How to Register as a Consent Manager under the DPDP Rules: A Step-by-Step Application Guide

Rule 4 of the DPDP Rules, 2025 starts on 13 November 2026, and with it the route to becoming a registered Consent Manager. There is one awkward fact. In our check on 10 November, we could not find a published application form or portal. The Rule says the Board will specify what an application needs on its own website.

So, the useful work this week is preparation. Here is what the law already settles, the order to do things in, and where applicants tend to come unstuck.

Part A: what you must show

Section 6(9) of the DPDP Act, 2023 says every Consent Manager must be registered with the Board, subject to prescribed technical, operational, financial and other conditions. Those conditions sit in Part A of the First Schedule to the Rules, and Rule 4(1) lets a person who meets them apply. PIB’s note on the notified Rules sums up the first one: Consent Managers must be companies based in India. The left column below is the Schedule. The right column is our suggestion for evidence, since the Board has not yet listed its own. For the wider legal picture, see our explainer on the Consent Manager under the DPDP Act.

Seven steps, in order

1. Test the basics first. Indian company, ₹2 crore net worth, clean management record. If any of these fails, nothing else matters yet.
2. Amend your articles before you file. Part A requires them to bind you to Part B items 9 and 10 (conflicts of interest), and later changes need Board approval. Get the wording right now, while it is still free to change.
3. Design to Part B. The platform must keep data contents unreadable to you, store consent and notice records for at least seven years, and give users access to them. Our 13 November explainer lists the Part B duties.
4. Plan the certification but wait for the standards. The certificate must be against standards and an assurance framework the Board publishes. Part A does not name ISO 27001 or SOC 2. They help as supporting evidence, not as a substitute.
5. Assemble the pack. Use the table above, then compare it with the Board’s list the day it appears.
6. File as the Board directs. Rule 4(1) points to the Board’s website for the particulars, information and documents required.
7. Answer the inquiry. The Board may ask for more. Reply fast and in writing.

Net worth: where startups slip

Part A says net worth of not less than ₹2 crore. How to count it is where applicants slip, and our guide to the ₹2 crore net worth test works through what counts. Settle the basis with your CA and check the Board’s particulars.

Here is the trap, using a hypothetical company. A startup has raised ₹3 crore, so it feels comfortable. But it has booked ₹2.2 crore of accumulated losses. Its net worth is ₹0.8 crore, well short. Funding rounds do not help if the losses keep eating the balance sheet. Work the number from audited accounts, not from the bank balance.

What the Board can do after you apply

• Run whatever inquiry it considers appropriate and ask you for information (Rule 4(2) and 4(6)).
• Register you and publish your particulars on its website or reject you and give reasons.
• After a hearing, direct you to fix a breach of conditions or obligations (Rule 4(4)).
• Suspend or cancel registration by a reasoned order where that protects Data Principals (Rule 4(5)).
• On an intimation of breach of a registration condition, inquire and impose a penalty under Section 27(1)(d) of the Act.

Rule 4 sets no timeline for any of this. MeitY has advertised the posts of Chairperson and four Members of the Board, and we found no announcement of appointments. Do not promise investors a launch date. Our guide to the Data Protection Board explains how it operates.

Mistakes to avoid

• Pitching a consent tool as if it were a Consent Manager. Compare the two in our consent management software guide.
• Buying a generic security certificate before the Board’s standards exist.
• Forgetting that promoters and every shareholder above two per cent must be disclosed once you are registered.
• Treating registration as the finish line. Audits and Board reporting follow.

Where RuleExpert fits

RuleExpert is not a registered Consent Manager, and it cannot file, certify or guarantee an application. If you are applying, one practical use is the evidence pack. RuleExpert describes its audit-ready documentation as a central evidence repository with activity logs and version history. Ask on a demo whether that suits your pack. If you are a business that will use Consent Managers rather than become one, the consent module and the free DPDP Scorecard are the better start. Book a RuleExpert Demo or see our DPDP compliance solution overview. Software supports the work. Legal advice is separate.

Frequently asked questions

How do I register as a Consent Manager under the DPDP Act?

Apply to the Data Protection Board under Rule 4(1) if you meet Part A of the First Schedule, filing the particulars and documents the Board specifies on its website. The Board may inquire, then registers you or rejects you with reasons.

When can I apply?

Rule 4 is scheduled to start on 13 November 2026, though some sources say 14 November. PIB’s own releases give both 13 and 14 November 2025 as the notification date, so confirm the commencement wording in Rule 1 of the Gazette notification. The application particulars depend on the Board publishing them.

Who is eligible to register?

A company incorporated in India that meets all nine Part A conditions, including capacity, sound finances, net worth, management integrity, binding articles and independent certification.

What net worth is required?

Not less than ₹2 crore, worked out from audited accounts with your CA. Our guide to the ₹2 crore net worth test explains what counts.

Is there an application fee?

Rule 4 mentions none, and we found no fee published. The Board specifies application particulars on its website, so check there before budgeting.

How long does registration take?

No one can say yet. Rule 4 sets no deadline for the Board’s inquiry or decision. Plan for uncertainty and avoid fixed launch promises.

What documents will I need?

The Board decides. Expect incorporation papers, audited financials, platform architecture, governance documents and the certification report. The evidence table above is a sensible starting set.

What does independent certification involve?

Part A requires a certificate that your platform meets the data protection standards and assurance framework the Board publishes, and that your controls support Part B. We have not seen those standards yet.

Can the Board reject or cancel my registration?

Yes. Under Rule 4 it can reject with reasons at the start, and later direct fixes or suspend or cancel after a hearing, by a reasoned order. Section 27(1)(d) of the Act also lets it inquire into a breach of registration conditions and impose a penalty.

Can a company that is also a Data Fiduciary become a Consent Manager?

Part A does not bar it by name, but Part B requires avoiding conflicts of interest with Data Fiduciaries. Take legal advice. The complete guide to DPDP in India explains the roles.