Rule 4 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Rule 4 is the rule under which a company applies to the Data Protection Board of India to be registered as a Consent Manager. It sets out how the Board inquires, registers or rejects, and what it can do afterwards if a Consent Manager does not keep to the conditions and obligations of the First Schedule.
Rule 4 is the only rule in the group that, under rule 1(3), comes into force one year after the date of publication of the Gazette. A person meeting the conditions in Part A of the First Schedule may apply to the Board for registration; the Board may inquire, then register or reject with reasons. A registered Consent Manager carries the Part B obligations. The Board can direct, and after a hearing, suspend or cancel registration. It can also call for information.
Commencement and the Act behind rule 4
Rule 1(3) says "Rule 4 shall come into force one year after the date of publication of this Gazette". Counting from the Gazette date of 13 November 2025, one year ends in mid-November 2026; confirm the exact date of publication before relying on a date. The other stages are in our article on rules 1 and 2.
The Consent Manager comes from section 6 of the Act, which allows a Data Principal to give, manage, review or withdraw consent through a Consent Manager registered with the Board. The Act's text is covered in Section 6 of the DPDP Act: the Consent Manager. Rule 4 supplies the registration procedure; the First Schedule supplies the conditions and obligations. The Schedule is explained in three articles: Part A conditions, Part B platform and security obligations, and Part B conflict of interest, audit and control.
Rule 4(1): who may apply and how
"A person who fulfils the conditions for registration of Consent Managers set out in Part A of First Schedule may apply to the Board for registration as a Consent Manager by furnishing such particulars and such other information and documents as the Board may publish in this behalf on its website."
Three things follow. The applicant must meet Part A, which begins with being a company incorporated in India. The application goes to the Board, not to the Central Government. And the particulars, information and documents are whatever the Board publishes on its website. What the Board has published is not in the Rules, so this article does not describe it. If you plan to apply, read the Board's website as it stands on the day you apply, and consider a legal consultation on whether your entity qualifies.
Rule 4(2): inquiry, registration or rejection
On receiving an application, the Board "may make such inquiry as it may deem fit to satisfy itself regarding fulfilment of the conditions set out in Part A of First Schedule". Then there are two outcomes:
| Board's view | What the Board does | Rule |
|---|---|---|
| Satisfied | Registers the applicant as a Consent Manager, under intimation to the applicant, and publishes on its website the particulars of the Consent Manager | 4(2)(a) |
| Not satisfied | Rejects the application and communicates the reasons for the rejection to the applicant | 4(2)(b) |
The inquiry is discretionary ("may make such inquiry as it may deem fit"). The Rules do not set a time within which the Board must decide, nor do they provide a form of appeal against a rejection within rule 4. Appeals under the Act are dealt with in rule 22 and our article on the appeal to the Appellate Tribunal, which concerns orders of the Board. Whether a rejection is such an order is not answered in rule 4; the text is silent.
Rule 4(3): obligations
"The Consent Manager shall have obligations as specified in Part B of First Schedule." Part B has thirteen items, from enabling consent through the platform to not transferring control without the Board's approval. They are explained in the two Part B articles linked above.
Rule 4(4): direction to adhere
If the Board "is of the opinion that a Consent Manager is not adhering to the conditions and obligations under this rule", it "may, after giving an opportunity of being heard, inform the Consent Manager of such non-adherence and direct the Consent Manager to take measures to ensure adherence". This is the first, milder step: a hearing, a notice of the non-adherence and a direction to correct it.
Rule 4(5): suspension or cancellation
The Board may take a stronger step "if it is satisfied that it is necessary so to do in the interests of Data Principals". The conditions are cumulative:
- The Board is satisfied that it is necessary in the interests of Data Principals.
- It gives the Consent Manager an opportunity of being heard.
- It acts "by order, for reasons to be recorded in writing".
Then it may (a) suspend or cancel the registration, and (b) "give such directions as it may deem fit to that Consent Manager, to protect the interests of the Data Principals". Note that rule 4(5) does not depend on a prior direction under rule 4(4); the text does not make the direction a precondition.
Rule 4(6): power to call for information
"The Board may, for the purposes of this rule, require the Consent Manager to furnish such information as the Board may call for." The power is limited "for the purposes of this rule", that is, registration, adherence and the steps in sub-rules (4) and (5). It is separate from the general power to call for information in rule 23, which is explained in our article on rule 23 and the Seventh Schedule.
An example
Lakshya Data Services Private Limited, an invented company incorporated in India, wants to run a consent platform for lenders and banks. It checks Part A of the First Schedule, collects what the Board has published on its website, and applies to the Board. If the Board registers it, the Board publishes its particulars on its website. A year later the Board forms the view that Lakshya has stopped publishing the shareholding information that Part B requires. It hears Lakshya and directs it to take measures to ensure adherence. If Lakshya ignores the direction and the Board is satisfied it is necessary in the interests of Data Principals, it can, after another hearing and by a written, reasoned order, suspend or cancel registration. The Rules contain no Illustration for rule 4; this example is ours.
Need help with a Consent Manager application?
Before you apply, it helps to test the company, its capital and its constitution against Part A. You can talk to our legal team about the structure, the memorandum and articles, and the documents to assemble.
Key takeaways
- Rule 4 starts one year after the date of publication of the Gazette (rule 1(3)).
- An applicant must meet Part A of the First Schedule and apply to the Board with the particulars and documents the Board publishes on its website.
- The Board may inquire, then register (and publish particulars) or reject (with reasons communicated).
- The Consent Manager has the Part B obligations.
- The Board may, after a hearing, direct a non-adhering Consent Manager to take measures, and may suspend or cancel by a reasoned written order in the interests of Data Principals.
- The Board may require information from the Consent Manager for purposes of rule 4.
Read next
- First Schedule Part A: conditions for registration of a Consent Manager
- First Schedule Part B: platform, records and security obligations
- Section 6 of the DPDP Act: the Consent Manager
- DPDP compliance checklist for businesses
Disclaimer: Based on the Digital Personal Data Protection Rules, 2025 as notified in the Gazette of India on 13 November 2025 (G.S.R. 846(E)), as consulted on 2 October 2026. The Rules come into force in three stages under rule 1; later amendments, notifications and anything published by the Data Protection Board of India should be checked. This article is general information, not legal advice; check the official text before acting.