IndiaDigital Personal Data Protection Rules, 2025, Consent Manager registration
G.S.R. 846(E) Digital Personal Data Protection Rules, 2025, rule 4 and First Schedule; Digital Personal Data Protection Act, 2023 (22 of 2023), ss. 6(9) and 27(1)(d)
In force since , under challenge in court.
A comprehensive regime rule binding private bodies.
- Court action
A suit challenging this law is pending. No court has blocked it. Premium data
What it requires
- From , a company that runs a platform through which people in India give, manage, review and withdraw their consent to Data Fiduciaries, acting as a Consent Manager, must first be registered with the Data Protection Board of India. It must be a company incorporated in India with a net worth of not less than two crore rupees, and once registered it must keep each user's record of consents, notices and data sharing for at least seven years and must not sub-contract its obligations.
These lines are LexLint's reading of the law's text.
What this law does
Rule 4 lets a company that meets the conditions in Part A of the First Schedule apply to the Data Protection Board for registration as a Consent Manager. Part A requires the applicant to be a company incorporated in India with a net worth of not less than two crore rupees.
A registered Consent Manager must meet the obligations in Part B, among them keeping its record of each Data Principal's consents, the notices preceding or accompanying requests for consent and the sharing of their personal data for at least seven years. Rule 4 comes into force on , one year after the Gazette of that published the Rules. Section 6(9) of the Act requires every Consent Manager to be registered with the Board.
Section 27(1)(d) of the Act empowers the Board, on an intimation that a Consent Manager has breached a condition of its registration, to inquire into the breach and impose a penalty. Both sections come into force on the same day as Rule 4, one year from the publication of the commencement notification of .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .