RULE 4
Registration and obligations of Consent Manager
Official Statutory Text
MeitY Gazette Notified
Section 40 Delegated Authority
Official Legal Text — Gazette of India
Rule 4
4. (1) A person who fulfils the conditions for registration of Consent Managers set out in Part A of First Schedule may apply to the Board for registration as a Consent Manager...
(3) The Consent Manager shall have obligations as specified in Part B of First Schedule.
Note: The First Schedule requires Consent Managers to be Indian companies with at least Rs. 2 Crore net worth, and mandates they maintain consent records for 7 years.
Plain-Language Compliance Breakdown (Editorial Analysis)
What this means: Companies can register to become "Consent Managers" (platforms where users can manage all their app permissions from one dashboard). They must be financially stable Indian companies and face strict audits to ensure they do not misuse the consent logs.
Key Practical Takeaways for Compliance Teams
-
•
Delegated Specificity: This rule provides concrete operational criteria that must be reflected in technical architectures and compliance records.
-
•
Audit Readiness: Ensure written SOPs, consent logs, and security controls correspond directly to the statutory wording of Rule 4.
-
•
Statutory Traceability: In any legal interpretation, the exact Gazette text above takes precedence over internal summaries.
Parent DPDP Act 2023 Provisions
← PREVIOUS RULE
Rule 3: Notice given by Data Fiduciary to Data Principal
NEXT RULE →
Rule 5: Processing of personal data by State and its instrumentalities
Statutory text reproduced under open access public domain principles. This reader is designed for educational and compliance decision support.