DPDP Rule 4 Explained Line by Line: Application, Inquiry, Rejection, Suspension

Rule 4 is the shortest rule that matters most to a Consent Manager. Six sub-rules, no timelines, and a lot left to the Board’s discretion. Most summaries paraphrase it in a sentence. This one reads it sub-rule by sub-rule and then lists what it does not say.

Rule 4 of the DPDP Rules, 2025 comes into force one year after the Gazette’s publication, which puts it at 13 November 2026. Some sources say 14 November, so confirm the commencement wording in Rule 1(3). For the business context, see our 13 November explainer.

When Rule 4 starts

Rule 1(2) brings Rules 1, 2 and 17 to 21 into force on publication. Rule 1(3) says Rule 4 comes into force one year after the date of publication of the Gazette. The Act’s own timing for Consent Managers, Section 6(9), follows the same point. Everything else, including most duties on ordinary businesses, waits until 13 May 2027, an 18-month schedule that PIB’s note on the notified Rules describes. We read Rule 1(3) from published transcriptions, so verify it in the Gazette.

The six sub-rules

Part A, with its nine conditions, and Part B, with thirteen obligations, do the heavy lifting. Rule 4 is the procedure that connects them. Our guide to registering as a Consent Manager maps Part A to evidence, and the post on the ₹2 crore net worth condition goes deeper on one of the nine.

Two tracks: before and after registration

It helps to see Rule 4 as two sequences. Before registration: apply under 4(1), inquiry under 4(2), then registration or rejection. After registration: a concern about non-adherence, a hearing under 4(4) or 4(5), then a direction, suspension or cancellation. Rule 4(6) information requests can come at either stage.

Notice the asymmetry. Rule 4(2) mentions no hearing before a rejection, while 4(4) and 4(5) require one before directions, suspension or cancellation. The text gives reasons on rejection and a written order on suspension. That difference matters if you are deciding how much to invest before applying.

How it connects to the Act

Rule 4 is made under the DPDP Act, 2023. Section 6(9) requires a Consent Manager to be registered with the Board on prescribed conditions, and Section 6(8) makes it accountable to the Data Principal. Section 27(1)(d) is a second route: the Board can inquire into a breach of the conditions of registration and impose a penalty. So a registered Consent Manager can face both the corrective powers in Rule 4 and a penalty under the Act. Our guide to the Data Protection Board explains how those inquiries run, and the Consent Manager explainer covers the role itself.

What Rule 4 leaves open

• Time. No deadline for the Board to decide.
• Money. No application fee is stated.
• Challenge. Rule 4 names no route to challenge a rejection. Any remedy would have to come from elsewhere in the framework, so take legal advice.
• The inquiry. "As it may deem fit" is wide. We do not know what it will involve.
• Certification. The Part A certificate is against standards the Board has yet to publish.

There is also a practical gap. As of our check on 10 November we found no published application form, and MeitY has only advertised the posts of Chairperson and four Members of the Board, with no appointments announced that we could find. Rule 4 starts on a date. Registrations may not.

Mistakes to avoid

• Reading Rule 4 as an automatic right. The Board can reject.
• Skipping Part B in planning. Rule 4(3) applies it from registration.
• Assuming a fast decision because the text is short.
• Treating information requests under 4(6) as a courtesy. Answer them promptly and in writing.
• Confusing Rule 4 with your own duties as a business. Those sit in other rules and begin in May 2027.

Where RuleExpert fits

RuleExpert is not a registered Consent Manager and cannot file or support an application on the Board’s behalf. If you are applying, its documentation tools, described by the company as a central evidence repository with activity logs and version history, may help you keep inquiry responses consistent. Ask on a demo. If you are a business that will receive instructions from Consent Managers, read how a Consent Manager differs from a consent management platform, then look at our consent module and the free DPDP Scorecard. Book a RuleExpert Demo or see the solution overview. The complete DPDP guide places Rule 4 in context.

Frequently asked questions

What is Rule 4 of the DPDP Rules?

Rule 4 sets out how a Consent Manager is registered with the Data Protection Board, what obligations follow, and how the Board can direct, suspend or cancel a registration. It is in the DPDP Rules, 2025.

When does DPDP Rule 4 come into force?

One year after the Gazette’s publication under Rule 1(3), which is 13 November 2026. Some sources say 14 November, so confirm in the Gazette.

Who can apply under Rule 4?

A person who meets the conditions in Part A of the First Schedule. That includes being a company incorporated in India with net worth of at least ₹2 crore.

What does the Board do after an application?

It may make such inquiry as it deems fit. If satisfied, it registers the applicant, informs it and publishes its particulars. If not, it rejects the application and communicates its reasons.

Is there a deadline for the Board to decide?

Rule 4 states none. Plan for an open-ended wait and avoid promising launch dates to investors or customers.

Can the Board suspend or cancel a Consent Manager?

Yes. Under Rule 4(5), if necessary in the interests of Data Principals, it may do so after a hearing, by an order with reasons recorded in writing.

What is the difference between Rule 4(4) and Rule 4(5)?

Rule 4(4) lets the Board, after a hearing, direct measures to ensure adherence to the Schedule. Rule 4(5) is more serious and allows suspension or cancellation, with directions.

Does Rule 4 say anything about appeal?

Rule 4 itself names no appeal or review route for a rejection or suspension. Check the Act and Rules, and take legal advice before relying on any remedy.

How does Rule 4 relate to Section 6(9) of the Act?

Section 6(9) of the DPDP Act requires Consent Managers to register on prescribed conditions. Rule 4 is the procedure that implements that requirement.

Is there an application fee under Rule 4?

None is stated in Rule 4, and we found none published. The Board will specify application particulars on its website. See our registration guide for the rest of the checklist.