.
- Keeping records of consent and data sharing.
- Giving people access to their records.
- Providing record information in a format that machines can read when asked following the terms of service.
- Keeping records for least seven years unless longer rules apply.
- Putting in place security measures.
- Keeping audit systems.
- Stopping conflicts of interest.
- Sharing information about management and ownership.
The Rules also stop people from giving the work of a Consent Manager to someone
These are not just suggested industry steps. They are part of the law.
Does Rule 4 mean the whole consent system is running today?
No. This is where legal facts matter.
The start of the DPDP Act is done in parts.
Section 6(9) which is about registering Consent Managers starts after one year. However Section 6(1) to (8), including the parts about consent taking it back and helping with Consent Managers is set to start after eighteen months.
So Rule 4 being active on 13 November 2026 should not be mixed up with every part of the law about managing consent.
The difference between registration and the full start of the law about consent must be clear.
Rule 4 is a step in the law. It creates the way for companies wanting to be registered Consent Managers and adds real rules, about financial strength, technology, security, openness, independence and checking.
Being registered alone won’t make people trust it.
A good Consent Manager will be judged by if people can really understand, handle and use their consent without much trouble.
The real test is not if an organization made a consent dashboard. It is if that dashboard gives people control.
